2 * Unit tests for security functions
4 * Copyright (c) 2004 Mike McCormack
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
25 #define WIN32_NO_STATUS
35 #include "wine/test.h"
37 /* copied from Wine winternl.h - not included in the Windows SDK */
38 typedef enum _OBJECT_INFORMATION_CLASS {
39 ObjectBasicInformation,
40 ObjectNameInformation,
41 ObjectTypeInformation,
44 } OBJECT_INFORMATION_CLASS, *POBJECT_INFORMATION_CLASS;
46 typedef struct _OBJECT_BASIC_INFORMATION {
48 ACCESS_MASK GrantedAccess;
52 ULONG NonPagedPoolUsage;
54 ULONG NameInformationLength;
55 ULONG TypeInformationLength;
56 ULONG SecurityDescriptorLength;
57 LARGE_INTEGER CreateTime;
58 } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;
60 #define expect_eq(expr, value, type, format) { type ret = expr; ok((value) == ret, #expr " expected " format " got " format "\n", (value), (ret)); }
62 typedef VOID (WINAPI *fnBuildTrusteeWithSidA)( PTRUSTEEA pTrustee, PSID pSid );
63 typedef VOID (WINAPI *fnBuildTrusteeWithNameA)( PTRUSTEEA pTrustee, LPSTR pName );
64 typedef VOID (WINAPI *fnBuildTrusteeWithObjectsAndNameA)( PTRUSTEEA pTrustee,
65 POBJECTS_AND_NAME_A pObjName,
66 SE_OBJECT_TYPE ObjectType,
68 LPSTR InheritedObjectTypeName,
70 typedef VOID (WINAPI *fnBuildTrusteeWithObjectsAndSidA)( PTRUSTEEA pTrustee,
71 POBJECTS_AND_SID pObjSid,
73 GUID* pInheritedObjectGuid,
75 typedef LPSTR (WINAPI *fnGetTrusteeNameA)( PTRUSTEEA pTrustee );
76 typedef BOOL (WINAPI *fnMakeSelfRelativeSD)( PSECURITY_DESCRIPTOR, PSECURITY_DESCRIPTOR, LPDWORD );
77 typedef BOOL (WINAPI *fnConvertSidToStringSidA)( PSID pSid, LPSTR *str );
78 typedef BOOL (WINAPI *fnConvertStringSidToSidA)( LPCSTR str, PSID pSid );
79 static BOOL (WINAPI *pConvertStringSecurityDescriptorToSecurityDescriptorA)(LPCSTR, DWORD,
80 PSECURITY_DESCRIPTOR*, PULONG );
81 static BOOL (WINAPI *pConvertSecurityDescriptorToStringSecurityDescriptorA)(PSECURITY_DESCRIPTOR, DWORD,
82 SECURITY_INFORMATION, LPSTR *, PULONG );
83 typedef BOOL (WINAPI *fnGetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
84 PSECURITY_DESCRIPTOR, DWORD, LPDWORD);
85 static DWORD (WINAPI *pGetNamedSecurityInfoA)(LPSTR, SE_OBJECT_TYPE, SECURITY_INFORMATION,
86 PSID*, PSID*, PACL*, PACL*,
87 PSECURITY_DESCRIPTOR*);
88 typedef DWORD (WINAPI *fnRtlAdjustPrivilege)(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
89 typedef BOOL (WINAPI *fnCreateWellKnownSid)(WELL_KNOWN_SID_TYPE,PSID,PSID,DWORD*);
90 typedef BOOL (WINAPI *fnDuplicateTokenEx)(HANDLE,DWORD,LPSECURITY_ATTRIBUTES,
91 SECURITY_IMPERSONATION_LEVEL,TOKEN_TYPE,PHANDLE);
93 typedef NTSTATUS (WINAPI *fnLsaQueryInformationPolicy)(LSA_HANDLE,POLICY_INFORMATION_CLASS,PVOID*);
94 typedef NTSTATUS (WINAPI *fnLsaClose)(LSA_HANDLE);
95 typedef NTSTATUS (WINAPI *fnLsaFreeMemory)(PVOID);
96 typedef NTSTATUS (WINAPI *fnLsaOpenPolicy)(PLSA_UNICODE_STRING,PLSA_OBJECT_ATTRIBUTES,ACCESS_MASK,PLSA_HANDLE);
97 static NTSTATUS (WINAPI *pNtQueryObject)(HANDLE,OBJECT_INFORMATION_CLASS,PVOID,ULONG,PULONG);
98 static DWORD (WINAPI *pSetEntriesInAclW)(ULONG, PEXPLICIT_ACCESSW, PACL, PACL*);
102 static char** myARGV;
104 fnBuildTrusteeWithSidA pBuildTrusteeWithSidA;
105 fnBuildTrusteeWithNameA pBuildTrusteeWithNameA;
106 fnBuildTrusteeWithObjectsAndNameA pBuildTrusteeWithObjectsAndNameA;
107 fnBuildTrusteeWithObjectsAndSidA pBuildTrusteeWithObjectsAndSidA;
108 fnGetTrusteeNameA pGetTrusteeNameA;
109 fnMakeSelfRelativeSD pMakeSelfRelativeSD;
110 fnConvertSidToStringSidA pConvertSidToStringSidA;
111 fnConvertStringSidToSidA pConvertStringSidToSidA;
112 fnGetFileSecurityA pGetFileSecurityA;
113 fnRtlAdjustPrivilege pRtlAdjustPrivilege;
114 fnCreateWellKnownSid pCreateWellKnownSid;
115 fnDuplicateTokenEx pDuplicateTokenEx;
116 fnLsaQueryInformationPolicy pLsaQueryInformationPolicy;
117 fnLsaClose pLsaClose;
118 fnLsaFreeMemory pLsaFreeMemory;
119 fnLsaOpenPolicy pLsaOpenPolicy;
123 SID_IDENTIFIER_AUTHORITY auth;
127 static void init(void)
131 hntdll = GetModuleHandleA("ntdll.dll");
132 pNtQueryObject = (void *)GetProcAddress( hntdll, "NtQueryObject" );
134 hmod = GetModuleHandle("advapi32.dll");
135 pConvertStringSecurityDescriptorToSecurityDescriptorA =
136 (void *)GetProcAddress(hmod, "ConvertStringSecurityDescriptorToSecurityDescriptorA" );
137 pConvertSecurityDescriptorToStringSecurityDescriptorA =
138 (void *)GetProcAddress(hmod, "ConvertSecurityDescriptorToStringSecurityDescriptorA" );
139 pMakeSelfRelativeSD = (void *)GetProcAddress(hmod, "MakeSelfRelativeSD");
140 pGetNamedSecurityInfoA = (void *)GetProcAddress(hmod, "GetNamedSecurityInfoA");
141 pSetEntriesInAclW = (void *)GetProcAddress(hmod, "SetEntriesInAclW");
143 myARGC = winetest_get_mainargs( &myARGV );
146 static void test_str_sid(const char *str_sid)
151 if (pConvertStringSidToSidA(str_sid, &psid))
153 if (pConvertSidToStringSidA(psid, &temp))
155 trace(" %s: %s\n", str_sid, temp);
162 if (GetLastError() != ERROR_INVALID_SID)
163 trace(" %s: couldn't be converted, returned %d\n", str_sid, GetLastError());
165 trace(" %s: couldn't be converted\n", str_sid);
169 static void test_sid(void)
171 struct sidRef refs[] = {
172 { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
173 { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1" },
174 { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1" },
175 { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1" },
176 { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1" },
177 { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1" },
179 const char noSubAuthStr[] = "S-1-5";
186 pConvertSidToStringSidA = (fnConvertSidToStringSidA)
187 GetProcAddress( hmod, "ConvertSidToStringSidA" );
188 if( !pConvertSidToStringSidA )
190 pConvertStringSidToSidA = (fnConvertStringSidToSidA)
191 GetProcAddress( hmod, "ConvertStringSidToSidA" );
192 if( !pConvertStringSidToSidA )
195 r = pConvertStringSidToSidA( NULL, NULL );
196 ok( !r, "expected failure with NULL parameters\n" );
197 if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED )
199 ok( GetLastError() == ERROR_INVALID_PARAMETER,
200 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
203 r = pConvertStringSidToSidA( refs[0].refStr, NULL );
204 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
205 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
208 r = pConvertStringSidToSidA( NULL, &str );
209 ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
210 "expected GetLastError() is ERROR_INVALID_PARAMETER, got %d\n",
213 r = pConvertStringSidToSidA( noSubAuthStr, &psid );
215 "expected failure with no sub authorities\n" );
216 ok( GetLastError() == ERROR_INVALID_SID,
217 "expected GetLastError() is ERROR_INVALID_SID, got %d\n",
220 ok(pConvertStringSidToSidA("S-1-5-21-93476-23408-4576", &psid), "ConvertStringSidToSidA failed\n");
222 ok(pisid->SubAuthorityCount == 4, "Invalid sub authority count - expected 4, got %d\n", pisid->SubAuthorityCount);
223 ok(pisid->SubAuthority[0] == 21, "Invalid subauthority 0 - expceted 21, got %d\n", pisid->SubAuthority[0]);
224 ok(pisid->SubAuthority[3] == 4576, "Invalid subauthority 0 - expceted 4576, got %d\n", pisid->SubAuthority[3]);
227 for( i = 0; i < sizeof(refs) / sizeof(refs[0]); i++ )
231 r = AllocateAndInitializeSid( &refs[i].auth, 1,1,0,0,0,0,0,0,0,
233 ok( r, "failed to allocate sid\n" );
234 r = pConvertSidToStringSidA( psid, &str );
235 ok( r, "failed to convert sid\n" );
238 ok( !strcmp( str, refs[i].refStr ),
239 "incorrect sid, expected %s, got %s\n", refs[i].refStr, str );
245 r = pConvertStringSidToSidA( refs[i].refStr, &psid );
246 ok( r, "failed to parse sid string\n" );
249 !memcmp( pisid->IdentifierAuthority.Value, refs[i].auth.Value,
250 sizeof(refs[i].auth) ),
251 "string sid %s didn't parse to expected value\n"
252 "(got 0x%04x%08x, expected 0x%04x%08x)\n",
254 MAKEWORD( pisid->IdentifierAuthority.Value[1],
255 pisid->IdentifierAuthority.Value[0] ),
256 MAKELONG( MAKEWORD( pisid->IdentifierAuthority.Value[5],
257 pisid->IdentifierAuthority.Value[4] ),
258 MAKEWORD( pisid->IdentifierAuthority.Value[3],
259 pisid->IdentifierAuthority.Value[2] ) ),
260 MAKEWORD( refs[i].auth.Value[1], refs[i].auth.Value[0] ),
261 MAKELONG( MAKEWORD( refs[i].auth.Value[5], refs[i].auth.Value[4] ),
262 MAKEWORD( refs[i].auth.Value[3], refs[i].auth.Value[2] ) ) );
267 trace("String SIDs:\n");
308 static void test_trustee(void)
310 GUID ObjectType = {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
311 GUID InheritedObjectType = {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
313 OBJECTS_AND_NAME_ oan;
317 char szObjectTypeName[] = "ObjectTypeName";
318 char szInheritedObjectTypeName[] = "InheritedObjectTypeName";
319 char szTrusteeName[] = "szTrusteeName";
320 SID_IDENTIFIER_AUTHORITY auth = { {0x11,0x22,0,0,0, 0} };
322 memset( &ZeroGuid, 0x00, sizeof (ZeroGuid) );
324 pBuildTrusteeWithSidA = (fnBuildTrusteeWithSidA)
325 GetProcAddress( hmod, "BuildTrusteeWithSidA" );
326 pBuildTrusteeWithNameA = (fnBuildTrusteeWithNameA)
327 GetProcAddress( hmod, "BuildTrusteeWithNameA" );
328 pBuildTrusteeWithObjectsAndNameA = (fnBuildTrusteeWithObjectsAndNameA)
329 GetProcAddress (hmod, "BuildTrusteeWithObjectsAndNameA" );
330 pBuildTrusteeWithObjectsAndSidA = (fnBuildTrusteeWithObjectsAndSidA)
331 GetProcAddress (hmod, "BuildTrusteeWithObjectsAndSidA" );
332 pGetTrusteeNameA = (fnGetTrusteeNameA)
333 GetProcAddress (hmod, "GetTrusteeNameA" );
334 if( !pBuildTrusteeWithSidA || !pBuildTrusteeWithNameA ||
335 !pBuildTrusteeWithObjectsAndNameA || !pBuildTrusteeWithObjectsAndSidA ||
339 if ( ! AllocateAndInitializeSid( &auth, 1, 42, 0,0,0,0,0,0,0,&psid ) )
341 trace( "failed to init SID\n" );
345 /* test BuildTrusteeWithSidA */
346 memset( &trustee, 0xff, sizeof trustee );
347 pBuildTrusteeWithSidA( &trustee, psid );
349 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
350 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
351 "MultipleTrusteeOperation wrong\n");
352 ok( trustee.TrusteeForm == TRUSTEE_IS_SID, "TrusteeForm wrong\n");
353 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
354 ok( trustee.ptstrName == (LPSTR) psid, "ptstrName wrong\n" );
356 /* test BuildTrusteeWithObjectsAndSidA (test 1) */
