2 * Copyright 1999, 2000 Juergen Schmied <juergen.schmied@debitel.net>
3 * Copyright 2003 CodeWeavers Inc. (Ulrich Czekalla)
4 * Copyright 2006 Robert Reif
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
26 #define WIN32_NO_STATUS
41 #include "advapi32_misc.h"
44 #include "wine/debug.h"
45 #include "wine/unicode.h"
47 WINE_DEFAULT_DEBUG_CHANNEL(advapi);
49 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes);
50 static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags,
51 PACL pAcl, LPDWORD cBytes);
52 static BYTE ParseAceStringFlags(LPCWSTR* StringAcl);
53 static BYTE ParseAceStringType(LPCWSTR* StringAcl);
54 static DWORD ParseAceStringRights(LPCWSTR* StringAcl);
55 static BOOL ParseStringSecurityDescriptorToSecurityDescriptor(
56 LPCWSTR StringSecurityDescriptor,
57 SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
59 static DWORD ParseAclStringFlags(LPCWSTR* StringAcl);
61 typedef struct _ACEFLAG
65 } ACEFLAG, *LPACEFLAG;
67 typedef struct _MAX_SID
69 /* same fields as struct _SID */
71 BYTE SubAuthorityCount;
72 SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
73 DWORD SubAuthority[SID_MAX_SUB_AUTHORITIES];
76 typedef struct WELLKNOWNSID
79 WELL_KNOWN_SID_TYPE Type;
83 static const WELLKNOWNSID WellKnownSids[] =
85 { {0,0}, WinNullSid, { SID_REVISION, 1, { SECURITY_NULL_SID_AUTHORITY }, { SECURITY_NULL_RID } } },
86 { {'W','D'}, WinWorldSid, { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } } },
87 { {0,0}, WinLocalSid, { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } } },
88 { {'C','O'}, WinCreatorOwnerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_RID } } },
89 { {'C','G'}, WinCreatorGroupSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_RID } } },
90 { {0,0}, WinCreatorOwnerServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_SERVER_RID } } },
91 { {0,0}, WinCreatorGroupServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_SERVER_RID } } },
92 { {0,0}, WinNtAuthoritySid, { SID_REVISION, 0, { SECURITY_NT_AUTHORITY }, { SECURITY_NULL_RID } } },
93 { {0,0}, WinDialupSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_DIALUP_RID } } },
94 { {'N','U'}, WinNetworkSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_RID } } },
95 { {0,0}, WinBatchSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BATCH_RID } } },
96 { {'I','U'}, WinInteractiveSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } } },
97 { {'S','U'}, WinServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_SERVICE_RID } } },
98 { {'A','N'}, WinAnonymousSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } } },
99 { {0,0}, WinProxySid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PROXY_RID } } },
100 { {'E','D'}, WinEnterpriseControllersSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ENTERPRISE_CONTROLLERS_RID } } },
101 { {'P','S'}, WinSelfSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PRINCIPAL_SELF_RID } } },
102 { {'A','U'}, WinAuthenticatedUserSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } } },
103 { {'R','C'}, WinRestrictedCodeSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_RESTRICTED_CODE_RID } } },
104 { {0,0}, WinTerminalServerSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_TERMINAL_SERVER_RID } } },
105 { {0,0}, WinRemoteLogonIdSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_REMOTE_LOGON_RID } } },
106 { {'S','Y'}, WinLocalSystemSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } } },
107 { {'L','S'}, WinLocalServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SERVICE_RID } } },
108 { {'N','S'}, WinNetworkServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_SERVICE_RID } } },
109 { {0,0}, WinBuiltinDomainSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID } } },
110 { {'B','A'}, WinBuiltinAdministratorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } } },
111 { {'B','U'}, WinBuiltinUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } } },
112 { {'B','G'}, WinBuiltinGuestsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_GUESTS } } },
113 { {'P','U'}, WinBuiltinPowerUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_POWER_USERS } } },
114 { {'A','O'}, WinBuiltinAccountOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ACCOUNT_OPS } } },
115 { {'S','O'}, WinBuiltinSystemOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_SYSTEM_OPS } } },
116 { {'P','O'}, WinBuiltinPrintOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PRINT_OPS } } },
117 { {'B','O'}, WinBuiltinBackupOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_BACKUP_OPS } } },
118 { {'R','E'}, WinBuiltinReplicatorSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REPLICATOR } } },
119 { {'R','U'}, WinBuiltinPreWindows2000CompatibleAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PREW2KCOMPACCESS } } },
120 { {'R','D'}, WinBuiltinRemoteDesktopUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS } } },
121 { {'N','O'}, WinBuiltinNetworkConfigurationOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS } } },
122 { {0,0}, WinNTLMAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_NTLM_RID } } },
123 { {0,0}, WinDigestAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_DIGEST_RID } } },
124 { {0,0}, WinSChannelAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_SCHANNEL_RID } } },
125 { {0,0}, WinThisOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_THIS_ORGANIZATION_RID } } },
126 { {0,0}, WinOtherOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_OTHER_ORGANIZATION_RID } } },
127 { {0,0}, WinBuiltinIncomingForestTrustBuildersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS } } },
128 { {0,0}, WinBuiltinPerfMonitoringUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_MONITORING_USERS } } },
129 { {0,0}, WinBuiltinPerfLoggingUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_LOGGING_USERS } } },
130 { {0,0}, WinBuiltinAuthorizationAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS } } },
131 { {0,0}, WinBuiltinTerminalServerLicenseServersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS } } },
132 { {0,0}, WinBuiltinDCOMUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_DCOM_USERS } } },
133 { {'L','W'}, WinLowLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_LOW_RID} } },
134 { {'M','E'}, WinMediumLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_MEDIUM_RID } } },
135 { {'H','I'}, WinHighLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_HIGH_RID } } },
136 { {'S','I'}, WinSystemLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_SYSTEM_RID } } },
139 /* these SIDs must be constructed as relative to some domain - only the RID is well-known */
140 typedef struct WELLKNOWNRID
142 WELL_KNOWN_SID_TYPE Type;
146 static const WELLKNOWNRID WellKnownRids[] = {
147 { WinAccountAdministratorSid, DOMAIN_USER_RID_ADMIN },
148 { WinAccountGuestSid, DOMAIN_USER_RID_GUEST },
149 { WinAccountKrbtgtSid, DOMAIN_USER_RID_KRBTGT },
150 { WinAccountDomainAdminsSid, DOMAIN_GROUP_RID_ADMINS },
151 { WinAccountDomainUsersSid, DOMAIN_GROUP_RID_USERS },
152 { WinAccountDomainGuestsSid, DOMAIN_GROUP_RID_GUESTS },
153 { WinAccountComputersSid, DOMAIN_GROUP_RID_COMPUTERS },
154 { WinAccountControllersSid, DOMAIN_GROUP_RID_CONTROLLERS },
155 { WinAccountCertAdminsSid, DOMAIN_GROUP_RID_CERT_ADMINS },
156 { WinAccountSchemaAdminsSid, DOMAIN_GROUP_RID_SCHEMA_ADMINS },
157 { WinAccountEnterpriseAdminsSid, DOMAIN_GROUP_RID_ENTERPRISE_ADMINS },
158 { WinAccountPolicyAdminsSid, DOMAIN_GROUP_RID_POLICY_ADMINS },
159 { WinAccountRasAndIasServersSid, DOMAIN_ALIAS_RID_RAS_SERVERS },
163 static SID const sidWorld = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY} , { SECURITY_WORLD_RID } };
165 typedef struct _AccountSid {
166 WELL_KNOWN_SID_TYPE type;
169 SID_NAME_USE name_use;
173 static const WCHAR Account_Operators[] = { 'A','c','c','o','u','n','t',' ','O','p','e','r','a','t','o','r','s',0 };
174 static const WCHAR Administrator[] = {'A','d','m','i','n','i','s','t','r','a','t','o','r',0 };
175 static const WCHAR Administrators[] = { 'A','d','m','i','n','i','s','t','r','a','t','o','r','s',0 };
176 static const WCHAR ANONYMOUS_LOGON[] = { 'A','N','O','N','Y','M','O','U','S',' ','L','O','G','O','N',0 };
177 static const WCHAR Authenticated_Users[] = { 'A','u','t','h','e','n','t','i','c','a','t','e','d',' ','U','s','e','r','s',0 };
178 static const WCHAR Backup_Operators[] = { 'B','a','c','k','u','p',' ','O','p','e','r','a','t','o','r','s',0 };
179 static const WCHAR BATCH[] = { 'B','A','T','C','H',0 };
180 static const WCHAR Blank[] = { 0 };
181 static const WCHAR BUILTIN[] = { 'B','U','I','L','T','I','N',0 };
182 static const WCHAR Cert_Publishers[] = { 'C','e','r','t',' ','P','u','b','l','i','s','h','e','r','s',0 };
183 static const WCHAR CREATOR_GROUP[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',0 };
184 static const WCHAR CREATOR_GROUP_SERVER[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',' ','S','E','R','V','E','R',0 };
185 static const WCHAR CREATOR_OWNER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',0 };
186 static const WCHAR CREATOR_OWNER_SERVER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',' ','S','E','R','V','E','R',0 };
187 static const WCHAR CURRENT_USER[] = { 'C','U','R','R','E','N','T','_','U','S','E','R',0 };
188 static const WCHAR DIALUP[] = { 'D','I','A','L','U','P',0 };
189 static const WCHAR Digest_Authentication[] = { 'D','i','g','e','s','t',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
190 static const WCHAR DOMAIN[] = {'D','O','M','A','I','N',0};
191 static const WCHAR Domain_Admins[] = { 'D','o','m','a','i','n',' ','A','d','m','i','n','s',0 };
192 static const WCHAR Domain_Computers[] = { 'D','o','m','a','i','n',' ','C','o','m','p','u','t','e','r','s',0 };
193 static const WCHAR Domain_Controllers[] = { 'D','o','m','a','i','n',' ','C','o','n','t','r','o','l','l','e','r','s',0 };
194 static const WCHAR Domain_Guests[] = { 'D','o','m','a','i','n',' ','G','u','e','s','t','s',0 };
195 static const WCHAR Domain_Users[] = { 'D','o','m','a','i','n',' ','U','s','e','r','s',0 };
196 static const WCHAR Enterprise_Admins[] = { 'E','n','t','e','r','p','r','i','s','e',' ','A','d','m','i','n','s',0 };
197 static const WCHAR ENTERPRISE_DOMAIN_CONTROLLERS[] = { 'E','N','T','E','R','P','R','I','S','E',' ','D','O','M','A','I','N',' ','C','O','N','T','R','O','L','L','E','R','S',0 };
198 static const WCHAR Everyone[] = { 'E','v','e','r','y','o','n','e',0 };
199 static const WCHAR Group_Policy_Creator_Owners[] = { 'G','r','o','u','p',' ','P','o','l','i','c','y',' ','C','r','e','a','t','o','r',' ','O','w','n','e','r','s',0 };
200 static const WCHAR Guest[] = { 'G','u','e','s','t',0 };
201 static const WCHAR Guests[] = { 'G','u','e','s','t','s',0 };
202 static const WCHAR INTERACTIVE[] = { 'I','N','T','E','R','A','C','T','I','V','E',0 };
203 static const WCHAR LOCAL[] = { 'L','O','C','A','L',0 };
204 static const WCHAR LOCAL_SERVICE[] = { 'L','O','C','A','L',' ','S','E','R','V','I','C','E',0 };
205 static const WCHAR LOCAL_SERVICE2[] = { 'L','O','C','A','L','S','E','R','V','I','C','E',0 };
206 static const WCHAR NETWORK[] = { 'N','E','T','W','O','R','K',0 };
207 static const WCHAR Network_Configuration_Operators[] = { 'N','e','t','w','o','r','k',' ','C','o','n','f','i','g','u','r','a','t','i','o','n',' ','O','p','e','r','a','t','o','r','s',0 };
208 static const WCHAR NETWORK_SERVICE[] = { 'N','E','T','W','O','R','K',' ','S','E','R','V','I','C','E',0 };
209 static const WCHAR NETWORK_SERVICE2[] = { 'N','E','T','W','O','R','K','S','E','R','V','I','C','E',0 };
210 static const WCHAR NT_AUTHORITY[] = { 'N','T',' ','A','U','T','H','O','R','I','T','Y',0 };
211 static const WCHAR NT_Pseudo_Domain[] = { 'N','T',' ','P','s','e','u','d','o',' ','D','o','m','a','i','n',0 };
212 static const WCHAR NTML_Authentication[] = { 'N','T','M','L',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
213 static const WCHAR NULL_SID[] = { 'N','U','L','L',' ','S','I','D',0 };
214 static const WCHAR Other_Organization[] = { 'O','t','h','e','r',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 };
215 static const WCHAR Performance_Log_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','L','o','g',' ','U','s','e','r','s',0 };
216 static const WCHAR Performance_Monitor_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','M','o','n','i','t','o','r',' ','U','s','e','r','s',0 };
217 static const WCHAR Power_Users[] = { 'P','o','w','e','r',' ','U','s','e','r','s',0 };
218 static const WCHAR Pre_Windows_2000_Compatible_Access[] = { 'P','r','e','-','W','i','n','d','o','w','s',' ','2','0','0','0',' ','C','o','m','p','a','t','i','b','l','e',' ','A','c','c','e','s','s',0 };
219 static const WCHAR Print_Operators[] = { 'P','r','i','n','t',' ','O','p','e','r','a','t','o','r','s',0 };
220 static const WCHAR PROXY[] = { 'P','R','O','X','Y',0 };
221 static const WCHAR RAS_and_IAS_Servers[] = { 'R','A','S',' ','a','n','d',' ','I','A','S',' ','S','e','r','v','e','r','s',0 };
222 static const WCHAR Remote_Desktop_Users[] = { 'R','e','m','o','t','e',' ','D','e','s','k','t','o','p',' ','U','s','e','r','s',0 };
223 static const WCHAR REMOTE_INTERACTIVE_LOGON[] = { 'R','E','M','O','T','E',' ','I','N','T','E','R','A','C','T','I','V','E',' ','L','O','G','O','N',0 };
224 static const WCHAR Replicators[] = { 'R','e','p','l','i','c','a','t','o','r','s',0 };
225 static const WCHAR RESTRICTED[] = { 'R','E','S','T','R','I','C','T','E','D',0 };
226 static const WCHAR SChannel_Authentication[] = { 'S','C','h','a','n','n','e','l',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
227 static const WCHAR Schema_Admins[] = { 'S','c','h','e','m','a',' ','A','d','m','i','n','s',0 };
228 static const WCHAR SELF[] = { 'S','E','L','F',0 };
229 static const WCHAR Server_Operators[] = { 'S','e','r','v','e','r',' ','O','p','e','r','a','t','o','r','s',0 };
230 static const WCHAR SERVICE[] = { 'S','E','R','V','I','C','E',0 };
231 static const WCHAR SYSTEM[] = { 'S','Y','S','T','E','M',0 };
232 static const WCHAR TERMINAL_SERVER_USER[] = { 'T','E','R','M','I','N','A','L',' ','S','E','R','V','E','R',' ','U','S','E','R',0 };
233 static const WCHAR This_Organization[] = { 'T','h','i','s',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 };
234 static const WCHAR Users[] = { 'U','s','e','r','s',0 };
236 static const AccountSid ACCOUNT_SIDS[] = {
237 { WinNullSid, NULL_SID, Blank, SidTypeWellKnownGroup },
238 { WinWorldSid, Everyone, Blank, SidTypeWellKnownGroup },
239 { WinLocalSid, LOCAL, Blank, SidTypeWellKnownGroup },
240 { WinCreatorOwnerSid, CREATOR_OWNER, Blank, SidTypeWellKnownGroup },
241 { WinCreatorGroupSid, CREATOR_GROUP, Blank, SidTypeWellKnownGroup },
242 { WinCreatorOwnerServerSid, CREATOR_OWNER_SERVER, Blank, SidTypeWellKnownGroup },
243 { WinCreatorGroupServerSid, CREATOR_GROUP_SERVER, Blank, SidTypeWellKnownGroup },
244 { WinNtAuthoritySid, NT_Pseudo_Domain, NT_Pseudo_Domain, SidTypeDomain },
245 { WinDialupSid, DIALUP, NT_AUTHORITY, SidTypeWellKnownGroup },
246 { WinNetworkSid, NETWORK, NT_AUTHORITY, SidTypeWellKnownGroup },
247 { WinBatchSid, BATCH, NT_AUTHORITY, SidTypeWellKnownGroup },
248 { WinInteractiveSid, INTERACTIVE, NT_AUTHORITY, SidTypeWellKnownGroup },
249 { WinServiceSid, SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup },
250 { WinAnonymousSid, ANONYMOUS_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup },
251 { WinProxySid, PROXY, NT_AUTHORITY, SidTypeWellKnownGroup },
252 { WinEnterpriseControllersSid, ENTERPRISE_DOMAIN_CONTROLLERS, NT_AUTHORITY, SidTypeWellKnownGroup },
253 { WinSelfSid, SELF, NT_AUTHORITY, SidTypeWellKnownGroup },
254 { WinAuthenticatedUserSid, Authenticated_Users, NT_AUTHORITY, SidTypeWellKnownGroup },
255 { WinRestrictedCodeSid, RESTRICTED, NT_AUTHORITY, SidTypeWellKnownGroup },
256 { WinTerminalServerSid, TERMINAL_SERVER_USER, NT_AUTHORITY, SidTypeWellKnownGroup },
257 { WinRemoteLogonIdSid, REMOTE_INTERACTIVE_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup },
258 { WinLocalSystemSid, SYSTEM, NT_AUTHORITY, SidTypeWellKnownGroup },
259 { WinLocalServiceSid, LOCAL_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup, LOCAL_SERVICE2 },
260 { WinNetworkServiceSid, NETWORK_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup , NETWORK_SERVICE2},
261 { WinBuiltinDomainSid, BUILTIN, BUILTIN, SidTypeDomain },
262 { WinBuiltinAdministratorsSid, Administrators, BUILTIN, SidTypeAlias },
263 { WinBuiltinUsersSid, Users, BUILTIN, SidTypeAlias },
264 { WinBuiltinGuestsSid, Guests, BUILTIN, SidTypeAlias },
265 { WinBuiltinPowerUsersSid, Power_Users, BUILTIN, SidTypeAlias },
266 { WinBuiltinAccountOperatorsSid, Account_Operators, BUILTIN, SidTypeAlias },
267 { WinBuiltinSystemOperatorsSid, Server_Operators, BUILTIN, SidTypeAlias },
268 { WinBuiltinPrintOperatorsSid, Print_Operators, BUILTIN, SidTypeAlias },
269 { WinBuiltinBackupOperatorsSid, Backup_Operators, BUILTIN, SidTypeAlias },
270 { WinBuiltinReplicatorSid, Replicators, BUILTIN, SidTypeAlias },
271 { WinBuiltinPreWindows2000CompatibleAccessSid, Pre_Windows_2000_Compatible_Access, BUILTIN, SidTypeAlias },
272 { WinBuiltinRemoteDesktopUsersSid, Remote_Desktop_Users, BUILTIN, SidTypeAlias },
273 { WinBuiltinNetworkConfigurationOperatorsSid, Network_Configuration_Operators, BUILTIN, SidTypeAlias },
274 { WinNTLMAuthenticationSid, NTML_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
275 { WinDigestAuthenticationSid, Digest_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
276 { WinSChannelAuthenticationSid, SChannel_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
277 { WinThisOrganizationSid, This_Organization, NT_AUTHORITY, SidTypeWellKnownGroup },
278 { WinOtherOrganizationSid, Other_Organization, NT_AUTHORITY, SidTypeWellKnownGroup },
279 { WinBuiltinPerfMonitoringUsersSid, Performance_Monitor_Users, BUILTIN, SidTypeAlias },
280 { WinBuiltinPerfLoggingUsersSid, Performance_Log_Users, BUILTIN, SidTypeAlias },
285 static const WCHAR SDDL_READ_CONTROL[] = {'R','C',0};
286 static const WCHAR SDDL_WRITE_DAC[] = {'W','D',0};
287 static const WCHAR SDDL_WRITE_OWNER[] = {'W','O',0};
288 static const WCHAR SDDL_STANDARD_DELETE[] = {'S','D',0};
290 static const WCHAR SDDL_READ_PROPERTY[] = {'R','P',0};
291 static const WCHAR SDDL_WRITE_PROPERTY[] = {'W','P',0};
292 static const WCHAR SDDL_CREATE_CHILD[] = {'C','C',0};
293 static const WCHAR SDDL_DELETE_CHILD[] = {'D','C',0};
294 static const WCHAR SDDL_LIST_CHILDREN[] = {'L','C',0};
295 static const WCHAR SDDL_SELF_WRITE[] = {'S','W',0};
296 static const WCHAR SDDL_LIST_OBJECT[] = {'L','O',0};
297 static const WCHAR SDDL_DELETE_TREE[] = {'D','T',0};
298 static const WCHAR SDDL_CONTROL_ACCESS[] = {'C','R',0};
300 static const WCHAR SDDL_FILE_ALL[] = {'F','A',0};
301 static const WCHAR SDDL_FILE_READ[] = {'F','R',0};
302 static const WCHAR SDDL_FILE_WRITE[] = {'F','W',0};
303 static const WCHAR SDDL_FILE_EXECUTE[] = {'F','X',0};
305 static const WCHAR SDDL_KEY_ALL[] = {'K','A',0};
306 static const WCHAR SDDL_KEY_READ[] = {'K','R',0};
307 static const WCHAR SDDL_KEY_WRITE[] = {'K','W',0};
308 static const WCHAR SDDL_KEY_EXECUTE[] = {'K','X',0};
310 static const WCHAR SDDL_GENERIC_ALL[] = {'G','A',0};
311 static const WCHAR SDDL_GENERIC_READ[] = {'G','R',0};
312 static const WCHAR SDDL_GENERIC_WRITE[] = {'G','W',0};
313 static const WCHAR SDDL_GENERIC_EXECUTE[] = {'G','X',0};
318 static const WCHAR SDDL_PROTECTED[] = {'P',0};
319 static const WCHAR SDDL_AUTO_INHERIT_REQ[] = {'A','R',0};
320 static const WCHAR SDDL_AUTO_INHERITED[] = {'A','I',0};
325 static const WCHAR SDDL_ACCESS_ALLOWED[] = {'A',0};
326 static const WCHAR SDDL_ACCESS_DENIED[] = {'D',0};
327 static const WCHAR SDDL_OBJECT_ACCESS_ALLOWED[] = {'O','A',0};
328 static const WCHAR SDDL_OBJECT_ACCESS_DENIED[] = {'O','D',0};
329 static const WCHAR SDDL_AUDIT[] = {'A','U',0};
330 static const WCHAR SDDL_ALARM[] = {'A','L',0};
331 static const WCHAR SDDL_OBJECT_AUDIT[] = {'O','U',0};
332 static const WCHAR SDDL_OBJECT_ALARMp[] = {'O','L',0};
337 static const WCHAR SDDL_CONTAINER_INHERIT[] = {'C','I',0};
338 static const WCHAR SDDL_OBJECT_INHERIT[] = {'O','I',0};
339 static const WCHAR SDDL_NO_PROPAGATE[] = {'N','P',0};
340 static const WCHAR SDDL_INHERIT_ONLY[] = {'I','O',0};
341 static const WCHAR SDDL_INHERITED[] = {'I','D',0};
342 static const WCHAR SDDL_AUDIT_SUCCESS[] = {'S','A',0};
343 static const WCHAR SDDL_AUDIT_FAILURE[] = {'F','A',0};
345 const char * debugstr_sid(PSID sid)
353 auth = psid->IdentifierAuthority.Value[5] +
354 (psid->IdentifierAuthority.Value[4] << 8) +
355 (psid->IdentifierAuthority.Value[3] << 16) +
356 (psid->IdentifierAuthority.Value[2] << 24);
358 switch (psid->SubAuthorityCount) {
360 return wine_dbg_sprintf("S-%d-%d", psid->Revision, auth);
362 return wine_dbg_sprintf("S-%d-%d-%u", psid->Revision, auth,
363 psid->SubAuthority[0]);
365 return wine_dbg_sprintf("S-%d-%d-%u-%u", psid->Revision, auth,
366 psid->SubAuthority[0], psid->SubAuthority[1]);
368 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u", psid->Revision, auth,
369 psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2]);
371 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u", psid->Revision, auth,
372 psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
373 psid->SubAuthority[3]);
375 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u", psid->Revision, auth,
376 psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
377 psid->SubAuthority[3], psid->SubAuthority[4]);
379 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
380 psid->SubAuthority[3], psid->SubAuthority[1], psid->SubAuthority[2],
381 psid->SubAuthority[0], psid->SubAuthority[4], psid->SubAuthority[5]);
383 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
384 psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
385 psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
386 psid->SubAuthority[6]);
388 return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
389 psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
390 psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
391 psid->SubAuthority[6], psid->SubAuthority[7]);
396 /* set last error code from NT status and get the proper boolean return value */
397 /* used for functions that are a simple wrapper around the corresponding ntdll API */
398 static inline BOOL set_ntstatus( NTSTATUS status )
400 if (status) SetLastError( RtlNtStatusToDosError( status ));
404 #define WINE_SIZE_OF_WORLD_ACCESS_ACL (sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD))
406 static void GetWorldAccessACL(PACL pACL)
408 PACCESS_ALLOWED_ACE pACE = (PACCESS_ALLOWED_ACE) (pACL + 1);
410 pACL->AclRevision = ACL_REVISION;
412 pACL->AclSize = WINE_SIZE_OF_WORLD_ACCESS_ACL;
416 pACE->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
417 pACE->Header.AceFlags = CONTAINER_INHERIT_ACE;
418 pACE->Header.AceSize = sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD);
419 pACE->Mask = 0xf3ffffff; /* Everything except reserved bits */
420 memcpy(&pACE->SidStart, &sidWorld, sizeof(sidWorld));
423 /************************************************************
424 * ADVAPI_IsLocalComputer
426 * Checks whether the server name indicates local machine.
428 BOOL ADVAPI_IsLocalComputer(LPCWSTR ServerName)
430 DWORD dwSize = MAX_COMPUTERNAME_LENGTH + 1;
434 if (!ServerName || !ServerName[0])
437 buf = HeapAlloc(GetProcessHeap(), 0, dwSize * sizeof(WCHAR));
438 Result = GetComputerNameW(buf, &dwSize);
439 if (Result && (ServerName[0] == '\\') && (ServerName[1] == '\\'))
441 Result = Result && !lstrcmpW(ServerName, buf);
442 HeapFree(GetProcessHeap(), 0, buf);
447 /************************************************************
448 * ADVAPI_GetComputerSid
450 * Reads the computer SID from the registry.
452 BOOL ADVAPI_GetComputerSid(PSID sid)
457 static const WCHAR Account[] = { 'S','E','C','U','R','I','T','Y','\\','S','A','M','\\','D','o','m','a','i','n','s','\\','A','c','c','o','u','n','t',0 };
458 static const WCHAR V[] = { 'V',0 };
460 if ((ret = RegOpenKeyExW(HKEY_LOCAL_MACHINE, Account, 0,
461 KEY_READ, &key)) == ERROR_SUCCESS)
464 ret = RegQueryValueExW(key, V, NULL, NULL, NULL, &size);
465 if (ret == ERROR_MORE_DATA || ret == ERROR_SUCCESS)
467 BYTE * data = HeapAlloc(GetProcessHeap(), 0, size);
470 if ((ret = RegQueryValueExW(key, V, NULL, NULL,
471 data, &size)) == ERROR_SUCCESS)
473 /* the SID is in the last 24 bytes of the binary data */
474 CopyMemory(sid, &data[size-24], 24);
477 HeapFree(GetProcessHeap(), 0, data);
483 if(retval == TRUE) return retval;
485 /* create a new random SID */
486 if (RegCreateKeyExW(HKEY_LOCAL_MACHINE, Account,
487 0, NULL, 0, KEY_ALL_ACCESS, NULL, &key, NULL) == ERROR_SUCCESS)
490 SID_IDENTIFIER_AUTHORITY identifierAuthority = {SECURITY_NT_AUTHORITY};
493 if (RtlGenRandom(id, sizeof(id)))
495 if (AllocateAndInitializeSid(&identifierAuthority, 4, SECURITY_NT_NON_UNIQUE, id[0], id[1], id[2], 0, 0, 0, 0, &new_sid))
497 if (RegSetValueExW(key, V, 0, REG_BINARY, new_sid, GetLengthSid(new_sid)) == ERROR_SUCCESS)
498 retval = CopySid(GetLengthSid(new_sid), sid, new_sid);
509 /* ##############################
510 ###### TOKEN FUNCTIONS ######
511 ##############################
514 /******************************************************************************
515 * OpenProcessToken [ADVAPI32.@]
516 * Opens the access token associated with a process handle.
519 * ProcessHandle [I] Handle to process
520 * DesiredAccess [I] Desired access to process
521 * TokenHandle [O] Pointer to handle of open access token
524 * Success: TRUE. TokenHandle contains the access token.
528 * See NtOpenProcessToken.
531 OpenProcessToken( HANDLE ProcessHandle, DWORD DesiredAccess,
532 HANDLE *TokenHandle )
534 return set_ntstatus(NtOpenProcessToken( ProcessHandle, DesiredAccess, TokenHandle ));
537 /******************************************************************************
538 * OpenThreadToken [ADVAPI32.@]
540 * Opens the access token associated with a thread handle.
543 * ThreadHandle [I] Handle to process
544 * DesiredAccess [I] Desired access to the thread
546 * TokenHandle [O] Destination for the token handle
549 * Success: TRUE. TokenHandle contains the access token.
553 * See NtOpenThreadToken.