357 memset( &trustee, 0xff, sizeof trustee );
358 memset( &oas, 0xff, sizeof(oas) );
359 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, &ObjectType,
360 &InheritedObjectType, psid);
362 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
363 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
364 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
365 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
366 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
368 ok(oas.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
369 ok(!memcmp(&oas.ObjectTypeGuid, &ObjectType, sizeof(GUID)), "ObjectTypeGuid wrong\n");
370 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
371 ok(oas.pSid == psid, "pSid wrong\n");
373 /* test GetTrusteeNameA */
374 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oas, "GetTrusteeName returned wrong value\n");
376 /* test BuildTrusteeWithObjectsAndSidA (test 2) */
377 memset( &trustee, 0xff, sizeof trustee );
378 memset( &oas, 0xff, sizeof(oas) );
379 pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, NULL,
380 &InheritedObjectType, psid);
382 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
383 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
384 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
385 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
386 ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
388 ok(oas.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
389 ok(!memcmp(&oas.ObjectTypeGuid, &ZeroGuid, sizeof(GUID)), "ObjectTypeGuid wrong\n");
390 ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
391 ok(oas.pSid == psid, "pSid wrong\n");
395 /* test BuildTrusteeWithNameA */
396 memset( &trustee, 0xff, sizeof trustee );
397 pBuildTrusteeWithNameA( &trustee, szTrusteeName );
399 ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
400 ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
401 "MultipleTrusteeOperation wrong\n");
402 ok( trustee.TrusteeForm == TRUSTEE_IS_NAME, "TrusteeForm wrong\n");
403 ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
404 ok( trustee.ptstrName == szTrusteeName, "ptstrName wrong\n" );
406 /* test BuildTrusteeWithObjectsAndNameA (test 1) */
407 memset( &trustee, 0xff, sizeof trustee );
408 memset( &oan, 0xff, sizeof(oan) );
409 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
410 szInheritedObjectTypeName, szTrusteeName);
412 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
413 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
414 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
415 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
416 ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
418 ok(oan.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
419 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
420 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
421 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
423 /* test GetTrusteeNameA */
424 ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oan, "GetTrusteeName returned wrong value\n");
426 /* test BuildTrusteeWithObjectsAndNameA (test 2) */
427 memset( &trustee, 0xff, sizeof trustee );
428 memset( &oan, 0xff, sizeof(oan) );
429 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, NULL,
430 szInheritedObjectTypeName, szTrusteeName);
432 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
433 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
434 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
435 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
436 ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
438 ok(oan.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
439 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
440 ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
441 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
443 /* test BuildTrusteeWithObjectsAndNameA (test 3) */
444 memset( &trustee, 0xff, sizeof trustee );
445 memset( &oan, 0xff, sizeof(oan) );
446 pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
447 NULL, szTrusteeName);
449 ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
450 ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
451 ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
452 ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
453 ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
455 ok(oan.ObjectsPresent == ACE_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
456 ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
457 ok(oan.InheritedObjectTypeName == NULL, "InheritedObjectTypeName wrong\n");
458 ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
461 /* If the first isn't defined, assume none is */
462 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
463 #define SE_MIN_WELL_KNOWN_PRIVILEGE 2L
464 #define SE_CREATE_TOKEN_PRIVILEGE 2L
465 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3L
466 #define SE_LOCK_MEMORY_PRIVILEGE 4L
467 #define SE_INCREASE_QUOTA_PRIVILEGE 5L
468 #define SE_MACHINE_ACCOUNT_PRIVILEGE 6L
469 #define SE_TCB_PRIVILEGE 7L
470 #define SE_SECURITY_PRIVILEGE 8L
471 #define SE_TAKE_OWNERSHIP_PRIVILEGE 9L
472 #define SE_LOAD_DRIVER_PRIVILEGE 10L
473 #define SE_SYSTEM_PROFILE_PRIVILEGE 11L
474 #define SE_SYSTEMTIME_PRIVILEGE 12L
475 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
476 #define SE_INC_BASE_PRIORITY_PRIVILEGE 14L
477 #define SE_CREATE_PAGEFILE_PRIVILEGE 15L
478 #define SE_CREATE_PERMANENT_PRIVILEGE 16L
479 #define SE_BACKUP_PRIVILEGE 17L
480 #define SE_RESTORE_PRIVILEGE 18L
481 #define SE_SHUTDOWN_PRIVILEGE 19L
482 #define SE_DEBUG_PRIVILEGE 20L
483 #define SE_AUDIT_PRIVILEGE 21L
484 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22L
485 #define SE_CHANGE_NOTIFY_PRIVILLEGE 23L
486 #define SE_REMOTE_SHUTDOWN_PRIVILEGE 24L
487 #define SE_UNDOCK_PRIVILEGE 25L
488 #define SE_SYNC_AGENT_PRIVILEGE 26L
489 #define SE_ENABLE_DELEGATION_PRIVILEGE 27L
490 #define SE_MANAGE_VOLUME_PRIVILEGE 28L
491 #define SE_IMPERSONATE_PRIVILEGE 29L
492 #define SE_CREATE_GLOBAL_PRIVILEGE 30L
493 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_GLOBAL_PRIVILEGE
494 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
496 static void test_allocateLuid(void)
498 BOOL (WINAPI *pAllocateLocallyUniqueId)(PLUID);
502 pAllocateLocallyUniqueId = (void*)GetProcAddress(hmod, "AllocateLocallyUniqueId");
503 if (!pAllocateLocallyUniqueId) return;
505 ret = pAllocateLocallyUniqueId(&luid1);
506 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
510 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
511 ret = pAllocateLocallyUniqueId(&luid2);
513 "AllocateLocallyUniqueId failed: %d\n", GetLastError());
514 ok(luid1.LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE || luid1.HighPart != 0,
515 "AllocateLocallyUniqueId returned a well-known LUID\n");
516 ok(luid1.LowPart != luid2.LowPart || luid1.HighPart != luid2.HighPart,
517 "AllocateLocallyUniqueId returned non-unique LUIDs\n");
518 ret = pAllocateLocallyUniqueId(NULL);
519 ok( !ret && GetLastError() == ERROR_NOACCESS,
520 "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %d\n",
524 static void test_lookupPrivilegeName(void)
526 BOOL (WINAPI *pLookupPrivilegeNameA)(LPCSTR, PLUID, LPSTR, LPDWORD);
527 char buf[MAX_PATH]; /* arbitrary, seems long enough */
528 DWORD cchName = sizeof(buf);
529 LUID luid = { 0, 0 };
533 /* check whether it's available first */
534 pLookupPrivilegeNameA = (void*)GetProcAddress(hmod, "LookupPrivilegeNameA");
535 if (!pLookupPrivilegeNameA) return;
536 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
537 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
538 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
541 /* check with a short buffer */
543 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
544 ret = pLookupPrivilegeNameA(NULL, &luid, NULL, &cchName);
545 ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
546 "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %d\n",
548 ok(cchName == strlen("SeCreateTokenPrivilege") + 1,
549 "LookupPrivilegeNameA returned an incorrect required length for\n"
550 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
551 lstrlenA("SeCreateTokenPrivilege") + 1);
552 /* check a known value and its returned length on success */
553 cchName = sizeof(buf);
554 ok(pLookupPrivilegeNameA(NULL, &luid, buf, &cchName) &&
555 cchName == strlen("SeCreateTokenPrivilege"),
556 "LookupPrivilegeNameA returned an incorrect output length for\n"
557 "SeCreateTokenPrivilege (got %d, expected %d)\n", cchName,
558 (int)strlen("SeCreateTokenPrivilege"));
559 /* check known values */
560 for (i = SE_MIN_WELL_KNOWN_PRIVILEGE; i < SE_MAX_WELL_KNOWN_PRIVILEGE; i++)
563 cchName = sizeof(buf);
564 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
565 ok( ret || GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
566 "LookupPrivilegeNameA(0.%d) failed: %d\n", i, GetLastError());
568 /* check a bogus LUID */
569 luid.LowPart = 0xdeadbeef;
570 cchName = sizeof(buf);
571 ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
572 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
573 "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
575 /* check on a bogus system */
576 luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
577 cchName = sizeof(buf);
578 ret = pLookupPrivilegeNameA("b0gu5.Nam3", &luid, buf, &cchName);
579 ok( !ret && GetLastError() == RPC_S_SERVER_UNAVAILABLE,
580 "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
590 static void test_lookupPrivilegeValue(void)
592 static const struct NameToLUID privs[] = {
593 { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE },
594 { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE },
595 { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE },
596 { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE },
597 { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE },
598 { "SeTcbPrivilege", SE_TCB_PRIVILEGE },
599 { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE },
600 { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE },
601 { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE },
602 { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE },
603 { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE },
604 { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE },
605 { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE },
606 { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE },
607 { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE },
608 { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE },
609 { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE },
610 { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE },
611 { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE },
612 { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE },
613 { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE },
614 { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILLEGE },
615 { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE },
616 { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE },
617 { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE },
618 { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE },
619 { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE },
620 { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE },
621 { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE },
623 BOOL (WINAPI *pLookupPrivilegeValueA)(LPCSTR, LPCSTR, PLUID);
628 /* check whether it's available first */
629 pLookupPrivilegeValueA = (void*)GetProcAddress(hmod, "LookupPrivilegeValueA");
630 if (!pLookupPrivilegeValueA) return;
631 ret = pLookupPrivilegeValueA(NULL, "SeCreateTokenPrivilege", &luid);
632 if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
635 /* check a bogus system name */
636 ret = pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid);
637 ok( !ret && GetLastError() == RPC_S_SERVER_UNAVAILABLE,
638 "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE: %d\n",
640 /* check a NULL string */
641 ret = pLookupPrivilegeValueA(NULL, 0, &luid);
642 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
643 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
645 /* check a bogus privilege name */
646 ret = pLookupPrivilegeValueA(NULL, "SeBogusPrivilege", &luid);
647 ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
648 "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %d\n",
650 /* check case insensitive */
651 ret = pLookupPrivilegeValueA(NULL, "sEcREATEtOKENpRIVILEGE", &luid);
653 "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %d\n",
655 for (i = 0; i < sizeof(privs) / sizeof(privs[0]); i++)
657 /* Not all privileges are implemented on all Windows versions, so
658 * don't worry if the call fails
660 if (pLookupPrivilegeValueA(NULL, privs[i].name, &luid))
662 ok(luid.LowPart == privs[i].lowPart,
663 "LookupPrivilegeValueA returned an invalid LUID for %s\n",
669 static void test_luid(void)
672 test_lookupPrivilegeName();
673 test_lookupPrivilegeValue();
676 static void test_FileSecurity(void)
678 char directory[MAX_PATH];
679 DWORD retval, outSize;
683 pGetFileSecurityA = (fnGetFileSecurityA)
684 GetProcAddress( hmod, "GetFileSecurityA" );
685 if( !pGetFileSecurityA )
688 retval = GetTempPathA(sizeof(directory), directory);
690 trace("GetTempPathA failed\n");
694 strcpy(directory, "\\Should not exist");
696 SetLastError(NO_ERROR);
697 result = pGetFileSecurityA( directory,OWNER_SECURITY_INFORMATION,buffer,0x40,&outSize);
698 ok(!result, "GetFileSecurityA should fail for not existing directories/files\n");
699 ok( (GetLastError() == ERROR_FILE_NOT_FOUND ) ||
700 (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED) ,
701 "last error ERROR_FILE_NOT_FOUND / ERROR_CALL_NOT_IMPLEMENTED (98) "
702 "expected, got %d\n", GetLastError());
705 static void test_AccessCheck(void)
707 PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL;
709 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
710 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
711 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
712 GENERIC_MAPPING Mapping = { KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS };
719 PRIVILEGE_SET *PrivSet;
725 NtDllModule = GetModuleHandle("ntdll.dll");
728 skip("not running on NT, skipping test\n");
731 pRtlAdjustPrivilege = (fnRtlAdjustPrivilege)
732 GetProcAddress(NtDllModule, "RtlAdjustPrivilege");
733 if (!pRtlAdjustPrivilege)
735 skip("missing RtlAdjustPrivilege, skipping test\n");
739 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
740 res = InitializeAcl(Acl, 256, ACL_REVISION);
741 if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
743 skip("ACLs not implemented - skipping tests\n");
744 HeapFree(GetProcessHeap(), 0, Acl);
747 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
749 res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
750 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
752 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
753 DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdminSid);
754 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
756 res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
757 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
758 ok(res, "AllocateAndInitializeSid failed with error %d\n", GetLastError());
760 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
762 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
763 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
765 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
766 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
768 PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
769 PrivSet = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PrivSetLen);
770 PrivSet->PrivilegeCount = 16;
772 res = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &ProcessToken);
773 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
775 pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, FALSE, TRUE, &Enabled);
777 res = DuplicateToken(ProcessToken, SecurityIdentification, &Token);
778 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
780 /* SD without owner/group */
781 SetLastError(0xdeadbeef);
782 Access = AccessStatus = 0xdeadbeef;
783 ret = AccessCheck(SecurityDescriptor, Token, KEY_QUERY_VALUE, &Mapping,
784 PrivSet, &PrivSetLen, &Access, &AccessStatus);
785 err = GetLastError();
786 ok(!ret && err == ERROR_INVALID_SECURITY_DESCR, "AccessCheck should have "
787 "failed with ERROR_INVALID_SECURITY_DESCR, instead of %d\n", err);
788 ok(Access == 0xdeadbeef && AccessStatus == 0xdeadbeef,
789 "Access and/or AccessStatus were changed!\n");
791 /* Set owner and group */
792 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
793 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
794 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, TRUE);
795 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
797 /* Generic access mask */
798 SetLastError(0xdeadbeef);
799 ret = AccessCheck(SecurityDescriptor, Token, GENERIC_READ, &Mapping,
800 PrivSet, &PrivSetLen, &Access, &AccessStatus);
801 err = GetLastError();
802 ok(!ret && err == ERROR_GENERIC_NOT_MAPPED, "AccessCheck should have failed "
803 "with ERROR_GENERIC_NOT_MAPPED, instead of %d\n", err);
804 ok(Access == 0xdeadbeef && AccessStatus == 0xdeadbeef,
805 "Access and/or AccessStatus were changed!\n");
807 /* sd with no dacl present */
808 ret = SetSecurityDescriptorDacl(SecurityDescriptor, FALSE, NULL, FALSE);
809 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
810 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
811 PrivSet, &PrivSetLen, &Access, &AccessStatus);
812 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
813 ok(AccessStatus && (Access == KEY_READ),
814 "AccessCheck failed to grant access with error %d\n",
817 /* sd with NULL dacl */
818 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, NULL, FALSE);
819 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
820 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
821 PrivSet, &PrivSetLen, &Access, &AccessStatus);
822 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
823 ok(AccessStatus && (Access == KEY_READ),
824 "AccessCheck failed to grant access with error %d\n",
827 /* sd with blank dacl */
828 ret = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
829 ok(ret, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
830 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
831 PrivSet, &PrivSetLen, &Access, &AccessStatus);
832 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
833 err = GetLastError();
834 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
835 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
836 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
838 res = AddAccessAllowedAce(Acl, ACL_REVISION, KEY_READ, EveryoneSid);
839 ok(res, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
841 res = AddAccessDeniedAce(Acl, ACL_REVISION, KEY_SET_VALUE, AdminSid);
842 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
845 ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
846 PrivSet, &PrivSetLen, &Access, &AccessStatus);
847 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
848 ok(AccessStatus && (Access == KEY_READ),
849 "AccessCheck failed to grant access with error %d\n",
852 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
853 PrivSet, &PrivSetLen, &Access, &AccessStatus);
854 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
856 "AccessCheck failed to grant any access with error %d\n",
858 trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08x\n", Access);
860 /* Access denied by SD */
861 SetLastError(0xdeadbeef);
862 ret = AccessCheck(SecurityDescriptor, Token, KEY_WRITE, &Mapping,
863 PrivSet, &PrivSetLen, &Access, &AccessStatus);
864 ok(ret, "AccessCheck failed with error %d\n", GetLastError());
865 err = GetLastError();
866 ok(!AccessStatus && err == ERROR_ACCESS_DENIED, "AccessCheck should have failed "
867 "with ERROR_ACCESS_DENIED, instead of %d\n", err);
868 ok(!Access, "Should have failed to grant any access, got 0x%08x\n", Access);
871 PrivSet->PrivilegeCount = 16;
872 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
873 PrivSet, &PrivSetLen, &Access, &AccessStatus);