556 OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess,
557 BOOL OpenAsSelf, HANDLE *TokenHandle)
559 return set_ntstatus( NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle));
563 AdjustTokenGroups( HANDLE TokenHandle, BOOL ResetToDefault, PTOKEN_GROUPS NewState,
564 DWORD BufferLength, PTOKEN_GROUPS PreviousState, PDWORD ReturnLength )
566 return set_ntstatus( NtAdjustGroupsToken(TokenHandle, ResetToDefault, NewState, BufferLength,
567 PreviousState, ReturnLength));
570 /******************************************************************************
571 * AdjustTokenPrivileges [ADVAPI32.@]
573 * Adjust the privileges of an open token handle.
576 * TokenHandle [I] Handle from OpenProcessToken() or OpenThreadToken()
577 * DisableAllPrivileges [I] TRUE=Remove all privileges, FALSE=Use NewState
578 * NewState [I] Desired new privileges of the token
579 * BufferLength [I] Length of NewState
580 * PreviousState [O] Destination for the previous state
581 * ReturnLength [I/O] Size of PreviousState
585 * Success: TRUE. Privileges are set to NewState and PreviousState is updated.
589 * See NtAdjustPrivilegesToken.
592 AdjustTokenPrivileges( HANDLE TokenHandle, BOOL DisableAllPrivileges,
593 PTOKEN_PRIVILEGES NewState, DWORD BufferLength,
594 PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength )
600 status = NtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges,
601 NewState, BufferLength, PreviousState,
603 SetLastError( RtlNtStatusToDosError( status ));
604 if ((status == STATUS_SUCCESS) || (status == STATUS_NOT_ALL_ASSIGNED))
610 /******************************************************************************
611 * CheckTokenMembership [ADVAPI32.@]
613 * Determine if an access token is a member of a SID.
616 * TokenHandle [I] Handle from OpenProcessToken() or OpenThreadToken()
617 * SidToCheck [I] SID that possibly contains the token
618 * IsMember [O] Destination for result.
621 * Success: TRUE. IsMember is TRUE if TokenHandle is a member, FALSE otherwise.
625 CheckTokenMembership( HANDLE token, PSID sid_to_check,
628 PTOKEN_GROUPS token_groups = NULL;
629 HANDLE thread_token = NULL;
633 TRACE("(%p %s %p)\n", token, debugstr_sid(sid_to_check), is_member);
639 if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &thread_token))
641 HANDLE process_token;
642 ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &process_token);
645 ret = DuplicateTokenEx(process_token, TOKEN_QUERY,
646 NULL, SecurityImpersonation, TokenImpersonation,
648 CloseHandle(process_token);
652 token = thread_token;
655 ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
656 if (!ret && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
659 token_groups = HeapAlloc(GetProcessHeap(), 0, size);
666 ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
670 for (i = 0; i < token_groups->GroupCount; i++)
672 TRACE("Groups[%d]: {0x%x, %s}\n", i,
673 token_groups->Groups[i].Attributes,
674 debugstr_sid(token_groups->Groups[i].Sid));
675 if ((token_groups->Groups[i].Attributes & SE_GROUP_ENABLED) &&
676 EqualSid(sid_to_check, token_groups->Groups[i].Sid))
679 TRACE("sid enabled and found in token\n");
685 HeapFree(GetProcessHeap(), 0, token_groups);
686 if (thread_token != NULL) CloseHandle(thread_token);
691 /******************************************************************************
692 * GetTokenInformation [ADVAPI32.@]
694 * Get a type of information about an access token.
697 * token [I] Handle from OpenProcessToken() or OpenThreadToken()
698 * tokeninfoclass [I] A TOKEN_INFORMATION_CLASS from "winnt.h"
699 * tokeninfo [O] Destination for token information
700 * tokeninfolength [I] Length of tokeninfo
701 * retlen [O] Destination for returned token information length
704 * Success: TRUE. tokeninfo contains retlen bytes of token information
708 * See NtQueryInformationToken.
711 GetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
712 LPVOID tokeninfo, DWORD tokeninfolength, LPDWORD retlen )
714 TRACE("(%p, %s, %p, %d, %p):\n",
716 (tokeninfoclass == TokenUser) ? "TokenUser" :
717 (tokeninfoclass == TokenGroups) ? "TokenGroups" :
718 (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" :
719 (tokeninfoclass == TokenOwner) ? "TokenOwner" :
720 (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" :
721 (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" :
722 (tokeninfoclass == TokenSource) ? "TokenSource" :
723 (tokeninfoclass == TokenType) ? "TokenType" :
724 (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" :
725 (tokeninfoclass == TokenStatistics) ? "TokenStatistics" :
726 (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" :
727 (tokeninfoclass == TokenSessionId) ? "TokenSessionId" :
728 (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" :
729 (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" :
730 (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" :
732 tokeninfo, tokeninfolength, retlen);
733 return set_ntstatus( NtQueryInformationToken( token, tokeninfoclass, tokeninfo,
734 tokeninfolength, retlen));
737 /******************************************************************************
738 * SetTokenInformation [ADVAPI32.@]
740 * Set information for an access token.
743 * token [I] Handle from OpenProcessToken() or OpenThreadToken()
744 * tokeninfoclass [I] A TOKEN_INFORMATION_CLASS from "winnt.h"
745 * tokeninfo [I] Token information to set
746 * tokeninfolength [I] Length of tokeninfo
749 * Success: TRUE. The information for the token is set to tokeninfo.
753 SetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
754 LPVOID tokeninfo, DWORD tokeninfolength )
756 TRACE("(%p, %s, %p, %d): stub\n",
758 (tokeninfoclass == TokenUser) ? "TokenUser" :
759 (tokeninfoclass == TokenGroups) ? "TokenGroups" :
760 (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" :
761 (tokeninfoclass == TokenOwner) ? "TokenOwner" :
762 (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" :
763 (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" :
764 (tokeninfoclass == TokenSource) ? "TokenSource" :
765 (tokeninfoclass == TokenType) ? "TokenType" :
766 (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" :
767 (tokeninfoclass == TokenStatistics) ? "TokenStatistics" :
768 (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" :
769 (tokeninfoclass == TokenSessionId) ? "TokenSessionId" :
770 (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" :
771 (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" :
772 (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" :
774 tokeninfo, tokeninfolength);
776 return set_ntstatus( NtSetInformationToken( token, tokeninfoclass, tokeninfo, tokeninfolength ));
779 /*************************************************************************
780 * SetThreadToken [ADVAPI32.@]
782 * Assigns an 'impersonation token' to a thread so it can assume the
783 * security privileges of another thread or process. Can also remove
784 * a previously assigned token.
787 * thread [O] Handle to thread to set the token for
788 * token [I] Token to set
791 * Success: TRUE. The threads access token is set to token
795 * Only supported on NT or higher. On Win9X this function does nothing.
796 * See SetTokenInformation.
798 BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token)
800 return set_ntstatus( NtSetInformationThread( thread ? *thread : GetCurrentThread(),
801 ThreadImpersonationToken, &token, sizeof token ));
804 /*************************************************************************
805 * CreateRestrictedToken [ADVAPI32.@]
807 * Create a new more restricted token from an existing token.
810 * baseToken [I] Token to base the new restricted token on
812 * nDisableSids [I] Length of disableSids array
813 * disableSids [I] Array of SIDs to disable in the new token
814 * nDeletePrivs [I] Length of deletePrivs array
815 * deletePrivs [I] Array of privileges to delete in the new token
816 * nRestrictSids [I] Length of restrictSids array
817 * restrictSids [I] Array of SIDs to restrict in the new token
818 * newToken [O] Address where the new token is stored
824 BOOL WINAPI CreateRestrictedToken(
828 PSID_AND_ATTRIBUTES disableSids,
830 PLUID_AND_ATTRIBUTES deletePrivs,
832 PSID_AND_ATTRIBUTES restrictSids,
835 FIXME("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p): stub\n",
836 baseToken, flags, nDisableSids, disableSids,
837 nDeletePrivs, deletePrivs,
838 nRestrictSids, restrictSids,
840 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
844 /* ##############################
845 ###### SID FUNCTIONS ######
846 ##############################
849 /******************************************************************************
850 * AllocateAndInitializeSid [ADVAPI32.@]
853 * pIdentifierAuthority []
854 * nSubAuthorityCount []
866 AllocateAndInitializeSid( PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
867 BYTE nSubAuthorityCount,
868 DWORD nSubAuthority0, DWORD nSubAuthority1,
869 DWORD nSubAuthority2, DWORD nSubAuthority3,
870 DWORD nSubAuthority4, DWORD nSubAuthority5,
871 DWORD nSubAuthority6, DWORD nSubAuthority7,
874 return set_ntstatus( RtlAllocateAndInitializeSid(
875 pIdentifierAuthority, nSubAuthorityCount,
876 nSubAuthority0, nSubAuthority1, nSubAuthority2, nSubAuthority3,
877 nSubAuthority4, nSubAuthority5, nSubAuthority6, nSubAuthority7,
881 /******************************************************************************
882 * FreeSid [ADVAPI32.@]
891 return NULL; /* is documented like this */
894 /******************************************************************************
895 * CopySid [ADVAPI32.@]
898 * nDestinationSidLength []
903 CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid )
905 return RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid);
908 /******************************************************************************
909 * CreateWellKnownSid [ADVAPI32.@]
912 CreateWellKnownSid( WELL_KNOWN_SID_TYPE WellKnownSidType,
918 TRACE("(%d, %s, %p, %p)\n", WellKnownSidType, debugstr_sid(DomainSid), pSid, cbSid);
920 if (cbSid == NULL || (DomainSid && !IsValidSid(DomainSid)))
922 SetLastError(ERROR_INVALID_PARAMETER);
926 for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++) {
927 if (WellKnownSids[i].Type == WellKnownSidType) {
928 DWORD length = GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
933 SetLastError(ERROR_INSUFFICIENT_BUFFER);
938 SetLastError(ERROR_INVALID_PARAMETER);
941 CopyMemory(pSid, &WellKnownSids[i].Sid.Revision, length);
947 if (DomainSid == NULL || *GetSidSubAuthorityCount(DomainSid) == SID_MAX_SUB_AUTHORITIES)
949 SetLastError(ERROR_INVALID_PARAMETER);
953 for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
954 if (WellKnownRids[i].Type == WellKnownSidType) {
955 UCHAR domain_subauth = *GetSidSubAuthorityCount(DomainSid);
956 DWORD domain_sid_length = GetSidLengthRequired(domain_subauth);
957 DWORD output_sid_length = GetSidLengthRequired(domain_subauth + 1);
959 if (*cbSid < output_sid_length)
961 *cbSid = output_sid_length;
962 SetLastError(ERROR_INSUFFICIENT_BUFFER);
967 SetLastError(ERROR_INVALID_PARAMETER);
970 CopyMemory(pSid, DomainSid, domain_sid_length);
971 (*GetSidSubAuthorityCount(pSid))++;
972 (*GetSidSubAuthority(pSid, domain_subauth)) = WellKnownRids[i].Rid;
973 *cbSid = output_sid_length;
977 SetLastError(ERROR_INVALID_PARAMETER);
981 /******************************************************************************
982 * IsWellKnownSid [ADVAPI32.@]
985 IsWellKnownSid( PSID pSid, WELL_KNOWN_SID_TYPE WellKnownSidType )
988 TRACE("(%s, %d)\n", debugstr_sid(pSid), WellKnownSidType);
990 for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
991 if (WellKnownSids[i].Type == WellKnownSidType)
992 if (EqualSid(pSid, (PSID)&(WellKnownSids[i].Sid.Revision)))
999 IsTokenRestricted( HANDLE TokenHandle )
1001 TOKEN_GROUPS *groups;
1006 TRACE("(%p)\n", TokenHandle);
1008 status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, NULL, 0, &size);
1009 if (status != STATUS_BUFFER_TOO_SMALL)
1012 groups = HeapAlloc(GetProcessHeap(), 0, size);
1015 SetLastError(ERROR_OUTOFMEMORY);
1019 status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, groups, size, &size);
1020 if (status != STATUS_SUCCESS)
1022 HeapFree(GetProcessHeap(), 0, groups);
1023 return set_ntstatus(status);
1026 if (groups->GroupCount)
1031 HeapFree(GetProcessHeap(), 0, groups);
1036 /******************************************************************************
1037 * IsValidSid [ADVAPI32.@]
1043 IsValidSid( PSID pSid )
1045 return RtlValidSid( pSid );
1048 /******************************************************************************
1049 * EqualSid [ADVAPI32.@]
1056 EqualSid( PSID pSid1, PSID pSid2 )
1058 BOOL ret = RtlEqualSid( pSid1, pSid2 );
1059 SetLastError(ERROR_SUCCESS);
1063 /******************************************************************************
1064 * EqualPrefixSid [ADVAPI32.@]
1066 BOOL WINAPI EqualPrefixSid (PSID pSid1, PSID pSid2)
1068 return RtlEqualPrefixSid(pSid1, pSid2);
1071 /******************************************************************************
1072 * GetSidLengthRequired [ADVAPI32.@]
1075 * nSubAuthorityCount []
1078 GetSidLengthRequired( BYTE nSubAuthorityCount )
1080 return RtlLengthRequiredSid(nSubAuthorityCount);
1083 /******************************************************************************
1084 * InitializeSid [ADVAPI32.@]
1087 * pIdentifierAuthority []
1092 PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
1093 BYTE nSubAuthorityCount)
1095 return RtlInitializeSid(pSid, pIdentifierAuthority, nSubAuthorityCount);
1099 GetEffectiveRightsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pAccessRights )
1101 FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights);
1103 *pAccessRights = STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL;
1108 GetEffectiveRightsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pAccessRights )
1110 FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights);
1115 /******************************************************************************
1116 * GetSidIdentifierAuthority [ADVAPI32.@]
1121 PSID_IDENTIFIER_AUTHORITY WINAPI
1122 GetSidIdentifierAuthority( PSID pSid )
1124 return RtlIdentifierAuthoritySid(pSid);
1127 /******************************************************************************
1128 * GetSidSubAuthority [ADVAPI32.@]
1135 GetSidSubAuthority( PSID pSid, DWORD nSubAuthority )
1137 SetLastError(ERROR_SUCCESS);
1138 return RtlSubAuthoritySid(pSid, nSubAuthority);
1141 /******************************************************************************
1142 * GetSidSubAuthorityCount [ADVAPI32.@]
1148 GetSidSubAuthorityCount (PSID pSid)
1150 SetLastError(ERROR_SUCCESS);
1151 return RtlSubAuthorityCountSid(pSid);
1154 /******************************************************************************
1155 * GetLengthSid [ADVAPI32.@]
1161 GetLengthSid (PSID pSid)
1163 return RtlLengthSid(pSid);
1166 /* ##############################################
1167 ###### SECURITY DESCRIPTOR FUNCTIONS ######
1168 ##############################################
1171 /******************************************************************************
1172 * BuildSecurityDescriptorA [ADVAPI32.@]
1179 * cCountOfAccessEntries [I]
1180 * pListOfAccessEntries [I]
1181 * cCountOfAuditEntries [I]
1182 * pListofAuditEntries [I]
1184 * lpdwBufferLength [I/O]
1188 * Success: ERROR_SUCCESS
1189 * Failure: nonzero error code from Winerror.h
1191 DWORD WINAPI BuildSecurityDescriptorA(
1192 IN PTRUSTEEA pOwner,
1193 IN PTRUSTEEA pGroup,
1194 IN ULONG cCountOfAccessEntries,
1195 IN PEXPLICIT_ACCESSA pListOfAccessEntries,
1196 IN ULONG cCountOfAuditEntries,
1197 IN PEXPLICIT_ACCESSA pListofAuditEntries,
1198 IN PSECURITY_DESCRIPTOR pOldSD,
1199 IN OUT PULONG lpdwBufferLength,
1200 OUT PSECURITY_DESCRIPTOR* pNewSD)
1202 FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup,
1203 cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries,
1204 pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD);
1206 return ERROR_CALL_NOT_IMPLEMENTED;
1209 /******************************************************************************
1210 * BuildSecurityDescriptorW [ADVAPI32.@]
1212 * See BuildSecurityDescriptorA.