874 ok(ret && !AccessStatus && GetLastError() == ERROR_PRIVILEGE_NOT_HELD,
875 "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %d\n",
878 ret = pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, TRUE, TRUE, &Enabled);
882 PrivSet->PrivilegeCount = 16;
883 ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
884 PrivSet, &PrivSetLen, &Access, &AccessStatus);
885 ok(ret && AccessStatus && GetLastError() == 0,
886 "AccessCheck should have succeeded, error %d\n",
888 ok(Access == ACCESS_SYSTEM_SECURITY,
889 "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08x\n",
893 trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
898 res = DuplicateToken(ProcessToken, SecurityAnonymous, &Token);
899 ok(res, "DuplicateToken failed with error %d\n", GetLastError());
901 SetLastError(0xdeadbeef);
902 ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
903 PrivSet, &PrivSetLen, &Access, &AccessStatus);
904 err = GetLastError();
905 ok(!ret && err == ERROR_BAD_IMPERSONATION_LEVEL, "AccessCheck should have failed "
906 "with ERROR_BAD_IMPERSONATION_LEVEL, instead of %d\n", err);
910 SetLastError(0xdeadbeef);
911 ret = AccessCheck(SecurityDescriptor, ProcessToken, KEY_READ, &Mapping,
912 PrivSet, &PrivSetLen, &Access, &AccessStatus);
913 err = GetLastError();
914 ok(!ret && err == ERROR_NO_IMPERSONATION_TOKEN, "AccessCheck should have failed "
915 "with ERROR_NO_IMPERSONATION_TOKEN, instead of %d\n", err);
917 CloseHandle(ProcessToken);
920 FreeSid(EveryoneSid);
925 HeapFree(GetProcessHeap(), 0, Acl);
926 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
927 HeapFree(GetProcessHeap(), 0, PrivSet);
930 /* test GetTokenInformation for the various attributes */
931 static void test_token_attr(void)
933 HANDLE Token, ImpersonationToken;
935 TOKEN_PRIVILEGES *Privileges;
936 TOKEN_GROUPS *Groups;
941 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
943 /* cygwin-like use case */
944 SetLastError(0xdeadbeef);
945 ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &Token);
946 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
948 skip("OpenProcessToken is not implemented\n");
951 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
956 ret = GetTokenInformation(Token, TokenUser,(void*)buf, Size, &Size);
957 ok(ret, "GetTokenInformation failed with error %d\n", GetLastError());
958 Size = sizeof(ImpersonationLevel);
959 ret = GetTokenInformation(Token, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
960 GLE = GetLastError();
961 ok(!ret && (GLE == ERROR_INVALID_PARAMETER), "GetTokenInformation(TokenImpersonationLevel) on primary token should have failed with ERROR_INVALID_PARAMETER instead of %d\n", GLE);
965 if(!pConvertSidToStringSidA)
967 skip("ConvertSidToStringSidA is not available\n");
971 SetLastError(0xdeadbeef);
972 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY|TOKEN_DUPLICATE, &Token);
973 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
976 ret = GetTokenInformation(Token, TokenGroups, NULL, 0, &Size);
977 Groups = HeapAlloc(GetProcessHeap(), 0, Size);
978 ret = GetTokenInformation(Token, TokenGroups, Groups, Size, &Size);
979 ok(ret, "GetTokenInformation(TokenGroups) failed with error %d\n", GetLastError());
980 trace("TokenGroups:\n");
981 for (i = 0; i < Groups->GroupCount; i++)
983 DWORD NameLength = 255;
985 DWORD DomainLength = 255;
987 SID_NAME_USE SidNameUse;
988 pConvertSidToStringSidA(Groups->Groups[i].Sid, &SidString);
991 ret = LookupAccountSid(NULL, Groups->Groups[i].Sid, Name, &NameLength, Domain, &DomainLength, &SidNameUse);
993 trace("\t%s, %s\\%s use: %d attr: 0x%08x\n", SidString, Domain, Name, SidNameUse, Groups->Groups[i].Attributes);
995 trace("\t%s, attr: 0x%08x LookupAccountSid failed with error %d\n", SidString, Groups->Groups[i].Attributes, GetLastError());
996 LocalFree(SidString);
998 HeapFree(GetProcessHeap(), 0, Groups);
1001 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
1002 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1003 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1004 User = HeapAlloc(GetProcessHeap(), 0, Size);
1005 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
1007 "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1009 pConvertSidToStringSidA(User->User.Sid, &SidString);
1010 trace("TokenUser: %s attr: 0x%08x\n", SidString, User->User.Attributes);
1011 LocalFree(SidString);
1012 HeapFree(GetProcessHeap(), 0, User);
1015 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
1016 ok(!ret && (GetLastError() == ERROR_INSUFFICIENT_BUFFER),
1017 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1018 Privileges = HeapAlloc(GetProcessHeap(), 0, Size);
1019 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
1021 "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1022 trace("TokenPrivileges:\n");
1023 for (i = 0; i < Privileges->PrivilegeCount; i++)
1026 DWORD NameLen = sizeof(Name)/sizeof(Name[0]);
1027 LookupPrivilegeName(NULL, &Privileges->Privileges[i].Luid, Name, &NameLen);
1028 trace("\t%s, 0x%x\n", Name, Privileges->Privileges[i].Attributes);
1030 HeapFree(GetProcessHeap(), 0, Privileges);
1032 ret = DuplicateToken(Token, SecurityAnonymous, &ImpersonationToken);
1033 ok(ret, "DuplicateToken failed with error %d\n", GetLastError());
1035 Size = sizeof(ImpersonationLevel);
1036 ret = GetTokenInformation(ImpersonationToken, TokenImpersonationLevel, &ImpersonationLevel, Size, &Size);
1037 ok(ret, "GetTokenInformation(TokenImpersonationLevel) failed with error %d\n", GetLastError());
1038 ok(ImpersonationLevel == SecurityAnonymous, "ImpersonationLevel should have been SecurityAnonymous instead of %d\n", ImpersonationLevel);
1040 CloseHandle(ImpersonationToken);
1044 typedef union _MAX_SID
1047 char max[SECURITY_MAX_SID_SIZE];
1050 static void test_sid_str(PSID * sid)
1053 BOOL ret = pConvertSidToStringSidA(sid, &str_sid);
1054 ok(ret, "ConvertSidToStringSidA() failed: %d\n", GetLastError());
1057 char account[MAX_PATH], domain[MAX_PATH];
1059 DWORD acc_size = MAX_PATH;
1060 DWORD dom_size = MAX_PATH;
1061 ret = LookupAccountSid(NULL, sid, account, &acc_size, domain, &dom_size, &use);
1062 ok(ret || (!ret && (GetLastError() == ERROR_NONE_MAPPED)),
1063 "LookupAccountSid(%s) failed: %d\n", str_sid, GetLastError());
1065 trace(" %s %s\\%s %d\n", str_sid, domain, account, use);
1066 else if (GetLastError() == ERROR_NONE_MAPPED)
1067 trace(" %s couldn't be mapped\n", str_sid);
1072 static void test_LookupAccountSid(void)
1074 SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
1075 CHAR accountA[MAX_PATH], domainA[MAX_PATH];
1076 DWORD acc_sizeA, dom_sizeA;
1077 DWORD real_acc_sizeA, real_dom_sizeA;
1078 WCHAR accountW[MAX_PATH], domainW[MAX_PATH];
1079 DWORD acc_sizeW, dom_sizeW;
1080 DWORD real_acc_sizeW, real_dom_sizeW;
1081 PSID pUsersSid = NULL;
1089 /* native windows crashes if account size, domain size, or name use is NULL */
1091 ret = AllocateAndInitializeSid(&SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
1092 DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &pUsersSid);
1093 ok(ret || (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED),
1094 "AllocateAndInitializeSid failed with error %d\n", GetLastError());
1096 /* not running on NT so give up */
1097 if (!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1100 real_acc_sizeA = MAX_PATH;
1101 real_dom_sizeA = MAX_PATH;
1102 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &real_acc_sizeA, domainA, &real_dom_sizeA, &use);
1103 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1105 /* try NULL account */
1106 acc_sizeA = MAX_PATH;
1107 dom_sizeA = MAX_PATH;
1108 ret = LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1109 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1111 /* try NULL domain */
1112 acc_sizeA = MAX_PATH;
1113 dom_sizeA = MAX_PATH;
1114 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1115 ok(ret, "LookupAccountSidA() Expected TRUE, got FALSE\n");
1117 /* try a small account buffer */
1119 dom_sizeA = MAX_PATH;
1121 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1122 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1123 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1124 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1126 /* try a 0 sized account buffer */
1128 dom_sizeA = MAX_PATH;
1130 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1131 /* this can fail or succeed depending on OS version but the size will always be returned */
1132 ok(acc_sizeA == real_acc_sizeA + 1,
1133 "LookupAccountSidA() Expected acc_size = %u, got %u\n",
1134 real_acc_sizeA + 1, acc_sizeA);
1136 /* try a 0 sized account buffer */
1138 dom_sizeA = MAX_PATH;
1139 ret = LookupAccountSidA(NULL, pUsersSid, NULL, &acc_sizeA, domainA, &dom_sizeA, &use);
1140 /* this can fail or succeed depending on OS version but the size will always be returned */
1141 ok(acc_sizeA == real_acc_sizeA + 1,
1142 "LookupAccountSid() Expected acc_size = %u, got %u\n",
1143 real_acc_sizeA + 1, acc_sizeA);
1145 /* try a small domain buffer */
1147 acc_sizeA = MAX_PATH;
1149 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1150 ok(!ret, "LookupAccountSidA() Expected FALSE got TRUE\n");
1151 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1152 "LookupAccountSidA() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1154 /* try a 0 sized domain buffer */
1156 acc_sizeA = MAX_PATH;
1158 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use);
1159 /* this can fail or succeed depending on OS version but the size will always be returned */
1160 ok(dom_sizeA == real_dom_sizeA + 1,
1161 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1162 real_dom_sizeA + 1, dom_sizeA);
1164 /* try a 0 sized domain buffer */
1166 acc_sizeA = MAX_PATH;
1167 ret = LookupAccountSidA(NULL, pUsersSid, accountA, &acc_sizeA, NULL, &dom_sizeA, &use);
1168 /* this can fail or succeed depending on OS version but the size will always be returned */
1169 ok(dom_sizeA == real_dom_sizeA + 1,
1170 "LookupAccountSidA() Expected dom_size = %u, got %u\n",
1171 real_dom_sizeA + 1, dom_sizeA);
1173 real_acc_sizeW = MAX_PATH;
1174 real_dom_sizeW = MAX_PATH;
1175 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &real_acc_sizeW, domainW, &real_dom_sizeW, &use);
1176 ok(ret, "LookupAccountSidW() Expected TRUE, got FALSE\n");
1178 /* native windows crashes if domainW or accountW is NULL */
1180 /* try a small account buffer */
1182 dom_sizeW = MAX_PATH;
1184 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1185 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1186 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1187 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1189 /* try a 0 sized account buffer */
1191 dom_sizeW = MAX_PATH;
1193 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1194 /* this can fail or succeed depending on OS version but the size will always be returned */
1195 ok(acc_sizeW == real_acc_sizeW + 1,
1196 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1197 real_acc_sizeW + 1, acc_sizeW);
1199 /* try a 0 sized account buffer */
1201 dom_sizeW = MAX_PATH;
1202 ret = LookupAccountSidW(NULL, pUsersSid, NULL, &acc_sizeW, domainW, &dom_sizeW, &use);
1203 /* this can fail or succeed depending on OS version but the size will always be returned */
1204 ok(acc_sizeW == real_acc_sizeW + 1,
1205 "LookupAccountSidW() Expected acc_size = %u, got %u\n",
1206 real_acc_sizeW + 1, acc_sizeW);
1208 /* try a small domain buffer */
1210 acc_sizeW = MAX_PATH;
1212 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1213 ok(!ret, "LookupAccountSidW() Expected FALSE got TRUE\n");
1214 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1215 "LookupAccountSidW() Expected ERROR_NOT_ENOUGH_MEMORY, got %u\n", GetLastError());
1217 /* try a 0 sized domain buffer */
1219 acc_sizeW = MAX_PATH;
1221 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, domainW, &dom_sizeW, &use);
1222 /* this can fail or succeed depending on OS version but the size will always be returned */
1223 ok(dom_sizeW == real_dom_sizeW + 1,
1224 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1225 real_dom_sizeW + 1, dom_sizeW);
1227 /* try a 0 sized domain buffer */
1229 acc_sizeW = MAX_PATH;
1230 ret = LookupAccountSidW(NULL, pUsersSid, accountW, &acc_sizeW, NULL, &dom_sizeW, &use);
1231 /* this can fail or succeed depending on OS version but the size will always be returned */
1232 ok(dom_sizeW == real_dom_sizeW + 1,
1233 "LookupAccountSidW() Expected dom_size = %u, got %u\n",
1234 real_dom_sizeW + 1, dom_sizeW);
1238 pCreateWellKnownSid = (fnCreateWellKnownSid)GetProcAddress( hmod, "CreateWellKnownSid" );
1240 if (pCreateWellKnownSid && pConvertSidToStringSidA)
1242 trace("Well Known SIDs:\n");
1243 for (i = 0; i <= 60; i++)
1245 size = SECURITY_MAX_SID_SIZE;
1246 if (pCreateWellKnownSid(i, NULL, &max_sid.sid, &size))
1248 if (pConvertSidToStringSidA(&max_sid.sid, &str_sidA))
1250 acc_sizeA = MAX_PATH;
1251 dom_sizeA = MAX_PATH;
1252 if (LookupAccountSidA(NULL, &max_sid.sid, accountA, &acc_sizeA, domainA, &dom_sizeA, &use))
1253 trace(" %d: %s %s\\%s %d\n", i, str_sidA, domainA, accountA, use);
1254 LocalFree(str_sidA);
1259 if (GetLastError() != ERROR_INVALID_PARAMETER)
1260 trace(" CreateWellKnownSid(%d) failed: %d\n", i, GetLastError());
1262 trace(" %d: not supported\n", i);
1266 pLsaQueryInformationPolicy = (fnLsaQueryInformationPolicy)GetProcAddress( hmod, "LsaQueryInformationPolicy");
1267 pLsaOpenPolicy = (fnLsaOpenPolicy)GetProcAddress( hmod, "LsaOpenPolicy");
1268 pLsaFreeMemory = (fnLsaFreeMemory)GetProcAddress( hmod, "LsaFreeMemory");
1269 pLsaClose = (fnLsaClose)GetProcAddress( hmod, "LsaClose");
1271 if (pLsaQueryInformationPolicy && pLsaOpenPolicy && pLsaFreeMemory && pLsaClose)
1275 LSA_OBJECT_ATTRIBUTES object_attributes;
1277 ZeroMemory(&object_attributes, sizeof(object_attributes));
1278 object_attributes.Length = sizeof(object_attributes);
1280 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_ALL_ACCESS, &handle);
1281 ok(status == STATUS_SUCCESS || status == STATUS_ACCESS_DENIED,
1282 "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status);
1284 /* try a more restricted access mask if necessary */
1285 if (status == STATUS_ACCESS_DENIED) {
1286 trace("LsaOpenPolicy(POLICY_ALL_ACCESS) failed, trying POLICY_VIEW_LOCAL_INFORMATION\n");
1287 status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_VIEW_LOCAL_INFORMATION, &handle);
1288 ok(status == STATUS_SUCCESS, "LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) returned 0x%08x\n", status);
1291 if (status == STATUS_SUCCESS)
1293 PPOLICY_ACCOUNT_DOMAIN_INFO info;
1294 status = pLsaQueryInformationPolicy(handle, PolicyAccountDomainInformation, (PVOID*)&info);
1295 ok(status == STATUS_SUCCESS, "LsaQueryInformationPolicy() failed, returned 0x%08x\n", status);
1296 if (status == STATUS_SUCCESS)
1298 ok(info->DomainSid!=0, "LsaQueryInformationPolicy(PolicyAccountDomainInformation) missing SID\n");
1299 if (info->DomainSid)
1301 int count = *GetSidSubAuthorityCount(info->DomainSid);
1302 CopySid(GetSidLengthRequired(count), &max_sid, info->DomainSid);
1303 test_sid_str((PSID)&max_sid.sid);
1304 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_ADMIN;
1305 max_sid.sid.SubAuthorityCount = count + 1;
1306 test_sid_str((PSID)&max_sid.sid);
1307 max_sid.sid.SubAuthority[count] = DOMAIN_USER_RID_GUEST;
1308 test_sid_str((PSID)&max_sid.sid);
1309 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ADMINS;
1310 test_sid_str((PSID)&max_sid.sid);
1311 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_USERS;
1312 test_sid_str((PSID)&max_sid.sid);
1313 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_GUESTS;
1314 test_sid_str((PSID)&max_sid.sid);
1315 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_COMPUTERS;
1316 test_sid_str((PSID)&max_sid.sid);
1317 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CONTROLLERS;
1318 test_sid_str((PSID)&max_sid.sid);
1319 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_CERT_ADMINS;
1320 test_sid_str((PSID)&max_sid.sid);
1321 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_SCHEMA_ADMINS;
1322 test_sid_str((PSID)&max_sid.sid);
1323 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_ENTERPRISE_ADMINS;
1324 test_sid_str((PSID)&max_sid.sid);
1325 max_sid.sid.SubAuthority[count] = DOMAIN_GROUP_RID_POLICY_ADMINS;
1326 test_sid_str((PSID)&max_sid.sid);
1327 max_sid.sid.SubAuthority[count] = DOMAIN_ALIAS_RID_RAS_SERVERS;
1328 test_sid_str((PSID)&max_sid.sid);
1329 max_sid.sid.SubAuthority[count] = 1000; /* first user account */
1330 test_sid_str((PSID)&max_sid.sid);
1333 pLsaFreeMemory((LPVOID)info);
1336 status = pLsaClose(handle);
1337 ok(status == STATUS_SUCCESS, "LsaClose() failed, returned 0x%08x\n", status);
1343 static void get_sid_info(PSID psid, LPSTR *user, LPSTR *dom)
1345 static CHAR account[UNLEN + 1];
1346 static CHAR domain[UNLEN + 1];
1347 DWORD size, dom_size;
1353 size = dom_size = UNLEN + 1;
1356 LookupAccountSidA(NULL, psid, account, &size, domain, &dom_size, &use);
1359 static void test_LookupAccountName(void)
1361 DWORD sid_size, domain_size, user_size;
1362 DWORD sid_save, domain_save;
1363 CHAR user_name[UNLEN + 1];
1364 SID_NAME_USE sid_use;
1365 LPSTR domain, account, sid_dom;
1369 /* native crashes if (assuming all other parameters correct):
1371 * - Sid is NULL and cbSid is > 0
1372 * - cbSid or cchReferencedDomainName are NULL
1373 * - ReferencedDomainName is NULL and cchReferencedDomainName is the correct size
1376 user_size = UNLEN + 1;
1377 SetLastError(0xdeadbeef);
1378 ret = GetUserNameA(user_name, &user_size);
1379 if (!ret && (GetLastError() == ERROR_NOT_LOGGED_ON))
1381 /* Probably on win9x where the user used 'Cancel' instead of properly logging in */
1382 skip("Cannot get the user name (win9x and not logged in properly)\n");
1385 ok(ret, "Failed to get user name : %d\n", GetLastError());
1390 sid_use = 0xcafebabe;
1391 SetLastError(0xdeadbeef);
1392 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, NULL, &domain_size, &sid_use);
1393 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1395 skip("LookupAccountNameA is not implemented\n");
1398 ok(!ret, "Expected 0, got %d\n", ret);
1399 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1400 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1401 ok(sid_size != 0, "Expected non-zero sid size\n");
1402 ok(domain_size != 0, "Expected non-zero domain size\n");
1403 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
1405 sid_save = sid_size;
1406 domain_save = domain_size;
1408 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
1409 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
1411 /* try valid account name */
1412 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, domain, &domain_size, &sid_use);
1413 get_sid_info(psid, &account, &sid_dom);
1414 ok(ret, "Failed to lookup account name\n");
1415 ok(sid_size == GetLengthSid(psid), "Expected %d, got %d\n", GetLengthSid(psid), sid_size);
1418 ok(!lstrcmp(account, user_name), "Expected %s, got %s\n", user_name, account);
1419 ok(!lstrcmp(domain, sid_dom), "Expected %s, got %s\n", sid_dom, domain);
1420 ok(domain_size == domain_save - 1, "Expected %d, got %d\n", domain_save - 1, domain_size);
1421 ok(lstrlen(domain) == domain_size, "Expected %d\n", lstrlen(domain));
1422 ok(sid_use == SidTypeUser, "Expected SidTypeUser, got %d\n", SidTypeUser);
1424 domain_size = domain_save;
1426 /* NULL Sid with zero sid size */
1427 SetLastError(0xdeadbeef);
1429 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
1430 ok(!ret, "Expected 0, got %d\n", ret);
1431 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1432 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1433 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
1434 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
1436 /* try cchReferencedDomainName - 1 */
1437 SetLastError(0xdeadbeef);
1439 ret = LookupAccountNameA(NULL, user_name, NULL, &sid_size, domain, &domain_size, &sid_use);
1440 ok(!ret, "Expected 0, got %d\n", ret);
1441 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1442 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1443 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
1444 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