1214 DWORD WINAPI BuildSecurityDescriptorW(
1215 IN PTRUSTEEW pOwner,
1216 IN PTRUSTEEW pGroup,
1217 IN ULONG cCountOfAccessEntries,
1218 IN PEXPLICIT_ACCESSW pListOfAccessEntries,
1219 IN ULONG cCountOfAuditEntries,
1220 IN PEXPLICIT_ACCESSW pListofAuditEntries,
1221 IN PSECURITY_DESCRIPTOR pOldSD,
1222 IN OUT PULONG lpdwBufferLength,
1223 OUT PSECURITY_DESCRIPTOR* pNewSD)
1225 FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup,
1226 cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries,
1227 pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD);
1229 return ERROR_CALL_NOT_IMPLEMENTED;
1232 /******************************************************************************
1233 * InitializeSecurityDescriptor [ADVAPI32.@]
1240 InitializeSecurityDescriptor( PSECURITY_DESCRIPTOR pDescr, DWORD revision )
1242 return set_ntstatus( RtlCreateSecurityDescriptor(pDescr, revision ));
1246 /******************************************************************************
1247 * MakeAbsoluteSD [ADVAPI32.@]
1249 BOOL WINAPI MakeAbsoluteSD (
1250 IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
1251 OUT PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
1252 OUT LPDWORD lpdwAbsoluteSecurityDescriptorSize,
1254 OUT LPDWORD lpdwDaclSize,
1256 OUT LPDWORD lpdwSaclSize,
1258 OUT LPDWORD lpdwOwnerSize,
1259 OUT PSID pPrimaryGroup,
1260 OUT LPDWORD lpdwPrimaryGroupSize)
1262 return set_ntstatus( RtlSelfRelativeToAbsoluteSD(pSelfRelativeSecurityDescriptor,
1263 pAbsoluteSecurityDescriptor,
1264 lpdwAbsoluteSecurityDescriptorSize,
1265 pDacl, lpdwDaclSize, pSacl, lpdwSaclSize,
1266 pOwner, lpdwOwnerSize,
1267 pPrimaryGroup, lpdwPrimaryGroupSize));
1270 /******************************************************************************
1271 * GetKernelObjectSecurity [ADVAPI32.@]
1273 BOOL WINAPI GetKernelObjectSecurity(
1275 SECURITY_INFORMATION RequestedInformation,
1276 PSECURITY_DESCRIPTOR pSecurityDescriptor,
1278 LPDWORD lpnLengthNeeded )
1280 TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", Handle, RequestedInformation,
1281 pSecurityDescriptor, nLength, lpnLengthNeeded);
1283 return set_ntstatus( NtQuerySecurityObject(Handle, RequestedInformation, pSecurityDescriptor,
1284 nLength, lpnLengthNeeded ));
1287 /******************************************************************************
1288 * GetPrivateObjectSecurity [ADVAPI32.@]
1290 BOOL WINAPI GetPrivateObjectSecurity(
1291 PSECURITY_DESCRIPTOR ObjectDescriptor,
1292 SECURITY_INFORMATION SecurityInformation,
1293 PSECURITY_DESCRIPTOR ResultantDescriptor,
1294 DWORD DescriptorLength,
1295 PDWORD ReturnLength )
1297 SECURITY_DESCRIPTOR desc;
1298 BOOL defaulted, present;
1302 TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", ObjectDescriptor, SecurityInformation,
1303 ResultantDescriptor, DescriptorLength, ReturnLength);
1305 if (!InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION))
1308 if (SecurityInformation & OWNER_SECURITY_INFORMATION)
1310 if (!GetSecurityDescriptorOwner(ObjectDescriptor, &psid, &defaulted))
1312 SetSecurityDescriptorOwner(&desc, psid, defaulted);
1315 if (SecurityInformation & GROUP_SECURITY_INFORMATION)
1317 if (!GetSecurityDescriptorGroup(ObjectDescriptor, &psid, &defaulted))
1319 SetSecurityDescriptorGroup(&desc, psid, defaulted);
1322 if (SecurityInformation & DACL_SECURITY_INFORMATION)
1324 if (!GetSecurityDescriptorDacl(ObjectDescriptor, &present, &pacl, &defaulted))
1326 SetSecurityDescriptorDacl(&desc, present, pacl, defaulted);
1329 if (SecurityInformation & SACL_SECURITY_INFORMATION)
1331 if (!GetSecurityDescriptorSacl(ObjectDescriptor, &present, &pacl, &defaulted))
1333 SetSecurityDescriptorSacl(&desc, present, pacl, defaulted);
1336 *ReturnLength = DescriptorLength;
1337 return MakeSelfRelativeSD(&desc, ResultantDescriptor, ReturnLength);
1340 /******************************************************************************
1341 * GetSecurityDescriptorLength [ADVAPI32.@]
1343 DWORD WINAPI GetSecurityDescriptorLength( PSECURITY_DESCRIPTOR pDescr)
1345 return RtlLengthSecurityDescriptor(pDescr);
1348 /******************************************************************************
1349 * GetSecurityDescriptorOwner [ADVAPI32.@]
1353 * lpbOwnerDefaulted []
1356 GetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pDescr, PSID *pOwner,
1357 LPBOOL lpbOwnerDefaulted )
1360 BOOL ret = set_ntstatus( RtlGetOwnerSecurityDescriptor( pDescr, pOwner, &defaulted ));
1361 *lpbOwnerDefaulted = defaulted;
1365 /******************************************************************************
1366 * SetSecurityDescriptorOwner [ADVAPI32.@]
1370 BOOL WINAPI SetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1371 PSID pOwner, BOOL bOwnerDefaulted)
1373 return set_ntstatus( RtlSetOwnerSecurityDescriptor(pSecurityDescriptor, pOwner, bOwnerDefaulted));
1375 /******************************************************************************
1376 * GetSecurityDescriptorGroup [ADVAPI32.@]
1378 BOOL WINAPI GetSecurityDescriptorGroup(
1379 PSECURITY_DESCRIPTOR SecurityDescriptor,
1381 LPBOOL GroupDefaulted)
1384 BOOL ret = set_ntstatus( RtlGetGroupSecurityDescriptor(SecurityDescriptor, Group, &defaulted ));
1385 *GroupDefaulted = defaulted;
1388 /******************************************************************************
1389 * SetSecurityDescriptorGroup [ADVAPI32.@]
1391 BOOL WINAPI SetSecurityDescriptorGroup ( PSECURITY_DESCRIPTOR SecurityDescriptor,
1392 PSID Group, BOOL GroupDefaulted)
1394 return set_ntstatus( RtlSetGroupSecurityDescriptor( SecurityDescriptor, Group, GroupDefaulted));
1397 /******************************************************************************
1398 * IsValidSecurityDescriptor [ADVAPI32.@]
1404 IsValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor )
1406 return set_ntstatus( RtlValidSecurityDescriptor(SecurityDescriptor));
1409 /******************************************************************************
1410 * GetSecurityDescriptorDacl [ADVAPI32.@]
1412 BOOL WINAPI GetSecurityDescriptorDacl(
1413 IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
1414 OUT LPBOOL lpbDaclPresent,
1416 OUT LPBOOL lpbDaclDefaulted)
1418 BOOLEAN present, defaulted;
1419 BOOL ret = set_ntstatus( RtlGetDaclSecurityDescriptor(pSecurityDescriptor, &present, pDacl, &defaulted));
1420 *lpbDaclPresent = present;
1421 *lpbDaclDefaulted = defaulted;
1425 /******************************************************************************
1426 * SetSecurityDescriptorDacl [ADVAPI32.@]
1429 SetSecurityDescriptorDacl (
1430 PSECURITY_DESCRIPTOR lpsd,
1433 BOOL dacldefaulted )
1435 return set_ntstatus( RtlSetDaclSecurityDescriptor (lpsd, daclpresent, dacl, dacldefaulted ) );
1437 /******************************************************************************
1438 * GetSecurityDescriptorSacl [ADVAPI32.@]
1440 BOOL WINAPI GetSecurityDescriptorSacl(
1441 IN PSECURITY_DESCRIPTOR lpsd,
1442 OUT LPBOOL lpbSaclPresent,
1444 OUT LPBOOL lpbSaclDefaulted)
1446 BOOLEAN present, defaulted;
1447 BOOL ret = set_ntstatus( RtlGetSaclSecurityDescriptor(lpsd, &present, pSacl, &defaulted) );
1448 *lpbSaclPresent = present;
1449 *lpbSaclDefaulted = defaulted;
1453 /**************************************************************************
1454 * SetSecurityDescriptorSacl [ADVAPI32.@]
1456 BOOL WINAPI SetSecurityDescriptorSacl (
1457 PSECURITY_DESCRIPTOR lpsd,
1462 return set_ntstatus (RtlSetSaclSecurityDescriptor(lpsd, saclpresent, lpsacl, sacldefaulted));
1464 /******************************************************************************
1465 * MakeSelfRelativeSD [ADVAPI32.@]
1474 IN PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
1475 IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
1476 IN OUT LPDWORD lpdwBufferLength)
1478 return set_ntstatus( RtlMakeSelfRelativeSD( pAbsoluteSecurityDescriptor,
1479 pSelfRelativeSecurityDescriptor, lpdwBufferLength));
1482 /******************************************************************************
1483 * GetSecurityDescriptorControl [ADVAPI32.@]
1486 BOOL WINAPI GetSecurityDescriptorControl ( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1487 PSECURITY_DESCRIPTOR_CONTROL pControl, LPDWORD lpdwRevision)
1489 return set_ntstatus( RtlGetControlSecurityDescriptor(pSecurityDescriptor,pControl,lpdwRevision));
1492 /******************************************************************************
1493 * SetSecurityDescriptorControl [ADVAPI32.@]
1495 BOOL WINAPI SetSecurityDescriptorControl( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1496 SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest,
1497 SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet )
1499 return set_ntstatus( RtlSetControlSecurityDescriptor(
1500 pSecurityDescriptor, ControlBitsOfInterest, ControlBitsToSet ) );
1503 /* ##############################
1504 ###### ACL FUNCTIONS ######
1505 ##############################
1508 /*************************************************************************
1509 * InitializeAcl [ADVAPI32.@]
1511 BOOL WINAPI InitializeAcl(PACL acl, DWORD size, DWORD rev)
1513 return set_ntstatus( RtlCreateAcl(acl, size, rev));
1516 BOOL WINAPI ImpersonateNamedPipeClient( HANDLE hNamedPipe )
1518 IO_STATUS_BLOCK io_block;
1520 TRACE("(%p)\n", hNamedPipe);
1522 return set_ntstatus( NtFsControlFile(hNamedPipe, NULL, NULL, NULL,
1523 &io_block, FSCTL_PIPE_IMPERSONATE, NULL, 0, NULL, 0) );
1526 /******************************************************************************
1527 * AddAccessAllowedAce [ADVAPI32.@]
1529 BOOL WINAPI AddAccessAllowedAce(
1531 IN DWORD dwAceRevision,
1532 IN DWORD AccessMask,
1535 return set_ntstatus(RtlAddAccessAllowedAce(pAcl, dwAceRevision, AccessMask, pSid));
1538 /******************************************************************************
1539 * AddAccessAllowedAceEx [ADVAPI32.@]
1541 BOOL WINAPI AddAccessAllowedAceEx(
1543 IN DWORD dwAceRevision,
1545 IN DWORD AccessMask,
1548 return set_ntstatus(RtlAddAccessAllowedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid));
1551 /******************************************************************************
1552 * AddAccessDeniedAce [ADVAPI32.@]
1554 BOOL WINAPI AddAccessDeniedAce(
1556 IN DWORD dwAceRevision,
1557 IN DWORD AccessMask,
1560 return set_ntstatus(RtlAddAccessDeniedAce(pAcl, dwAceRevision, AccessMask, pSid));
1563 /******************************************************************************
1564 * AddAccessDeniedAceEx [ADVAPI32.@]
1566 BOOL WINAPI AddAccessDeniedAceEx(
1568 IN DWORD dwAceRevision,
1570 IN DWORD AccessMask,
1573 return set_ntstatus(RtlAddAccessDeniedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid));
1576 /******************************************************************************
1577 * AddAce [ADVAPI32.@]
1581 IN DWORD dwAceRevision,
1582 IN DWORD dwStartingAceIndex,
1584 DWORD nAceListLength)
1586 return set_ntstatus(RtlAddAce(pAcl, dwAceRevision, dwStartingAceIndex, pAceList, nAceListLength));
1589 /******************************************************************************
1590 * DeleteAce [ADVAPI32.@]
1592 BOOL WINAPI DeleteAce(PACL pAcl, DWORD dwAceIndex)
1594 return set_ntstatus(RtlDeleteAce(pAcl, dwAceIndex));
1597 /******************************************************************************
1598 * FindFirstFreeAce [ADVAPI32.@]
1600 BOOL WINAPI FindFirstFreeAce(IN PACL pAcl, LPVOID * pAce)
1602 return RtlFirstFreeAce(pAcl, (PACE_HEADER *)pAce);
1605 /******************************************************************************
1606 * GetAce [ADVAPI32.@]
1608 BOOL WINAPI GetAce(PACL pAcl,DWORD dwAceIndex,LPVOID *pAce )
1610 return set_ntstatus(RtlGetAce(pAcl, dwAceIndex, pAce));
1613 /******************************************************************************
1614 * GetAclInformation [ADVAPI32.@]
1616 BOOL WINAPI GetAclInformation(
1618 LPVOID pAclInformation,
1619 DWORD nAclInformationLength,
1620 ACL_INFORMATION_CLASS dwAclInformationClass)
1622 return set_ntstatus(RtlQueryInformationAcl(pAcl, pAclInformation,
1623 nAclInformationLength, dwAclInformationClass));
1626 /******************************************************************************
1627 * IsValidAcl [ADVAPI32.@]
1629 BOOL WINAPI IsValidAcl(IN PACL pAcl)
1631 return RtlValidAcl(pAcl);
1634 /* ##############################
1635 ###### MISC FUNCTIONS ######
1636 ##############################
1639 /******************************************************************************
1640 * AllocateLocallyUniqueId [ADVAPI32.@]
1645 BOOL WINAPI AllocateLocallyUniqueId( PLUID lpLuid )
1647 return set_ntstatus(NtAllocateLocallyUniqueId(lpLuid));
1650 static const WCHAR SE_CREATE_TOKEN_NAME_W[] =
1651 { 'S','e','C','r','e','a','t','e','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 };
1652 static const WCHAR SE_ASSIGNPRIMARYTOKEN_NAME_W[] =
1653 { 'S','e','A','s','s','i','g','n','P','r','i','m','a','r','y','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 };
1654 static const WCHAR SE_LOCK_MEMORY_NAME_W[] =
1655 { 'S','e','L','o','c','k','M','e','m','o','r','y','P','r','i','v','i','l','e','g','e',0 };
1656 static const WCHAR SE_INCREASE_QUOTA_NAME_W[] =
1657 { 'S','e','I','n','c','r','e','a','s','e','Q','u','o','t','a','P','r','i','v','i','l','e','g','e',0 };
1658 static const WCHAR SE_MACHINE_ACCOUNT_NAME_W[] =
1659 { 'S','e','M','a','c','h','i','n','e','A','c','c','o','u','n','t','P','r','i','v','i','l','e','g','e',0 };
1660 static const WCHAR SE_TCB_NAME_W[] =
1661 { 'S','e','T','c','b','P','r','i','v','i','l','e','g','e',0 };
1662 static const WCHAR SE_SECURITY_NAME_W[] =
1663 { 'S','e','S','e','c','u','r','i','t','y','P','r','i','v','i','l','e','g','e',0 };
1664 static const WCHAR SE_TAKE_OWNERSHIP_NAME_W[] =
1665 { 'S','e','T','a','k','e','O','w','n','e','r','s','h','i','p','P','r','i','v','i','l','e','g','e',0 };
1666 static const WCHAR SE_LOAD_DRIVER_NAME_W[] =
1667 { 'S','e','L','o','a','d','D','r','i','v','e','r','P','r','i','v','i','l','e','g','e',0 };
1668 static const WCHAR SE_SYSTEM_PROFILE_NAME_W[] =
1669 { 'S','e','S','y','s','t','e','m','P','r','o','f','i','l','e','P','r','i','v','i','l','e','g','e',0 };
1670 static const WCHAR SE_SYSTEMTIME_NAME_W[] =
1671 { 'S','e','S','y','s','t','e','m','t','i','m','e','P','r','i','v','i','l','e','g','e',0 };
1672 static const WCHAR SE_PROF_SINGLE_PROCESS_NAME_W[] =
1673 { 'S','e','P','r','o','f','i','l','e','S','i','n','g','l','e','P','r','o','c','e','s','s','P','r','i','v','i','l','e','g','e',0 };
1674 static const WCHAR SE_INC_BASE_PRIORITY_NAME_W[] =
1675 { 'S','e','I','n','c','r','e','a','s','e','B','a','s','e','P','r','i','o','r','i','t','y','P','r','i','v','i','l','e','g','e',0 };
1676 static const WCHAR SE_CREATE_PAGEFILE_NAME_W[] =
1677 { 'S','e','C','r','e','a','t','e','P','a','g','e','f','i','l','e','P','r','i','v','i','l','e','g','e',0 };
1678 static const WCHAR SE_CREATE_PERMANENT_NAME_W[] =
1679 { 'S','e','C','r','e','a','t','e','P','e','r','m','a','n','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1680 static const WCHAR SE_BACKUP_NAME_W[] =
1681 { 'S','e','B','a','c','k','u','p','P','r','i','v','i','l','e','g','e',0 };
1682 static const WCHAR SE_RESTORE_NAME_W[] =
1683 { 'S','e','R','e','s','t','o','r','e','P','r','i','v','i','l','e','g','e',0 };
1684 static const WCHAR SE_SHUTDOWN_NAME_W[] =
1685 { 'S','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 };
1686 static const WCHAR SE_DEBUG_NAME_W[] =
1687 { 'S','e','D','e','b','u','g','P','r','i','v','i','l','e','g','e',0 };
1688 static const WCHAR SE_AUDIT_NAME_W[] =
1689 { 'S','e','A','u','d','i','t','P','r','i','v','i','l','e','g','e',0 };
1690 static const WCHAR SE_SYSTEM_ENVIRONMENT_NAME_W[] =
1691 { 'S','e','S','y','s','t','e','m','E','n','v','i','r','o','n','m','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1692 static const WCHAR SE_CHANGE_NOTIFY_NAME_W[] =
1693 { 'S','e','C','h','a','n','g','e','N','o','t','i','f','y','P','r','i','v','i','l','e','g','e',0 };
1694 static const WCHAR SE_REMOTE_SHUTDOWN_NAME_W[] =
1695 { 'S','e','R','e','m','o','t','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 };
1696 static const WCHAR SE_UNDOCK_NAME_W[] =
1697 { 'S','e','U','n','d','o','c','k','P','r','i','v','i','l','e','g','e',0 };
1698 static const WCHAR SE_SYNC_AGENT_NAME_W[] =
1699 { 'S','e','S','y','n','c','A','g','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1700 static const WCHAR SE_ENABLE_DELEGATION_NAME_W[] =
1701 { 'S','e','E','n','a','b','l','e','D','e','l','e','g','a','t','i','o','n','P','r','i','v','i','l','e','g','e',0 };
1702 static const WCHAR SE_MANAGE_VOLUME_NAME_W[] =
1703 { 'S','e','M','a','n','a','g','e','V','o','l','u','m','e','P','r','i','v','i','l','e','g','e',0 };
1704 static const WCHAR SE_IMPERSONATE_NAME_W[] =
1705 { 'S','e','I','m','p','e','r','s','o','n','a','t','e','P','r','i','v','i','l','e','g','e',0 };
1706 static const WCHAR SE_CREATE_GLOBAL_NAME_W[] =
1707 { 'S','e','C','r','e','a','t','e','G','l','o','b','a','l','P','r','i','v','i','l','e','g','e',0 };
1709 static const WCHAR * const WellKnownPrivNames[SE_MAX_WELL_KNOWN_PRIVILEGE + 1] =
1713 SE_CREATE_TOKEN_NAME_W,
1714 SE_ASSIGNPRIMARYTOKEN_NAME_W,
1715 SE_LOCK_MEMORY_NAME_W,
1716 SE_INCREASE_QUOTA_NAME_W,
1717 SE_MACHINE_ACCOUNT_NAME_W,
1720 SE_TAKE_OWNERSHIP_NAME_W,
1721 SE_LOAD_DRIVER_NAME_W,
1722 SE_SYSTEM_PROFILE_NAME_W,
1723 SE_SYSTEMTIME_NAME_W,
1724 SE_PROF_SINGLE_PROCESS_NAME_W,
1725 SE_INC_BASE_PRIORITY_NAME_W,
1726 SE_CREATE_PAGEFILE_NAME_W,
1727 SE_CREATE_PERMANENT_NAME_W,
1733 SE_SYSTEM_ENVIRONMENT_NAME_W,
1734 SE_CHANGE_NOTIFY_NAME_W,
1735 SE_REMOTE_SHUTDOWN_NAME_W,
1737 SE_SYNC_AGENT_NAME_W,
1738 SE_ENABLE_DELEGATION_NAME_W,
1739 SE_MANAGE_VOLUME_NAME_W,
1740 SE_IMPERSONATE_NAME_W,
1741 SE_CREATE_GLOBAL_NAME_W,
1744 /******************************************************************************
1745 * LookupPrivilegeValueW [ADVAPI32.@]
1747 * See LookupPrivilegeValueA.
1750 LookupPrivilegeValueW( LPCWSTR lpSystemName, LPCWSTR lpName, PLUID lpLuid )
1754 TRACE("%s,%s,%p\n",debugstr_w(lpSystemName), debugstr_w(lpName), lpLuid);
1756 if (!ADVAPI_IsLocalComputer(lpSystemName))
1758 SetLastError(RPC_S_SERVER_UNAVAILABLE);
1763 SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1766 for( i=SE_MIN_WELL_KNOWN_PRIVILEGE; i<=SE_MAX_WELL_KNOWN_PRIVILEGE; i++ )
1768 if( !WellKnownPrivNames[i] )
1770 if( strcmpiW( WellKnownPrivNames[i], lpName) )
1772 lpLuid->LowPart = i;
1773 lpLuid->HighPart = 0;
1774 TRACE( "%s -> %08x-%08x\n",debugstr_w( lpSystemName ),
1775 lpLuid->HighPart, lpLuid->LowPart );
1778 SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1782 /******************************************************************************
1783 * LookupPrivilegeValueA [ADVAPI32.@]
1785 * Retrieves LUID used on a system to represent the privilege name.
1788 * lpSystemName [I] Name of the system
1789 * lpName [I] Name of the privilege
1790 * lpLuid [O] Destination for the resulting LUID
1793 * Success: TRUE. lpLuid contains the requested LUID.
1797 LookupPrivilegeValueA( LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid )
1799 UNICODE_STRING lpSystemNameW;
1800 UNICODE_STRING lpNameW;
1803 RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
1804 RtlCreateUnicodeStringFromAsciiz(&lpNameW,lpName);
1805 ret = LookupPrivilegeValueW(lpSystemNameW.Buffer, lpNameW.Buffer, lpLuid);
1806 RtlFreeUnicodeString(&lpNameW);
1807 RtlFreeUnicodeString(&lpSystemNameW);
1811 BOOL WINAPI LookupPrivilegeDisplayNameA( LPCSTR lpSystemName, LPCSTR lpName, LPSTR lpDisplayName,
1812 LPDWORD cchDisplayName, LPDWORD lpLanguageId )
1814 FIXME("%s %s %s %p %p - stub\n", debugstr_a(lpSystemName), debugstr_a(lpName),
1815 debugstr_a(lpDisplayName), cchDisplayName, lpLanguageId);
1820 BOOL WINAPI LookupPrivilegeDisplayNameW( LPCWSTR lpSystemName, LPCWSTR lpName, LPWSTR lpDisplayName,
1821 LPDWORD cchDisplayName, LPDWORD lpLanguageId )
1823 FIXME("%s %s %s %p %p - stub\n", debugstr_w(lpSystemName), debugstr_w(lpName),
1824 debugstr_w(lpDisplayName), cchDisplayName, lpLanguageId);
1829 /******************************************************************************
1830 * LookupPrivilegeNameA [ADVAPI32.@]
1832 * See LookupPrivilegeNameW.
1835 LookupPrivilegeNameA( LPCSTR lpSystemName, PLUID lpLuid, LPSTR lpName,
1838 UNICODE_STRING lpSystemNameW;
1842 TRACE("%s %p %p %p\n", debugstr_a(lpSystemName), lpLuid, lpName, cchName);
1844 RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
1845 ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, NULL, &wLen);
1846 if (!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
1848 LPWSTR lpNameW = HeapAlloc(GetProcessHeap(), 0, wLen * sizeof(WCHAR));
1850 ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, lpNameW,
1854 /* Windows crashes if cchName is NULL, so will I */
1855 unsigned int len = WideCharToMultiByte(CP_ACP, 0, lpNameW, -1, lpName,
1856 *cchName, NULL, NULL);
1860 /* WideCharToMultiByte failed */
1863 else if (len > *cchName)
1866 SetLastError(ERROR_INSUFFICIENT_BUFFER);
1871 /* WideCharToMultiByte succeeded, output length needs to be
1872 * length not including NULL terminator
1877 HeapFree(GetProcessHeap(), 0, lpNameW);
1879 RtlFreeUnicodeString(&lpSystemNameW);
1883 /******************************************************************************
1884 * LookupPrivilegeNameW [ADVAPI32.@]
1886 * Retrieves the privilege name referred to by the LUID lpLuid.
1889 * lpSystemName [I] Name of the system
1890 * lpLuid [I] Privilege value
1891 * lpName [O] Name of the privilege
1892 * cchName [I/O] Number of characters in lpName.
1895 * Success: TRUE. lpName contains the name of the privilege whose value is
1900 * Only well-known privilege names (those defined in winnt.h) can be retrieved
1901 * using this function.
1902 * If the length of lpName is too small, on return *cchName will contain the
1903 * number of WCHARs needed to contain the privilege, including the NULL
1904 * terminator, and GetLastError will return ERROR_INSUFFICIENT_BUFFER.
1905 * On success, *cchName will contain the number of characters stored in
1906 * lpName, NOT including the NULL terminator.
1909 LookupPrivilegeNameW( LPCWSTR lpSystemName, PLUID lpLuid, LPWSTR lpName,
1914 TRACE("%s,%p,%p,%p\n",debugstr_w(lpSystemName), lpLuid, lpName, cchName);
1916 if (!ADVAPI_IsLocalComputer(lpSystemName))
1918 SetLastError(RPC_S_SERVER_UNAVAILABLE);
1921 if (lpLuid->HighPart || (lpLuid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
1922 lpLuid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE))
1924 SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1927 privNameLen = strlenW(WellKnownPrivNames[lpLuid->LowPart]);
1928 /* Windows crashes if cchName is NULL, so will I */
1929 if (*cchName <= privNameLen)
1931 *cchName = privNameLen + 1;
1932 SetLastError(ERROR_INSUFFICIENT_BUFFER);
1937 strcpyW(lpName, WellKnownPrivNames[lpLuid->LowPart]);
1938 *cchName = privNameLen;
1943 /******************************************************************************
1944 * GetFileSecurityA [ADVAPI32.@]
1946 * Obtains Specified information about the security of a file or directory.
1949 * lpFileName [I] Name of the file to get info for
1950 * RequestedInformation [I] SE_ flags from "winnt.h"
1951 * pSecurityDescriptor [O] Destination for security information
1952 * nLength [I] Length of pSecurityDescriptor
1953 * lpnLengthNeeded [O] Destination for length of returned security information
1956 * Success: TRUE. pSecurityDescriptor contains the requested information.
1957 * Failure: FALSE. lpnLengthNeeded contains the required space to return the info.
1960 * The information returned is constrained by the callers access rights and
1964 GetFileSecurityA( LPCSTR lpFileName,
1965 SECURITY_INFORMATION RequestedInformation,
1966 PSECURITY_DESCRIPTOR pSecurityDescriptor,
1967 DWORD nLength, LPDWORD lpnLengthNeeded )
1975 len = MultiByteToWideChar( CP_ACP, 0, lpFileName, -1, NULL, 0 );
1976 name = HeapAlloc( GetProcessHeap(), 0, len*sizeof(WCHAR) );
1977 MultiByteToWideChar( CP_ACP, 0, lpFileName, -1, name, len );
1980 r = GetFileSecurityW( name, RequestedInformation, pSecurityDescriptor,
1981 nLength, lpnLengthNeeded );
1982 HeapFree( GetProcessHeap(), 0, name );
1987 /******************************************************************************
1988 * GetFileSecurityW [ADVAPI32.@]
1990 * See GetFileSecurityA.