1446 /* NULL ReferencedDomainName with zero domain name size */
1447 SetLastError(0xdeadbeef);
1449 ret = LookupAccountNameA(NULL, user_name, psid, &sid_size, NULL, &domain_size, &sid_use);
1450 ok(!ret, "Expected 0, got %d\n", ret);
1451 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1452 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1453 ok(sid_size == sid_save, "Expected %d, got %d\n", sid_save, sid_size);
1454 ok(domain_size == domain_save, "Expected %d, got %d\n", domain_save, domain_size);
1456 HeapFree(GetProcessHeap(), 0, psid);
1457 HeapFree(GetProcessHeap(), 0, domain);
1459 /* get sizes for NULL account name */
1462 sid_use = 0xcafebabe;
1463 SetLastError(0xdeadbeef);
1464 ret = LookupAccountNameA(NULL, NULL, NULL, &sid_size, NULL, &domain_size, &sid_use);
1465 ok(!ret, "Expected 0, got %d\n", ret);
1466 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER,
1467 "Expected ERROR_INSUFFICIENT_BUFFER, got %d\n", GetLastError());
1468 ok(sid_size != 0, "Expected non-zero sid size\n");
1469 ok(domain_size != 0, "Expected non-zero domain size\n");
1470 ok(sid_use == 0xcafebabe, "Expected 0xcafebabe, got %d\n", sid_use);
1472 psid = HeapAlloc(GetProcessHeap(), 0, sid_size);
1473 domain = HeapAlloc(GetProcessHeap(), 0, domain_size);
1475 /* try NULL account name */
1476 ret = LookupAccountNameA(NULL, NULL, psid, &sid_size, domain, &domain_size, &sid_use);
1477 get_sid_info(psid, &account, &sid_dom);
1478 ok(ret, "Failed to lookup account name\n");
1481 /* Using a fixed string will not work on different locales */
1482 ok(!lstrcmp(account, domain),
1483 "Got %s for account and %s for domain, these should be the same\n",
1485 ok(sid_use == SidTypeDomain, "Expected SidTypeDomain, got %d\n", SidTypeDomain);
1488 /* try an invalid account name */
1489 SetLastError(0xdeadbeef);
1492 ret = LookupAccountNameA(NULL, "oogabooga", NULL, &sid_size, NULL, &domain_size, &sid_use);
1493 ok(!ret, "Expected 0, got %d\n", ret);
1496 ok(GetLastError() == ERROR_NONE_MAPPED,
1497 "Expected ERROR_NONE_MAPPED, got %d\n", GetLastError());
1498 ok(sid_size == 0, "Expected 0, got %d\n", sid_size);
1499 ok(domain_size == 0, "Expected 0, got %d\n", domain_size);
1502 HeapFree(GetProcessHeap(), 0, psid);
1503 HeapFree(GetProcessHeap(), 0, domain);
1506 static void test_security_descriptor(void)
1508 SECURITY_DESCRIPTOR sd;
1511 BOOL isDefault, isPresent;
1515 InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION);
1516 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
1517 expect_eq(psid, NULL, PSID, "%p");
1518 expect_eq(isDefault, FALSE, BOOL, "%d");
1519 sd.Control |= SE_DACL_PRESENT | SE_SACL_PRESENT;
1521 SetLastError(0xdeadbeef);
1523 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), FALSE, BOOL, "%d");
1524 expect_eq(GetLastError(), ERROR_INSUFFICIENT_BUFFER, DWORD, "%u");
1525 ok(size > 5, "Size not increased\n");
1528 expect_eq(MakeSelfRelativeSD(&sd, buf, &size), TRUE, BOOL, "%d");
1529 ok(GetSecurityDescriptorOwner(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
1530 expect_eq(psid, NULL, PSID, "%p");
1531 expect_eq(isDefault, FALSE, BOOL, "%d");
1532 ok(GetSecurityDescriptorGroup(&sd, &psid, &isDefault), "GetSecurityDescriptorOwner failed\n");
1533 expect_eq(psid, NULL, PSID, "%p");
1534 expect_eq(isDefault, FALSE, BOOL, "%d");
1535 ok(GetSecurityDescriptorDacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorOwner failed\n");
1536 expect_eq(isPresent, TRUE, BOOL, "%d");
1537 expect_eq(psid, NULL, PSID, "%p");
1538 expect_eq(isDefault, FALSE, BOOL, "%d");
1539 ok(GetSecurityDescriptorSacl(&sd, &isPresent, &pacl, &isDefault), "GetSecurityDescriptorOwner failed\n");
1540 expect_eq(isPresent, TRUE, BOOL, "%d");
1541 expect_eq(psid, NULL, PSID, "%p");
1542 expect_eq(isDefault, FALSE, BOOL, "%d");
1546 #define TEST_GRANTED_ACCESS(a,b) test_granted_access(a,b,__LINE__)
1547 static void test_granted_access(HANDLE handle, ACCESS_MASK access, int line)
1549 OBJECT_BASIC_INFORMATION obj_info;
1552 if (!pNtQueryObject)
1554 skip_(__FILE__, line)("Not NT platform - skipping tests\n");
1558 status = pNtQueryObject( handle, ObjectBasicInformation, &obj_info,
1559 sizeof(obj_info), NULL );
1560 ok_(__FILE__, line)(!status, "NtQueryObject with err: %08x\n", status);
1561 ok_(__FILE__, line)(obj_info.GrantedAccess == access, "Granted access should "
1562 "be 0x%08x, instead of 0x%08x\n", access, obj_info.GrantedAccess);
1565 #define CHECK_SET_SECURITY(o,i,e) \
1569 SetLastError( 0xdeadbeef ); \
1570 res = SetKernelObjectSecurity( o, i, SecurityDescriptor ); \
1571 err = GetLastError(); \
1572 if (e == ERROR_SUCCESS) \
1573 ok(res, "SetKernelObjectSecurity failed with %d\n", err); \
1575 ok(!res && err == e, "SetKernelObjectSecurity should have failed " \
1576 "with %s, instead of %d\n", #e, err); \
1579 static void test_process_security(void)
1582 char owner[32], group[32];
1583 PSID AdminSid = NULL, UsersSid = NULL;
1585 SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
1586 char buffer[MAX_PATH];
1587 PROCESS_INFORMATION info;
1588 STARTUPINFOA startup;
1589 SECURITY_ATTRIBUTES psa;
1590 HANDLE token, event;
1593 Acl = HeapAlloc(GetProcessHeap(), 0, 256);
1594 res = InitializeAcl(Acl, 256, ACL_REVISION);
1595 if (!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
1597 skip("ACLs not implemented - skipping tests\n");
1598 HeapFree(GetProcessHeap(), 0, Acl);
1601 ok(res, "InitializeAcl failed with error %d\n", GetLastError());
1603 /* get owner from the token we might be running as a user not admin */
1604 res = OpenProcessToken( GetCurrentProcess(), MAXIMUM_ALLOWED, &token );
1605 ok(res, "OpenProcessToken failed with error %d\n", GetLastError());
1608 HeapFree(GetProcessHeap(), 0, Acl);
1612 res = GetTokenInformation( token, TokenOwner, owner, sizeof(owner), &tmp );
1613 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
1614 AdminSid = ((TOKEN_OWNER*)owner)->Owner;
1615 res = GetTokenInformation( token, TokenPrimaryGroup, group, sizeof(group), &tmp );
1616 ok(res, "GetTokenInformation failed with error %d\n", GetLastError());
1617 UsersSid = ((TOKEN_PRIMARY_GROUP*)group)->PrimaryGroup;
1619 CloseHandle( token );
1622 HeapFree(GetProcessHeap(), 0, Acl);
1626 res = AddAccessDeniedAce(Acl, ACL_REVISION, PROCESS_VM_READ, AdminSid);
1627 ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError());
1628 res = AddAccessAllowedAce(Acl, ACL_REVISION, PROCESS_ALL_ACCESS, AdminSid);
1629 ok(res, "AddAccessAllowedAceEx failed with error %d\n", GetLastError());
1631 SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
1632 res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
1633 ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError());
1635 event = CreateEvent( NULL, TRUE, TRUE, "test_event" );
1636 ok(event != NULL, "CreateEvent %d\n", GetLastError());
1638 SecurityDescriptor->Revision = 0;
1639 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_UNKNOWN_REVISION );
1640 SecurityDescriptor->Revision = SECURITY_DESCRIPTOR_REVISION;
1642 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
1643 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_INVALID_SECURITY_DESCR );
1644 CHECK_SET_SECURITY( event, SACL_SECURITY_INFORMATION, ERROR_ACCESS_DENIED );
1645 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
1646 /* NULL DACL is valid and means default DACL from token */
1647 SecurityDescriptor->Control |= SE_DACL_PRESENT;
1648 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
1650 /* Set owner and group and dacl */
1651 res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
1652 ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1653 CHECK_SET_SECURITY( event, OWNER_SECURITY_INFORMATION, ERROR_SUCCESS );
1654 res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, FALSE);
1655 ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1656 CHECK_SET_SECURITY( event, GROUP_SECURITY_INFORMATION, ERROR_SUCCESS );
1657 res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
1658 ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError());
1659 CHECK_SET_SECURITY( event, DACL_SECURITY_INFORMATION, ERROR_SUCCESS );
1661 sprintf(buffer, "%s tests/security.c test", myARGV[0]);
1662 memset(&startup, 0, sizeof(startup));
1663 startup.cb = sizeof(startup);
1664 startup.dwFlags = STARTF_USESHOWWINDOW;
1665 startup.wShowWindow = SW_SHOWNORMAL;
1667 psa.nLength = sizeof(psa);
1668 psa.lpSecurityDescriptor = SecurityDescriptor;
1669 psa.bInheritHandle = TRUE;
1671 /* Doesn't matter what ACL say we should get full access for ourselves */
1672 ok(CreateProcessA( NULL, buffer, &psa, NULL, FALSE, 0, NULL, NULL, &startup, &info ),
1673 "CreateProcess with err:%d\n", GetLastError());
1674 TEST_GRANTED_ACCESS( info.hProcess, PROCESS_ALL_ACCESS );
1675 ok(WaitForSingleObject(info.hProcess, 30000) == WAIT_OBJECT_0, "Child process termination\n");
1677 CloseHandle( event );
1678 HeapFree(GetProcessHeap(), 0, Acl);
1679 HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
1682 static void test_process_security_child(void)
1684 HANDLE handle, handle1;
1688 handle = OpenProcess( PROCESS_TERMINATE, FALSE, GetCurrentProcessId() );
1689 ok(handle != NULL, "OpenProcess(PROCESS_TERMINATE) with err:%d\n", GetLastError());
1690 TEST_GRANTED_ACCESS( handle, PROCESS_TERMINATE );
1692 ok(DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
1693 &handle1, 0, TRUE, DUPLICATE_SAME_ACCESS ),
1694 "duplicating handle err:%d\n", GetLastError());
1695 TEST_GRANTED_ACCESS( handle1, PROCESS_TERMINATE );
1697 CloseHandle( handle1 );
1699 SetLastError( 0xdeadbeef );
1700 ret = DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
1701 &handle1, PROCESS_ALL_ACCESS, TRUE, 0 );
1702 err = GetLastError();
1704 ok(!ret && err == ERROR_ACCESS_DENIED, "duplicating handle should have failed "
1705 "with STATUS_ACCESS_DENIED, instead of err:%d\n", err);
1707 CloseHandle( handle );
1709 /* These two should fail - they are denied by ACL */
1710 handle = OpenProcess( PROCESS_VM_READ, FALSE, GetCurrentProcessId() );
1712 ok(handle == NULL, "OpenProcess(PROCESS_VM_READ) should have failed\n");
1713 handle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId() );