1993 GetFileSecurityW( LPCWSTR lpFileName,
1994 SECURITY_INFORMATION RequestedInformation,
1995 PSECURITY_DESCRIPTOR pSecurityDescriptor,
1996 DWORD nLength, LPDWORD lpnLengthNeeded )
2002 TRACE("(%s,%d,%p,%d,%p)\n", debugstr_w(lpFileName),
2003 RequestedInformation, pSecurityDescriptor,
2004 nLength, lpnLengthNeeded);
2006 if (RequestedInformation & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|
2007 DACL_SECURITY_INFORMATION))
2008 access |= READ_CONTROL;
2009 if (RequestedInformation & SACL_SECURITY_INFORMATION)
2010 access |= ACCESS_SYSTEM_SECURITY;
2012 hfile = CreateFileW( lpFileName, access, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
2013 NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0 );
2014 if ( hfile == INVALID_HANDLE_VALUE )
2017 status = NtQuerySecurityObject( hfile, RequestedInformation, pSecurityDescriptor,
2018 nLength, lpnLengthNeeded );
2019 CloseHandle( hfile );
2020 return set_ntstatus( status );
2024 /******************************************************************************
2025 * LookupAccountSidA [ADVAPI32.@]
2032 IN OUT LPDWORD accountSize,
2034 IN OUT LPDWORD domainSize,
2035 OUT PSID_NAME_USE name_use )
2039 LPWSTR systemW = NULL;
2040 LPWSTR accountW = NULL;
2041 LPWSTR domainW = NULL;
2042 DWORD accountSizeW = *accountSize;
2043 DWORD domainSizeW = *domainSize;
2046 len = MultiByteToWideChar( CP_ACP, 0, system, -1, NULL, 0 );
2047 systemW = HeapAlloc( GetProcessHeap(), 0, len * sizeof(WCHAR) );
2048 MultiByteToWideChar( CP_ACP, 0, system, -1, systemW, len );
2051 accountW = HeapAlloc( GetProcessHeap(), 0, accountSizeW * sizeof(WCHAR) );
2053 domainW = HeapAlloc( GetProcessHeap(), 0, domainSizeW * sizeof(WCHAR) );
2055 r = LookupAccountSidW( systemW, sid, accountW, &accountSizeW, domainW, &domainSizeW, name_use );
2058 if (accountW && *accountSize) {
2059 len = WideCharToMultiByte( CP_ACP, 0, accountW, -1, NULL, 0, NULL, NULL );
2060 WideCharToMultiByte( CP_ACP, 0, accountW, -1, account, len, NULL, NULL );
2063 *accountSize = accountSizeW + 1;
2065 if (domainW && *domainSize) {
2066 len = WideCharToMultiByte( CP_ACP, 0, domainW, -1, NULL, 0, NULL, NULL );
2067 WideCharToMultiByte( CP_ACP, 0, domainW, -1, domain, len, NULL, NULL );
2070 *domainSize = domainSizeW + 1;
2073 HeapFree( GetProcessHeap(), 0, systemW );
2074 HeapFree( GetProcessHeap(), 0, accountW );
2075 HeapFree( GetProcessHeap(), 0, domainW );
2080 /******************************************************************************
2081 * LookupAccountSidW [ADVAPI32.@]
2098 IN OUT LPDWORD accountSize,
2100 IN OUT LPDWORD domainSize,
2101 OUT PSID_NAME_USE name_use )
2104 const WCHAR * ac = NULL;
2105 const WCHAR * dm = NULL;
2106 SID_NAME_USE use = 0;
2107 LPWSTR computer_name = NULL;
2108 LPWSTR account_name = NULL;
2110 TRACE("(%s,sid=%s,%p,%p(%u),%p,%p(%u),%p)\n",
2111 debugstr_w(system),debugstr_sid(sid),
2112 account,accountSize,accountSize?*accountSize:0,
2113 domain,domainSize,domainSize?*domainSize:0,
2116 if (!ADVAPI_IsLocalComputer(system)) {
2117 FIXME("Only local computer supported!\n");
2118 SetLastError(RPC_S_SERVER_UNAVAILABLE);
2122 /* check the well known SIDs first */
2123 for (i = 0; i <= 60; i++) {
2124 if (IsWellKnownSid(sid, i)) {
2125 for (j = 0; j < (sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0])); j++) {
2126 if (ACCOUNT_SIDS[j].type == i) {
2127 ac = ACCOUNT_SIDS[j].account;
2128 dm = ACCOUNT_SIDS[j].domain;
2129 use = ACCOUNT_SIDS[j].name_use;
2139 /* check for the local computer next */
2140 if (ADVAPI_GetComputerSid(&local)) {
2141 DWORD size = MAX_COMPUTERNAME_LENGTH + 1;
2144 computer_name = HeapAlloc(GetProcessHeap(), 0, size * sizeof(WCHAR));
2145 result = GetComputerNameW(computer_name, &size);
2148 if (EqualSid(sid, &local)) {
2153 local.SubAuthorityCount++;
2155 if (EqualPrefixSid(sid, &local)) {
2158 switch (((MAX_SID *)sid)->SubAuthority[4]) {
2159 case DOMAIN_USER_RID_ADMIN:
2162 case DOMAIN_USER_RID_GUEST:
2165 case DOMAIN_GROUP_RID_ADMINS:
2168 case DOMAIN_GROUP_RID_USERS:
2171 case DOMAIN_GROUP_RID_GUESTS:
2174 case DOMAIN_GROUP_RID_COMPUTERS:
2175 ac = Domain_Computers;
2177 case DOMAIN_GROUP_RID_CONTROLLERS:
2178 ac = Domain_Controllers;
2180 case DOMAIN_GROUP_RID_CERT_ADMINS:
2181 ac = Cert_Publishers;
2183 case DOMAIN_GROUP_RID_SCHEMA_ADMINS:
2186 case DOMAIN_GROUP_RID_ENTERPRISE_ADMINS:
2187 ac = Enterprise_Admins;
2189 case DOMAIN_GROUP_RID_POLICY_ADMINS:
2190 ac = Group_Policy_Creator_Owners;
2192 case DOMAIN_ALIAS_RID_RAS_SERVERS:
2193 ac = RAS_and_IAS_Servers;
2195 case 1000: /* first user account */
2197 account_name = HeapAlloc(
2198 GetProcessHeap(), 0, size * sizeof(WCHAR));
2199 if (GetUserNameW(account_name, &size))
2216 DWORD ac_len = lstrlenW(ac);
2217 DWORD dm_len = lstrlenW(dm);
2220 if (*accountSize > ac_len) {
2222 lstrcpyW(account, ac);
2224 if (*domainSize > dm_len) {
2226 lstrcpyW(domain, dm);
2228 if (((*accountSize != 0) && (*accountSize < ac_len)) ||
2229 ((*domainSize != 0) && (*domainSize < dm_len))) {
2230 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2234 *domainSize = dm_len;
2236 *domainSize = dm_len + 1;
2238 *accountSize = ac_len;
2240 *accountSize = ac_len + 1;
2242 HeapFree(GetProcessHeap(), 0, account_name);
2243 HeapFree(GetProcessHeap(), 0, computer_name);
2247 HeapFree(GetProcessHeap(), 0, account_name);
2248 HeapFree(GetProcessHeap(), 0, computer_name);
2249 SetLastError(ERROR_NONE_MAPPED);
2253 /******************************************************************************
2254 * SetFileSecurityA [ADVAPI32.@]
2256 * See SetFileSecurityW.
2258 BOOL WINAPI SetFileSecurityA( LPCSTR lpFileName,
2259 SECURITY_INFORMATION RequestedInformation,
2260 PSECURITY_DESCRIPTOR pSecurityDescriptor)
2268 len = MultiByteToWideChar( CP_ACP, 0, lpFileName, -1, NULL, 0 );
2269 name = HeapAlloc( GetProcessHeap(), 0, len*sizeof(WCHAR) );
2270 MultiByteToWideChar( CP_ACP, 0, lpFileName, -1, name, len );
2273 r = SetFileSecurityW( name, RequestedInformation, pSecurityDescriptor );
2274 HeapFree( GetProcessHeap(), 0, name );
2279 /******************************************************************************
2280 * SetFileSecurityW [ADVAPI32.@]
2282 * Sets the security of a file or directory.
2286 * RequestedInformation []
2287 * pSecurityDescriptor []
2294 SetFileSecurityW( LPCWSTR lpFileName,
2295 SECURITY_INFORMATION RequestedInformation,
2296 PSECURITY_DESCRIPTOR pSecurityDescriptor )
2302 TRACE("(%s, 0x%x, %p)\n", debugstr_w(lpFileName), RequestedInformation,
2303 pSecurityDescriptor );
2305 if (RequestedInformation & OWNER_SECURITY_INFORMATION ||
2306 RequestedInformation & GROUP_SECURITY_INFORMATION)
2307 access |= WRITE_OWNER;
2308 if (RequestedInformation & SACL_SECURITY_INFORMATION)
2309 access |= ACCESS_SYSTEM_SECURITY;
2310 if (RequestedInformation & DACL_SECURITY_INFORMATION)
2311 access |= WRITE_DAC;
2313 file = CreateFileW( lpFileName, access, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
2314 NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL );
2315 if (file == INVALID_HANDLE_VALUE)
2318 status = NtSetSecurityObject( file, RequestedInformation, pSecurityDescriptor );
2319 CloseHandle( file );
2320 return set_ntstatus( status );
2323 /******************************************************************************
2324 * QueryWindows31FilesMigration [ADVAPI32.@]
2330 QueryWindows31FilesMigration( DWORD x1 )
2332 FIXME("(%d):stub\n",x1);
2336 /******************************************************************************
2337 * SynchronizeWindows31FilesAndWindowsNTRegistry [ADVAPI32.@]
2346 SynchronizeWindows31FilesAndWindowsNTRegistry( DWORD x1, DWORD x2, DWORD x3,
2349 FIXME("(0x%08x,0x%08x,0x%08x,0x%08x):stub\n",x1,x2,x3,x4);
2353 /******************************************************************************
2354 * NotifyBootConfigStatus [ADVAPI32.@]
2360 NotifyBootConfigStatus( BOOL x1 )
2362 FIXME("(0x%08d):stub\n",x1);
2366 /******************************************************************************
2367 * RevertToSelf [ADVAPI32.@]
2369 * Ends the impersonation of a user.
2379 RevertToSelf( void )
2381 HANDLE Token = NULL;
2382 return set_ntstatus( NtSetInformationThread( GetCurrentThread(),
2383 ThreadImpersonationToken, &Token, sizeof(Token) ) );
2386 /******************************************************************************
2387 * ImpersonateSelf [ADVAPI32.@]
2389 * Makes an impersonation token that represents the process user and assigns
2390 * to the current thread.
2393 * ImpersonationLevel [I] Level at which to impersonate.
2400 ImpersonateSelf(SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
2402 return set_ntstatus( RtlImpersonateSelf( ImpersonationLevel ) );
2405 /******************************************************************************
2406 * ImpersonateLoggedOnUser [ADVAPI32.@]
2408 BOOL WINAPI ImpersonateLoggedOnUser(HANDLE hToken)
2412 HANDLE ImpersonationToken;
2414 static BOOL warn = TRUE;
2418 FIXME( "(%p)\n", hToken );
2421 if (!GetTokenInformation( hToken, TokenType, &Type,
2422 sizeof(TOKEN_TYPE), &size ))
2425 if (Type == TokenPrimary)
2427 OBJECT_ATTRIBUTES ObjectAttributes;
2429 InitializeObjectAttributes( &ObjectAttributes, NULL, 0, NULL, NULL );
2431 Status = NtDuplicateToken( hToken,
2432 TOKEN_IMPERSONATE | TOKEN_QUERY,
2434 SecurityImpersonation,
2436 &ImpersonationToken );
2437 if (Status != STATUS_SUCCESS)
2439 ERR( "NtDuplicateToken failed with error 0x%08x\n", Status );
2440 SetLastError( RtlNtStatusToDosError( Status ) );
2445 ImpersonationToken = hToken;
2447 Status = NtSetInformationThread( GetCurrentThread(),
2448 ThreadImpersonationToken,
2449 &ImpersonationToken,
2450 sizeof(ImpersonationToken) );
2452 if (Type == TokenPrimary)
2453 NtClose( ImpersonationToken );
2455 if (Status != STATUS_SUCCESS)
2457 ERR( "NtSetInformationThread failed with error 0x%08x\n", Status );
2458 SetLastError( RtlNtStatusToDosError( Status ) );
2465 /******************************************************************************
2466 * AccessCheck [ADVAPI32.@]
2470 PSECURITY_DESCRIPTOR SecurityDescriptor,
2472 DWORD DesiredAccess,
2473 PGENERIC_MAPPING GenericMapping,
2474 PPRIVILEGE_SET PrivilegeSet,
2475 LPDWORD PrivilegeSetLength,
2476 LPDWORD GrantedAccess,
2477 LPBOOL AccessStatus)
2479 NTSTATUS access_status;
2480 BOOL ret = set_ntstatus( NtAccessCheck(SecurityDescriptor, ClientToken, DesiredAccess,
2481 GenericMapping, PrivilegeSet, PrivilegeSetLength,
2482 GrantedAccess, &access_status) );
2483 if (ret) *AccessStatus = set_ntstatus( access_status );
2488 /******************************************************************************
2489 * AccessCheckByType [ADVAPI32.@]
2491 BOOL WINAPI AccessCheckByType(
2492 PSECURITY_DESCRIPTOR pSecurityDescriptor,
2493 PSID PrincipalSelfSid,
2495 DWORD DesiredAccess,
2496 POBJECT_TYPE_LIST ObjectTypeList,
2497 DWORD ObjectTypeListLength,
2498 PGENERIC_MAPPING GenericMapping,
2499 PPRIVILEGE_SET PrivilegeSet,
2500 LPDWORD PrivilegeSetLength,
2501 LPDWORD GrantedAccess,
2502 LPBOOL AccessStatus)
2506 *AccessStatus = TRUE;
2508 return !*AccessStatus;
2511 /******************************************************************************
2512 * MapGenericMask [ADVAPI32.@]
2514 * Maps generic access rights into specific access rights according to the
2518 * AccessMask [I/O] Access rights.
2519 * GenericMapping [I] The mapping between generic and specific rights.
2524 VOID WINAPI MapGenericMask( PDWORD AccessMask, PGENERIC_MAPPING GenericMapping )
2526 RtlMapGenericMask( AccessMask, GenericMapping );
2529 /*************************************************************************
2530 * SetKernelObjectSecurity [ADVAPI32.@]
2532 BOOL WINAPI SetKernelObjectSecurity (
2534 IN SECURITY_INFORMATION SecurityInformation,
2535 IN PSECURITY_DESCRIPTOR SecurityDescriptor )
2537 return set_ntstatus (NtSetSecurityObject (Handle, SecurityInformation, SecurityDescriptor));
2541 /******************************************************************************
2542 * AddAuditAccessAce [ADVAPI32.@]
2544 BOOL WINAPI AddAuditAccessAce(
2546 IN DWORD dwAceRevision,
2547 IN DWORD dwAccessMask,
2549 IN BOOL bAuditSuccess,
2550 IN BOOL bAuditFailure)
2552 return set_ntstatus( RtlAddAuditAccessAce(pAcl, dwAceRevision, dwAccessMask, pSid,
2553 bAuditSuccess, bAuditFailure) );
2556 /******************************************************************************
2557 * AddAuditAccessAce [ADVAPI32.@]
2559 BOOL WINAPI AddAuditAccessAceEx(
2561 IN DWORD dwAceRevision,
2562 IN DWORD dwAceFlags,
2563 IN DWORD dwAccessMask,
2565 IN BOOL bAuditSuccess,
2566 IN BOOL bAuditFailure)
2568 return set_ntstatus( RtlAddAuditAccessAceEx(pAcl, dwAceRevision, dwAceFlags, dwAccessMask, pSid,
2569 bAuditSuccess, bAuditFailure) );
2572 /******************************************************************************
2573 * LookupAccountNameA [ADVAPI32.@]
2581 LPSTR ReferencedDomainName,
2582 IN OUT LPDWORD cbReferencedDomainName,
2583 OUT PSID_NAME_USE name_use )
2586 UNICODE_STRING lpSystemW;
2587 UNICODE_STRING lpAccountW;
2588 LPWSTR lpReferencedDomainNameW = NULL;
2590 RtlCreateUnicodeStringFromAsciiz(&lpSystemW, system);
2591 RtlCreateUnicodeStringFromAsciiz(&lpAccountW, account);
2593 if (ReferencedDomainName)
2594 lpReferencedDomainNameW = HeapAlloc(GetProcessHeap(), 0, *cbReferencedDomainName * sizeof(WCHAR));
2596 ret = LookupAccountNameW(lpSystemW.Buffer, lpAccountW.Buffer, sid, cbSid, lpReferencedDomainNameW,
2597 cbReferencedDomainName, name_use);
2599 if (ret && lpReferencedDomainNameW)
2601 WideCharToMultiByte(CP_ACP, 0, lpReferencedDomainNameW, -1,
2602 ReferencedDomainName, *cbReferencedDomainName+1, NULL, NULL);
2605 RtlFreeUnicodeString(&lpSystemW);
2606 RtlFreeUnicodeString(&lpAccountW);
2607 HeapFree(GetProcessHeap(), 0, lpReferencedDomainNameW);
2612 /******************************************************************************
2613 * lookup_user_account_name
2615 static BOOL lookup_user_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName,
2616 LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2618 char buffer[sizeof(TOKEN_USER) + sizeof(SID) + sizeof(DWORD)*SID_MAX_SUB_AUTHORITIES];
2619 DWORD len = sizeof(buffer);
2623 static const WCHAR dm[] = {'D','O','M','A','I','N',0};
2627 if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
2629 if (GetLastError() != ERROR_NO_TOKEN) return FALSE;
2630 if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) return FALSE;
2633 ret = GetTokenInformation(token, TokenUser, buffer, len, &len);
2634 CloseHandle( token );
2636 if (!ret) return FALSE;
2638 pSid = ((TOKEN_USER *)buffer)->User.Sid;
2640 if (Sid != NULL && (*cbSid >= GetLengthSid(pSid)))
2641 CopySid(*cbSid, Sid, pSid);
2642 if (*cbSid < GetLengthSid(pSid))
2644 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2647 *cbSid = GetLengthSid(pSid);
2650 nameLen = strlenW(domainName);
2652 if (*cchReferencedDomainName <= nameLen || !ret)
2654 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2658 else if (ReferencedDomainName)
2659 strcpyW(ReferencedDomainName, domainName);
2661 *cchReferencedDomainName = nameLen;
2664 *peUse = SidTypeUser;
2669 /******************************************************************************
2670 * lookup_computer_account_name
2672 static BOOL lookup_computer_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName,
2673 LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2677 static const WCHAR dm[] = {'D','O','M','A','I','N',0};
2681 if ((ret = ADVAPI_GetComputerSid(&local)))
2683 if (Sid != NULL && (*cbSid >= GetLengthSid(&local)))
2684 CopySid(*cbSid, Sid, &local);
2685 if (*cbSid < GetLengthSid(&local))
2687 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2690 *cbSid = GetLengthSid(&local);
2694 nameLen = strlenW(domainName);
2696 if (*cchReferencedDomainName <= nameLen || !ret)
2698 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2702 else if (ReferencedDomainName)
2703 strcpyW(ReferencedDomainName, domainName);
2705 *cchReferencedDomainName = nameLen;
2708 *peUse = SidTypeDomain;
2713 static void split_domain_account( const LSA_UNICODE_STRING *str, LSA_UNICODE_STRING *account,
2714 LSA_UNICODE_STRING *domain )
2716 WCHAR *p = str->Buffer + str->Length / sizeof(WCHAR) - 1;
2718 while (p > str->Buffer && *p != '\\') p--;
2722 domain->Buffer = str->Buffer;
2723 domain->Length = (p - str->Buffer) * sizeof(WCHAR);
2725 account->Buffer = p + 1;
2726 account->Length = str->Length - ((p - str->Buffer + 1) * sizeof(WCHAR));
2730 domain->Buffer = NULL;
2733 account->Buffer = str->Buffer;
2734 account->Length = str->Length;
2738 static BOOL match_domain( ULONG idx, LSA_UNICODE_STRING *domain )
2740 ULONG len = strlenW( ACCOUNT_SIDS[idx].domain );
2742 if (len == domain->Length / sizeof(WCHAR) && !strncmpiW( domain->Buffer, ACCOUNT_SIDS[idx].domain, len ))
2748 static BOOL match_account( ULONG idx, LSA_UNICODE_STRING *account )
2750 ULONG len = strlenW( ACCOUNT_SIDS[idx].account );
2752 if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].account, len ))
2755 if (ACCOUNT_SIDS[idx].alias)
2757 len = strlenW( ACCOUNT_SIDS[idx].alias );
2758 if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].alias, len ))
2765 * Helper function for LookupAccountNameW
2767 BOOL lookup_local_wellknown_name( LSA_UNICODE_STRING *account_and_domain,
2768 PSID Sid, LPDWORD cbSid,
2769 LPWSTR ReferencedDomainName,
2770 LPDWORD cchReferencedDomainName,
2771 PSID_NAME_USE peUse, BOOL *handled )
2774 LSA_UNICODE_STRING account, domain;
2779 split_domain_account( account_and_domain, &account, &domain );
2781 for (i = 0; i < sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0]); i++)
2783 /* check domain first */
2784 if (domain.Buffer && !match_domain( i, &domain )) continue;
2786 if (match_account( i, &account ))
2788 DWORD len, sidLen = SECURITY_MAX_SID_SIZE;
2790 if (!(pSid = HeapAlloc( GetProcessHeap(), 0, sidLen ))) return FALSE;
2792 if ((ret = CreateWellKnownSid( ACCOUNT_SIDS[i].type, NULL, pSid, &sidLen )))
2794 if (*cbSid < sidLen)
2796 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2801 CopySid(*cbSid, Sid, pSid);
2806 len = strlenW( ACCOUNT_SIDS[i].domain );
2807 if (*cchReferencedDomainName <= len || !ret)
2809 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2813 else if (ReferencedDomainName)
2815 strcpyW( ReferencedDomainName, ACCOUNT_SIDS[i].domain );
2818 *cchReferencedDomainName = len;
2820 *peUse = ACCOUNT_SIDS[i].name_use;
2822 HeapFree(GetProcessHeap(), 0, pSid);
2830 BOOL lookup_local_user_name( LSA_UNICODE_STRING *account_and_domain,
2831 PSID Sid, LPDWORD cbSid,
2832 LPWSTR ReferencedDomainName,
2833 LPDWORD cchReferencedDomainName,
2834 PSID_NAME_USE peUse, BOOL *handled )
2837 LPWSTR userName = NULL;
2838 LSA_UNICODE_STRING account, domain;
2842 split_domain_account( account_and_domain, &account, &domain );
2844 /* Let the current Unix user id masquerade as first Windows user account */
2846 nameLen = UNLEN + 1;
2847 if (!(userName = HeapAlloc( GetProcessHeap(), 0, nameLen * sizeof(WCHAR) ))) return FALSE;
2851 /* check to make sure this account is on this computer */
2852 if (GetComputerNameW( userName, &nameLen ) &&
2853 (domain.Length / sizeof(WCHAR) != nameLen || strncmpW( domain.Buffer, userName, nameLen )))
2855 SetLastError(ERROR_NONE_MAPPED);
2858 nameLen = UNLEN + 1;
2861 if (GetUserNameW( userName, &nameLen ) &&
2862 account.Length / sizeof(WCHAR) == nameLen - 1 && !strncmpW( account.Buffer, userName, nameLen - 1 ))
2864 ret = lookup_user_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse );
2869 nameLen = UNLEN + 1;
2870 if (GetComputerNameW( userName, &nameLen ) &&
2871 account.Length / sizeof(WCHAR) == nameLen && !strncmpW( account.Buffer, userName , nameLen ))
2873 ret = lookup_computer_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse );
2878 HeapFree(GetProcessHeap(), 0, userName);
2882 /******************************************************************************
2883 * LookupAccountNameW [ADVAPI32.@]
2885 BOOL WINAPI LookupAccountNameW( LPCWSTR lpSystemName, LPCWSTR lpAccountName, PSID Sid,
2886 LPDWORD cbSid, LPWSTR ReferencedDomainName,
2887 LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2890 LSA_UNICODE_STRING account;
2892 FIXME("%s %s %p %p %p %p %p - stub\n", debugstr_w(lpSystemName), debugstr_w(lpAccountName),
2893 Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse);
2895 if (!ADVAPI_IsLocalComputer( lpSystemName ))
2897 SetLastError( RPC_S_SERVER_UNAVAILABLE );
2901 if (!lpAccountName || !strcmpW( lpAccountName, Blank ))
2903 lpAccountName = BUILTIN;
2906 RtlInitUnicodeString( &account, lpAccountName );
2908 /* Check well known SIDs first */
2909 ret = lookup_local_wellknown_name( &account, Sid, cbSid, ReferencedDomainName,
2910 cchReferencedDomainName, peUse, &handled );
2914 /* Check user names */
2915 ret = lookup_local_user_name( &account, Sid, cbSid, ReferencedDomainName,
2916 cchReferencedDomainName, peUse, &handled);
2920 SetLastError( ERROR_NONE_MAPPED );
2924 /******************************************************************************
2925 * PrivilegeCheck [ADVAPI32.@]
2927 BOOL WINAPI PrivilegeCheck( HANDLE ClientToken, PPRIVILEGE_SET RequiredPrivileges, LPBOOL pfResult)
2932 TRACE("%p %p %p\n", ClientToken, RequiredPrivileges, pfResult);
2934 ret = set_ntstatus (NtPrivilegeCheck (ClientToken, RequiredPrivileges, &Result));
2940 /******************************************************************************
2941 * AccessCheckAndAuditAlarmA [ADVAPI32.@]
2943 BOOL WINAPI AccessCheckAndAuditAlarmA(LPCSTR Subsystem, LPVOID HandleId, LPSTR ObjectTypeName,
2944 LPSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess,
2945 PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess,
2946 LPBOOL AccessStatus, LPBOOL pfGenerateOnClose)
2948 FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_a(Subsystem),
2949 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName),
2950 SecurityDescriptor, DesiredAccess, GenericMapping,
2951 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose);
2955 /******************************************************************************
2956 * AccessCheckAndAuditAlarmW [ADVAPI32.@]
2958 BOOL WINAPI AccessCheckAndAuditAlarmW(LPCWSTR Subsystem, LPVOID HandleId, LPWSTR ObjectTypeName,
2959 LPWSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess,
2960 PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess,
2961 LPBOOL AccessStatus, LPBOOL pfGenerateOnClose)
2963 FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_w(Subsystem),
2964 HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName),
2965 SecurityDescriptor, DesiredAccess, GenericMapping,
2966 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose);
2970 BOOL WINAPI ObjectCloseAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
2972 FIXME("stub (%s,%p,%x)\n", debugstr_a(SubsystemName), HandleId, GenerateOnClose);
2977 BOOL WINAPI ObjectCloseAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
2979 FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose);
2984 BOOL WINAPI ObjectDeleteAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
2986 FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose);
2991 BOOL WINAPI ObjectOpenAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, LPSTR ObjectTypeName,
2992 LPSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess,
2993 DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted,
2994 LPBOOL GenerateOnClose)
2996 FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_a(SubsystemName),
2997 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName), pSecurityDescriptor,
2998 ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted,
3004 BOOL WINAPI ObjectOpenAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, LPWSTR ObjectTypeName,
3005 LPWSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess,
3006 DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted,
3007 LPBOOL GenerateOnClose)
3009 FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_w(SubsystemName),
3010 HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName), pSecurityDescriptor,
3011 ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted,
3017 BOOL WINAPI ObjectPrivilegeAuditAlarmA( LPCSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken,
3018 DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3020 FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_a(SubsystemName), HandleId, ClientToken,
3021 DesiredAccess, Privileges, AccessGranted);
3026 BOOL WINAPI ObjectPrivilegeAuditAlarmW( LPCWSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken,
3027 DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3029 FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_w(SubsystemName), HandleId, ClientToken,
3030 DesiredAccess, Privileges, AccessGranted);
3035 BOOL WINAPI PrivilegedServiceAuditAlarmA( LPCSTR SubsystemName, LPCSTR ServiceName, HANDLE ClientToken,
3036 PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3038 FIXME("stub (%s,%s,%p,%p,%x)\n", debugstr_a(SubsystemName), debugstr_a(ServiceName),
3039 ClientToken, Privileges, AccessGranted);
3044 BOOL WINAPI PrivilegedServiceAuditAlarmW( LPCWSTR SubsystemName, LPCWSTR ServiceName, HANDLE ClientToken,
3045 PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3047 FIXME("stub %s,%s,%p,%p,%x)\n", debugstr_w(SubsystemName), debugstr_w(ServiceName),
3048 ClientToken, Privileges, AccessGranted);
3053 /******************************************************************************
3054 * GetSecurityInfo [ADVAPI32.@]
3056 * Retrieves a copy of the security descriptor associated with an object.
3059 * hObject [I] A handle for the object.
3060 * ObjectType [I] The type of object.
3061 * SecurityInfo [I] A bitmask indicating what info to retrieve.
3062 * ppsidOwner [O] If non-null, receives a pointer to the owner SID.
3063 * ppsidGroup [O] If non-null, receives a pointer to the group SID.
3064 * ppDacl [O] If non-null, receives a pointer to the DACL.
3065 * ppSacl [O] If non-null, receives a pointer to the SACL.
3066 * ppSecurityDescriptor [O] Receives a pointer to the security descriptor,
3067 * which must be freed with LocalFree.
3070 * ERROR_SUCCESS if all's well, and a WIN32 error code otherwise.