1715 ok(handle == NULL, "OpenProcess(PROCESS_ALL_ACCESS) should have failed\n");
1717 /* Documented privilege elevation */
1718 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1719 &handle, 0, TRUE, DUPLICATE_SAME_ACCESS ),
1720 "duplicating handle err:%d\n", GetLastError());
1721 TEST_GRANTED_ACCESS( handle, PROCESS_ALL_ACCESS );
1723 CloseHandle( handle );
1725 /* Same only explicitly asking for all access rights */
1726 ok(DuplicateHandle( GetCurrentProcess(), GetCurrentProcess(), GetCurrentProcess(),
1727 &handle, PROCESS_ALL_ACCESS, TRUE, 0 ),
1728 "duplicating handle err:%d\n", GetLastError());
1729 TEST_GRANTED_ACCESS( handle, PROCESS_ALL_ACCESS );
1730 ok(DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
1731 &handle1, PROCESS_VM_READ, TRUE, 0 ),
1732 "duplicating handle err:%d\n", GetLastError());
1733 TEST_GRANTED_ACCESS( handle1, PROCESS_VM_READ );
1734 CloseHandle( handle1 );
1735 CloseHandle( handle );
1738 static void test_impersonation_level(void)
1740 HANDLE Token, ProcessToken;
1743 TOKEN_PRIVILEGES *Privileges;
1745 PRIVILEGE_SET *PrivilegeSet;
1751 pDuplicateTokenEx = (fnDuplicateTokenEx) GetProcAddress(hmod, "DuplicateTokenEx");
1752 if( !pDuplicateTokenEx ) {
1753 skip("DuplicateTokenEx is not available\n");
1756 SetLastError(0xdeadbeef);
1757 ret = ImpersonateSelf(SecurityAnonymous);
1758 if(!ret && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1760 skip("ImpersonateSelf is not implemented\n");
1763 ok(ret, "ImpersonateSelf(SecurityAnonymous) failed with error %d\n", GetLastError());
1764 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
1765 ok(!ret, "OpenThreadToken should have failed\n");
1766 error = GetLastError();
1767 ok(error == ERROR_CANT_OPEN_ANONYMOUS, "OpenThreadToken on anonymous token should have returned ERROR_CANT_OPEN_ANONYMOUS instead of %d\n", error);
1768 /* can't perform access check when opening object against an anonymous impersonation token */
1770 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
1771 ok(error == ERROR_INVALID_HANDLE, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error);
1775 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &ProcessToken);
1776 ok(ret, "OpenProcessToken failed with error %d\n", GetLastError());
1778 ret = pDuplicateTokenEx(ProcessToken,
1779 TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE, NULL,
1780 SecurityAnonymous, TokenImpersonation, &Token);
1781 ok(ret, "DuplicateTokenEx failed with error %d\n", GetLastError());
1782 /* can't increase the impersonation level */
1783 ret = DuplicateToken(Token, SecurityIdentification, &Token2);
1784 error = GetLastError();
1785 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL,
1786 "Duplicating a token and increasing the impersonation level should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
1787 /* we can query anything from an anonymous token, including the user */
1788 ret = GetTokenInformation(Token, TokenUser, NULL, 0, &Size);
1789 error = GetLastError();
1790 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenUser) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
1791 User = (TOKEN_USER *)HeapAlloc(GetProcessHeap(), 0, Size);
1792 ret = GetTokenInformation(Token, TokenUser, User, Size, &Size);
1793 ok(ret, "GetTokenInformation(TokenUser) failed with error %d\n", GetLastError());
1794 HeapFree(GetProcessHeap(), 0, User);
1796 /* PrivilegeCheck fails with SecurityAnonymous level */
1797 ret = GetTokenInformation(Token, TokenPrivileges, NULL, 0, &Size);
1798 error = GetLastError();
1799 ok(!ret && error == ERROR_INSUFFICIENT_BUFFER, "GetTokenInformation(TokenPrivileges) should have failed with ERROR_INSUFFICIENT_BUFFER instead of %d\n", error);
1800 Privileges = (TOKEN_PRIVILEGES *)HeapAlloc(GetProcessHeap(), 0, Size);
1801 ret = GetTokenInformation(Token, TokenPrivileges, Privileges, Size, &Size);
1802 ok(ret, "GetTokenInformation(TokenPrivileges) failed with error %d\n", GetLastError());
1804 PrivilegeSet = (PRIVILEGE_SET *)HeapAlloc(GetProcessHeap(), 0, FIELD_OFFSET(PRIVILEGE_SET, Privilege[Privileges->PrivilegeCount]));
1805 PrivilegeSet->PrivilegeCount = Privileges->PrivilegeCount;
1806 memcpy(PrivilegeSet->Privilege, Privileges->Privileges, PrivilegeSet->PrivilegeCount * sizeof(PrivilegeSet->Privilege[0]));
1807 PrivilegeSet->Control = PRIVILEGE_SET_ALL_NECESSARY;
1808 HeapFree(GetProcessHeap(), 0, Privileges);
1810 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
1811 error = GetLastError();
1812 ok(!ret && error == ERROR_BAD_IMPERSONATION_LEVEL, "PrivilegeCheck for SecurityAnonymous token should have failed with ERROR_BAD_IMPERSONATION_LEVEL instead of %d\n", error);
1816 ret = ImpersonateSelf(SecurityIdentification);
1817 ok(ret, "ImpersonateSelf(SecurityIdentification) failed with error %d\n", GetLastError());
1818 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
1819 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
1821 /* can't perform access check when opening object against an identification impersonation token */
1822 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
1824 ok(error == ERROR_INVALID_HANDLE, "RegOpenKeyEx should have failed with ERROR_INVALID_HANDLE instead of %d\n", error);
1826 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
1827 ok(ret, "PrivilegeCheck for SecurityIdentification failed with error %d\n", GetLastError());
1831 ret = ImpersonateSelf(SecurityImpersonation);
1832 ok(ret, "ImpersonateSelf(SecurityImpersonation) failed with error %d\n", GetLastError());
1833 ret = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY_SOURCE | TOKEN_IMPERSONATE | TOKEN_ADJUST_DEFAULT, TRUE, &Token);
1834 ok(ret, "OpenThreadToken failed with error %d\n", GetLastError());
1835 error = RegOpenKeyEx(HKEY_CURRENT_USER, "Software", 0, KEY_READ, &hkey);
1836 ok(error == ERROR_SUCCESS, "RegOpenKeyEx should have succeeded instead of failing with %d\n", error);
1838 ret = PrivilegeCheck(Token, PrivilegeSet, &AccessGranted);
1839 ok(ret, "PrivilegeCheck for SecurityImpersonation failed with error %d\n", GetLastError());
1843 CloseHandle(ProcessToken);
1845 HeapFree(GetProcessHeap(), 0, PrivilegeSet);
1848 static void test_SetEntriesInAcl(void)
1850 ACL *acl = (ACL*)0xdeadbeef;
1853 if (!pSetEntriesInAclW)
1855 skip("SetEntriesInAclW is not available\n");
1859 res = pSetEntriesInAclW(0, NULL, NULL, &acl);
1860 if(res == ERROR_CALL_NOT_IMPLEMENTED)
1862 skip("SetEntriesInAclW is not implemented\n");
1865 ok(res == ERROR_SUCCESS, "SetEntriesInAclW failed: %u\n", res);
1866 ok(acl == NULL, "acl=%p, expected NULL\n", acl);
1869 static void test_GetNamedSecurityInfoA(void)
1871 PSECURITY_DESCRIPTOR pSecDesc;
1873 SECURITY_DESCRIPTOR_CONTROL control;
1876 BOOL owner_defaulted;
1877 BOOL group_defaulted;
1880 CHAR windows_dir[MAX_PATH];
1882 if (!pGetNamedSecurityInfoA)
1884 skip("GetNamedSecurityInfoA is not available\n");
1888 ret = GetWindowsDirectoryA(windows_dir, MAX_PATH);
1889 ok(ret, "GetWindowsDirectory failed with error %d\n", GetLastError());
1891 SetLastError(0xdeadbeef);
1892 error = pGetNamedSecurityInfoA(windows_dir, SE_FILE_OBJECT,
1893 OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,
1894 NULL, NULL, NULL, NULL, &pSecDesc);
1895 if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
1897 skip("GetNamedSecurityInfoA is not implemented\n");
1900 ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
1902 ret = GetSecurityDescriptorControl(pSecDesc, &control, &revision);
1903 ok(ret, "GetSecurityDescriptorControl failed with error %d\n", GetLastError());
1904 ok((control & (SE_SELF_RELATIVE|SE_DACL_PRESENT)) == (SE_SELF_RELATIVE|SE_DACL_PRESENT),
1905 "control (0x%x) doesn't have (SE_SELF_RELATIVE|SE_DACL_PRESENT) flags set\n", control);
1906 ok(revision == SECURITY_DESCRIPTOR_REVISION1, "revision was %d instead of 1\n", revision);
1907 ret = GetSecurityDescriptorOwner(pSecDesc, &owner, &owner_defaulted);
1908 ok(ret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
1909 ok(owner != NULL, "owner should not be NULL\n");
1910 ret = GetSecurityDescriptorGroup(pSecDesc, &group, &group_defaulted);
1911 ok(ret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
1912 ok(group != NULL, "group should not be NULL\n");
1915 static void test_ConvertStringSecurityDescriptor(void)
1918 PSECURITY_DESCRIPTOR pSD;
1920 if (!pConvertStringSecurityDescriptorToSecurityDescriptorA)
1922 skip("ConvertStringSecurityDescriptorToSecurityDescriptor is not available\n");
1926 SetLastError(0xdeadbeef);
1927 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1928 "D:(A;;GA;;;WD)", 0xdeadbeef, &pSD, NULL);
1929 ok(!ret && GetLastError() == ERROR_UNKNOWN_REVISION,
1930 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_UNKNOWN_REVISION instead of %d\n",
1933 /* test ACE string type */
1934 SetLastError(0xdeadbeef);
1935 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1936 "D:(A;;GA;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1937 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1940 SetLastError(0xdeadbeef);
1941 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1942 "D:(D;;GA;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1943 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1946 SetLastError(0xdeadbeef);
1947 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1948 "ERROR:(D;;GA;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1949 ok(!ret && GetLastError() == ERROR_INVALID_PARAMETER,
1950 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_PARAMETER instead of %d\n",
1953 /* test ACE string access rights */
1954 SetLastError(0xdeadbeef);
1955 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1956 "D:(A;;GA;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1957 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1959 SetLastError(0xdeadbeef);
1960 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1961 "D:(A;;GRGWGX;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1962 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1964 SetLastError(0xdeadbeef);
1965 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1966 "D:(A;;RCSDWDWO;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1967 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1969 SetLastError(0xdeadbeef);
1970 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1971 "D:(A;;RPWPCCDCLCSWLODTCR;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1972 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1974 SetLastError(0xdeadbeef);
1975 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1976 "D:(A;;FAFRFWFX;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1977 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1979 SetLastError(0xdeadbeef);
1980 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1981 "D:(A;;KAKRKWKX;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1982 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1984 SetLastError(0xdeadbeef);
1985 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1986 "D:(A;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1987 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1989 SetLastError(0xdeadbeef);
1990 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1991 "S:(AU;;0xFFFFFFFF;;;WD)", SDDL_REVISION_1, &pSD, NULL);
1992 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
1995 /* test ACE string access right error case */
1996 SetLastError(0xdeadbeef);
1997 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
1998 "D:(A;;ROB;;;WD)", SDDL_REVISION_1, &pSD, NULL);
2000 ok(!ret && GetLastError() == ERROR_INVALID_ACL,
2001 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_ACL instead of %d\n",
2004 /* test ACE string SID */
2005 SetLastError(0xdeadbeef);
2006 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
2007 "D:(D;;GA;;;S-1-0-0)", SDDL_REVISION_1, &pSD, NULL);
2008 ok(ret, "ConvertStringSecurityDescriptorToSecurityDescriptor failed with error %d\n", GetLastError());
2011 SetLastError(0xdeadbeef);
2012 ret = pConvertStringSecurityDescriptorToSecurityDescriptorA(
2013 "D:(D;;GA;;;Nonexistent account)", SDDL_REVISION_1, &pSD, NULL);
2015 ok(!ret && GetLastError() == ERROR_INVALID_ACL,
2016 "ConvertStringSecurityDescriptorToSecurityDescriptor should have failed with ERROR_INVALID_ACL instead of %d\n",
2020 static void test_ConvertSecurityDescriptorToString()
2022 SECURITY_DESCRIPTOR desc;
2023 SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
2032 if (!pConvertSecurityDescriptorToStringSecurityDescriptorA)
2034 skip("ConvertSecurityDescriptorToStringSecurityDescriptor is not available\n");
2037 if (!pCreateWellKnownSid)
2039 skip("CreateWellKnownSid is not available\n");
2043 /* It seems Windows XP adds an extra character to the length of the string for each ACE in an ACL. We
2044 * don't replicate this feature so we only test len >= strlen+1. */
2045 #define CHECK_RESULT_AND_FREE(exp_str) \
2046 ok(strcmp(string, (exp_str)) == 0, "String mismatch (expected \"%s\", got \"%s\")\n", (exp_str), string); \
2047 ok(len >= (strlen(exp_str) + 1), "Length mismatch (expected %d, got %d)\n", strlen(exp_str) + 1, len); \
2050 #define CHECK_ONE_OF_AND_FREE(exp_str1, exp_str2) \
2051 ok(strcmp(string, (exp_str1)) == 0 || strcmp(string, (exp_str2)) == 0, "String mismatch (expected\n\"%s\" or\n\"%s\", got\n\"%s\")\n", (exp_str1), (exp_str2), string); \
2052 ok(len >= (strlen(string) + 1), "Length mismatch (expected %d, got %d)\n", strlen(string) + 1, len); \
2055 InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION);
2056 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2057 CHECK_RESULT_AND_FREE("");
2060 pCreateWellKnownSid(WinLocalSid, NULL, sid_buf, &size);
2061 SetSecurityDescriptorOwner(&desc, (PSID)sid_buf, FALSE);
2062 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2063 CHECK_RESULT_AND_FREE("O:S-1-2-0");
2065 SetSecurityDescriptorOwner(&desc, (PSID)sid_buf, TRUE);
2066 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2067 CHECK_RESULT_AND_FREE("O:S-1-2-0");
2069 size = sizeof(sid_buf);
2070 pCreateWellKnownSid(WinLocalSystemSid, NULL, sid_buf, &size);
2071 SetSecurityDescriptorOwner(&desc, (PSID)sid_buf, TRUE);
2072 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2073 CHECK_RESULT_AND_FREE("O:SY");
2075 ConvertStringSidToSid("S-1-5-21-93476-23408-4576", &psid);
2076 SetSecurityDescriptorGroup(&desc, psid, TRUE);
2077 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2078 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576");
2080 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, GROUP_SECURITY_INFORMATION, &string, &len), "Conversion failed\n");
2081 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
2083 pacl = (PACL)acl_buf;
2084 InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
2085 SetSecurityDescriptorDacl(&desc, TRUE, pacl, TRUE);
2086 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2087 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
2089 SetSecurityDescriptorDacl(&desc, TRUE, pacl, FALSE);
2090 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2091 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:");
2093 ConvertStringSidToSid("S-1-5-6", &psid2);
2094 AddAccessAllowedAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, 0xf0000000, psid2);
2095 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2096 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)");
2098 AddAccessAllowedAceEx(pacl, ACL_REVISION, INHERIT_ONLY_ACE|INHERITED_ACE, 0x00000003, psid2);
2099 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2100 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)");
2102 AddAccessDeniedAceEx(pacl, ACL_REVISION, OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE, 0xffffffff, psid);
2103 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2104 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
2107 pacl = (PACL)acl_buf;
2108 InitializeAcl(pacl, sizeof(acl_buf), ACL_REVISION);
2109 SetSecurityDescriptorSacl(&desc, TRUE, pacl, FALSE);
2110 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2111 CHECK_RESULT_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:");
2113 SetSecurityDescriptorDacl(&desc, TRUE, NULL, FALSE);
2114 AddAuditAccessAceEx(pacl, ACL_REVISION, VALID_INHERIT_FLAGS, KEY_READ|KEY_WRITE, psid2, TRUE, TRUE);
2115 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2116 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)", /* XP */
2117 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)" /* Vista */);
2119 AddAuditAccessAceEx(pacl, ACL_REVISION, NO_PROPAGATE_INHERIT_ACE, FILE_GENERIC_READ|FILE_GENERIC_WRITE, psid2, TRUE, FALSE);
2120 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(&desc, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2121 CHECK_ONE_OF_AND_FREE("O:SYG:S-1-5-21-93476-23408-4576D:S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", /* XP */
2122 "O:SYG:S-1-5-21-93476-23408-4576D:NO_ACCESS_CONTROLS:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)" /* Vista */);
2125 static void test_PrivateObjectSecurity(void)
2127 SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION;
2128 SECURITY_DESCRIPTOR_CONTROL ctrl;
2129 PSECURITY_DESCRIPTOR sec;
2135 PSECURITY_DESCRIPTOR buf;
2137 ok(ConvertStringSecurityDescriptorToSecurityDescriptorA(
2139 "G:S-1-5-21-93476-23408-4576"
2140 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
2141 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)", SDDL_REVISION_1, &sec, &dwDescSize), "Creating descriptor failed\n");
2142 buf = HeapAlloc(GetProcessHeap(), 0, dwDescSize);
2143 SetSecurityDescriptorControl(sec, SE_DACL_PROTECTED, SE_DACL_PROTECTED);
2144 GetSecurityDescriptorControl(sec, &ctrl, &dwRevision);
2145 todo_wine expect_eq(ctrl, 0x9014, int, "%x");
2147 ok(GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION, buf, dwDescSize, &retSize),
2148 "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
2149 ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
2150 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2151 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576");
2152 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
2153 expect_eq(ctrl, 0x8000, int, "%x");
2155 ok(GetPrivateObjectSecurity(sec, GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION, buf, dwDescSize, &retSize),
2156 "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
2157 ok(retSize <= dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
2158 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed err=%u\n", GetLastError());
2159 CHECK_RESULT_AND_FREE("G:S-1-5-21-93476-23408-4576D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)");
2160 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
2161 expect_eq(ctrl, 0x8004, int, "%x");
2163 ok(GetPrivateObjectSecurity(sec, sec_info, buf, dwDescSize, &retSize),
2164 "GetPrivateObjectSecurity failed (err=%u)\n", GetLastError());
2165 ok(retSize == dwDescSize, "Buffer too small (%d vs %d)\n", retSize, dwDescSize);
2166 ok(pConvertSecurityDescriptorToStringSecurityDescriptorA(buf, SDDL_REVISION_1, sec_info, &string, &len), "Conversion failed\n");
2167 CHECK_RESULT_AND_FREE("O:SY"
2168 "G:S-1-5-21-93476-23408-4576"
2169 "D:(A;NP;GAGXGWGR;;;SU)(A;IOID;CCDC;;;SU)(D;OICI;0xffffffff;;;S-1-5-21-93476-23408-4576)"
2170 "S:(AU;OICINPIOIDSAFA;CCDCLCSWRPRC;;;SU)(AU;NPSA;0x12019f;;;SU)");
2171 GetSecurityDescriptorControl(buf, &ctrl, &dwRevision);
2172 expect_eq(ctrl, 0x8014, int, "%x");
2174 SetLastError(0xdeadbeef);
2175 ok(GetPrivateObjectSecurity(sec, sec_info, buf, 5, &retSize) == FALSE, "GetPrivateObjectSecurity should have failed\n");
2176 ok(GetLastError() == ERROR_INSUFFICIENT_BUFFER, "Expected error ERROR_INSUFFICIENT_BUFFER, got %u\n", GetLastError());
2179 HeapFree(GetProcessHeap(), 0, buf);
2181 #undef CHECK_RESULT_AND_FREE
2182 #undef CHECK_ONE_OF_AND_FREE
2184 START_TEST(security)
2191 test_process_security_child();
2197 test_FileSecurity();
2200 test_LookupAccountSid();
2201 test_LookupAccountName();
2202 test_security_descriptor();
2203 test_process_security();
2204 test_impersonation_level();
2205 test_SetEntriesInAcl();
2206 test_GetNamedSecurityInfoA();
2207 test_ConvertStringSecurityDescriptor();
2208 test_ConvertSecurityDescriptorToString();
2209 test_PrivateObjectSecurity();