3072 DWORD WINAPI GetSecurityInfo(
3073 HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3074 SECURITY_INFORMATION SecurityInfo, PSID *ppsidOwner,
3075 PSID *ppsidGroup, PACL *ppDacl, PACL *ppSacl,
3076 PSECURITY_DESCRIPTOR *ppSecurityDescriptor
3079 PSECURITY_DESCRIPTOR sd;
3082 BOOL present, defaulted;
3084 status = NtQuerySecurityObject(hObject, SecurityInfo, NULL, 0, &n1);
3085 if (status != STATUS_BUFFER_TOO_SMALL && status != STATUS_SUCCESS)
3086 return RtlNtStatusToDosError(status);
3088 sd = LocalAlloc(0, n1);
3090 return ERROR_NOT_ENOUGH_MEMORY;
3092 status = NtQuerySecurityObject(hObject, SecurityInfo, sd, n1, &n2);
3093 if (status != STATUS_SUCCESS)
3096 return RtlNtStatusToDosError(status);
3102 GetSecurityDescriptorOwner(sd, ppsidOwner, &defaulted);
3107 GetSecurityDescriptorGroup(sd, ppsidGroup, &defaulted);
3112 GetSecurityDescriptorDacl(sd, &present, ppDacl, &defaulted);
3117 GetSecurityDescriptorSacl(sd, &present, ppSacl, &defaulted);
3119 if (ppSecurityDescriptor)
3120 *ppSecurityDescriptor = sd;
3122 return ERROR_SUCCESS;
3125 /******************************************************************************
3126 * GetSecurityInfoExA [ADVAPI32.@]
3128 DWORD WINAPI GetSecurityInfoExA(
3129 HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3130 SECURITY_INFORMATION SecurityInfo, LPCSTR lpProvider,
3131 LPCSTR lpProperty, PACTRL_ACCESSA *ppAccessList,
3132 PACTRL_AUDITA *ppAuditList, LPSTR *lppOwner, LPSTR *lppGroup
3136 return ERROR_BAD_PROVIDER;
3139 /******************************************************************************
3140 * GetSecurityInfoExW [ADVAPI32.@]
3142 DWORD WINAPI GetSecurityInfoExW(
3143 HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3144 SECURITY_INFORMATION SecurityInfo, LPCWSTR lpProvider,
3145 LPCWSTR lpProperty, PACTRL_ACCESSW *ppAccessList,
3146 PACTRL_AUDITW *ppAuditList, LPWSTR *lppOwner, LPWSTR *lppGroup
3150 return ERROR_BAD_PROVIDER;
3153 /******************************************************************************
3154 * BuildExplicitAccessWithNameA [ADVAPI32.@]
3156 VOID WINAPI BuildExplicitAccessWithNameA( PEXPLICIT_ACCESSA pExplicitAccess,
3157 LPSTR pTrusteeName, DWORD AccessPermissions,
3158 ACCESS_MODE AccessMode, DWORD Inheritance )
3160 TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_a(pTrusteeName),
3161 AccessPermissions, AccessMode, Inheritance);
3163 pExplicitAccess->grfAccessPermissions = AccessPermissions;
3164 pExplicitAccess->grfAccessMode = AccessMode;
3165 pExplicitAccess->grfInheritance = Inheritance;
3167 pExplicitAccess->Trustee.pMultipleTrustee = NULL;
3168 pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3169 pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3170 pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3171 pExplicitAccess->Trustee.ptstrName = pTrusteeName;
3174 /******************************************************************************
3175 * BuildExplicitAccessWithNameW [ADVAPI32.@]
3177 VOID WINAPI BuildExplicitAccessWithNameW( PEXPLICIT_ACCESSW pExplicitAccess,
3178 LPWSTR pTrusteeName, DWORD AccessPermissions,
3179 ACCESS_MODE AccessMode, DWORD Inheritance )
3181 TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_w(pTrusteeName),
3182 AccessPermissions, AccessMode, Inheritance);
3184 pExplicitAccess->grfAccessPermissions = AccessPermissions;
3185 pExplicitAccess->grfAccessMode = AccessMode;
3186 pExplicitAccess->grfInheritance = Inheritance;
3188 pExplicitAccess->Trustee.pMultipleTrustee = NULL;
3189 pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3190 pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3191 pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3192 pExplicitAccess->Trustee.ptstrName = pTrusteeName;
3195 /******************************************************************************
3196 * BuildTrusteeWithObjectsAndNameA [ADVAPI32.@]
3198 VOID WINAPI BuildTrusteeWithObjectsAndNameA( PTRUSTEEA pTrustee, POBJECTS_AND_NAME_A pObjName,
3199 SE_OBJECT_TYPE ObjectType, LPSTR ObjectTypeName,
3200 LPSTR InheritedObjectTypeName, LPSTR Name )
3202 DWORD ObjectsPresent = 0;
3204 TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
3205 ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_a(Name));
3207 /* Fill the OBJECTS_AND_NAME structure */
3208 pObjName->ObjectType = ObjectType;
3209 if (ObjectTypeName != NULL)
3211 ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3214 pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
3215 if (InheritedObjectTypeName != NULL)
3217 ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3220 pObjName->ObjectsPresent = ObjectsPresent;
3221 pObjName->ptstrName = Name;
3223 /* Fill the TRUSTEE structure */
3224 pTrustee->pMultipleTrustee = NULL;
3225 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3226 pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
3227 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3228 pTrustee->ptstrName = (LPSTR)pObjName;
3231 /******************************************************************************
3232 * BuildTrusteeWithObjectsAndNameW [ADVAPI32.@]
3234 VOID WINAPI BuildTrusteeWithObjectsAndNameW( PTRUSTEEW pTrustee, POBJECTS_AND_NAME_W pObjName,
3235 SE_OBJECT_TYPE ObjectType, LPWSTR ObjectTypeName,
3236 LPWSTR InheritedObjectTypeName, LPWSTR Name )
3238 DWORD ObjectsPresent = 0;
3240 TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
3241 ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_w(Name));
3243 /* Fill the OBJECTS_AND_NAME structure */
3244 pObjName->ObjectType = ObjectType;
3245 if (ObjectTypeName != NULL)
3247 ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3250 pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
3251 if (InheritedObjectTypeName != NULL)
3253 ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3256 pObjName->ObjectsPresent = ObjectsPresent;
3257 pObjName->ptstrName = Name;
3259 /* Fill the TRUSTEE structure */
3260 pTrustee->pMultipleTrustee = NULL;
3261 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3262 pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
3263 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3264 pTrustee->ptstrName = (LPWSTR)pObjName;
3267 /******************************************************************************
3268 * BuildTrusteeWithObjectsAndSidA [ADVAPI32.@]
3270 VOID WINAPI BuildTrusteeWithObjectsAndSidA( PTRUSTEEA pTrustee, POBJECTS_AND_SID pObjSid,
3271 GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid )
3273 DWORD ObjectsPresent = 0;
3275 TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
3277 /* Fill the OBJECTS_AND_SID structure */
3278 if (pObjectGuid != NULL)
3280 pObjSid->ObjectTypeGuid = *pObjectGuid;
3281 ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3285 ZeroMemory(&pObjSid->ObjectTypeGuid,
3289 if (pInheritedObjectGuid != NULL)
3291 pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
3292 ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3296 ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
3300 pObjSid->ObjectsPresent = ObjectsPresent;
3301 pObjSid->pSid = pSid;
3303 /* Fill the TRUSTEE structure */
3304 pTrustee->pMultipleTrustee = NULL;
3305 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3306 pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
3307 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3308 pTrustee->ptstrName = (LPSTR) pObjSid;
3311 /******************************************************************************
3312 * BuildTrusteeWithObjectsAndSidW [ADVAPI32.@]
3314 VOID WINAPI BuildTrusteeWithObjectsAndSidW( PTRUSTEEW pTrustee, POBJECTS_AND_SID pObjSid,
3315 GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid )
3317 DWORD ObjectsPresent = 0;
3319 TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
3321 /* Fill the OBJECTS_AND_SID structure */
3322 if (pObjectGuid != NULL)
3324 pObjSid->ObjectTypeGuid = *pObjectGuid;
3325 ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3329 ZeroMemory(&pObjSid->ObjectTypeGuid,
3333 if (pInheritedObjectGuid != NULL)
3335 pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
3336 ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3340 ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
3344 pObjSid->ObjectsPresent = ObjectsPresent;
3345 pObjSid->pSid = pSid;
3347 /* Fill the TRUSTEE structure */
3348 pTrustee->pMultipleTrustee = NULL;
3349 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3350 pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
3351 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3352 pTrustee->ptstrName = (LPWSTR) pObjSid;
3355 /******************************************************************************
3356 * BuildTrusteeWithSidA [ADVAPI32.@]
3358 VOID WINAPI BuildTrusteeWithSidA(PTRUSTEEA pTrustee, PSID pSid)
3360 TRACE("%p %p\n", pTrustee, pSid);
3362 pTrustee->pMultipleTrustee = NULL;
3363 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3364 pTrustee->TrusteeForm = TRUSTEE_IS_SID;
3365 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3366 pTrustee->ptstrName = pSid;
3369 /******************************************************************************
3370 * BuildTrusteeWithSidW [ADVAPI32.@]
3372 VOID WINAPI BuildTrusteeWithSidW(PTRUSTEEW pTrustee, PSID pSid)
3374 TRACE("%p %p\n", pTrustee, pSid);
3376 pTrustee->pMultipleTrustee = NULL;
3377 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3378 pTrustee->TrusteeForm = TRUSTEE_IS_SID;
3379 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3380 pTrustee->ptstrName = pSid;
3383 /******************************************************************************
3384 * BuildTrusteeWithNameA [ADVAPI32.@]
3386 VOID WINAPI BuildTrusteeWithNameA(PTRUSTEEA pTrustee, LPSTR name)
3388 TRACE("%p %s\n", pTrustee, debugstr_a(name) );
3390 pTrustee->pMultipleTrustee = NULL;
3391 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3392 pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
3393 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3394 pTrustee->ptstrName = name;
3397 /******************************************************************************
3398 * BuildTrusteeWithNameW [ADVAPI32.@]
3400 VOID WINAPI BuildTrusteeWithNameW(PTRUSTEEW pTrustee, LPWSTR name)
3402 TRACE("%p %s\n", pTrustee, debugstr_w(name) );
3404 pTrustee->pMultipleTrustee = NULL;
3405 pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3406 pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
3407 pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3408 pTrustee->ptstrName = name;
3411 /******************************************************************************
3412 * GetTrusteeFormA [ADVAPI32.@]
3414 TRUSTEE_FORM WINAPI GetTrusteeFormA(PTRUSTEEA pTrustee)
3416 TRACE("(%p)\n", pTrustee);
3419 return TRUSTEE_BAD_FORM;
3421 return pTrustee->TrusteeForm;
3424 /******************************************************************************
3425 * GetTrusteeFormW [ADVAPI32.@]
3427 TRUSTEE_FORM WINAPI GetTrusteeFormW(PTRUSTEEW pTrustee)
3429 TRACE("(%p)\n", pTrustee);
3432 return TRUSTEE_BAD_FORM;
3434 return pTrustee->TrusteeForm;
3437 /******************************************************************************
3438 * GetTrusteeNameA [ADVAPI32.@]
3440 LPSTR WINAPI GetTrusteeNameA(PTRUSTEEA pTrustee)
3442 TRACE("(%p)\n", pTrustee);
3447 return pTrustee->ptstrName;
3450 /******************************************************************************
3451 * GetTrusteeNameW [ADVAPI32.@]
3453 LPWSTR WINAPI GetTrusteeNameW(PTRUSTEEW pTrustee)
3455 TRACE("(%p)\n", pTrustee);
3460 return pTrustee->ptstrName;
3463 /******************************************************************************
3464 * GetTrusteeTypeA [ADVAPI32.@]
3466 TRUSTEE_TYPE WINAPI GetTrusteeTypeA(PTRUSTEEA pTrustee)
3468 TRACE("(%p)\n", pTrustee);
3471 return TRUSTEE_IS_UNKNOWN;
3473 return pTrustee->TrusteeType;
3476 /******************************************************************************
3477 * GetTrusteeTypeW [ADVAPI32.@]
3479 TRUSTEE_TYPE WINAPI GetTrusteeTypeW(PTRUSTEEW pTrustee)
3481 TRACE("(%p)\n", pTrustee);
3484 return TRUSTEE_IS_UNKNOWN;
3486 return pTrustee->TrusteeType;
3489 BOOL WINAPI SetAclInformation( PACL pAcl, LPVOID pAclInformation,
3490 DWORD nAclInformationLength,
3491 ACL_INFORMATION_CLASS dwAclInformationClass )
3493 FIXME("%p %p 0x%08x 0x%08x - stub\n", pAcl, pAclInformation,
3494 nAclInformationLength, dwAclInformationClass);
3499 /******************************************************************************
3500 * SetEntriesInAclA [ADVAPI32.@]
3502 DWORD WINAPI SetEntriesInAclA( ULONG count, PEXPLICIT_ACCESSA pEntries,
3503 PACL OldAcl, PACL* NewAcl )
3505 FIXME("%d %p %p %p\n",count,pEntries,OldAcl,NewAcl);
3508 return ERROR_SUCCESS;
3511 /******************************************************************************
3512 * SetEntriesInAclW [ADVAPI32.@]
3514 DWORD WINAPI SetEntriesInAclW( ULONG count, PEXPLICIT_ACCESSW pEntries,
3515 PACL OldAcl, PACL* NewAcl )
3519 DWORD ret = ERROR_SUCCESS;
3520 DWORD acl_size = sizeof(ACL);
3523 TRACE("%d %p %p %p\n", count, pEntries, OldAcl, NewAcl);
3527 if (!count && !OldAcl)
3528 return ERROR_SUCCESS;
3530 /* allocate array of maximum sized sids allowed */
3531 ppsid = HeapAlloc(GetProcessHeap(), 0, count * (sizeof(SID *) + FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES])));
3533 return ERROR_OUTOFMEMORY;
3535 for (i = 0; i < count; i++)
3537 ppsid[i] = (char *)&ppsid[count] + i * FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]);
3539 TRACE("[%d]:\n\tgrfAccessPermissions = 0x%x\n\tgrfAccessMode = %d\n\tgrfInheritance = 0x%x\n\t"
3540 "Trustee.pMultipleTrustee = %p\n\tMultipleTrusteeOperation = %d\n\tTrusteeForm = %d\n\t"
3541 "Trustee.TrusteeType = %d\n\tptstrName = %p\n", i,
3542 pEntries[i].grfAccessPermissions, pEntries[i].grfAccessMode, pEntries[i].grfInheritance,
3543 pEntries[i].Trustee.pMultipleTrustee, pEntries[i].Trustee.MultipleTrusteeOperation,
3544 pEntries[i].Trustee.TrusteeForm, pEntries[i].Trustee.TrusteeType,
3545 pEntries[i].Trustee.ptstrName);
3547 if (pEntries[i].Trustee.MultipleTrusteeOperation == TRUSTEE_IS_IMPERSONATE)
3549 WARN("bad multiple trustee operation %d for trustee %d\n", pEntries[i].Trustee.MultipleTrusteeOperation, i);
3550 ret = ERROR_INVALID_PARAMETER;
3554 switch (pEntries[i].Trustee.TrusteeForm)
3556 case TRUSTEE_IS_SID:
3557 if (!CopySid(FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]),
3558 ppsid[i], pEntries[i].Trustee.ptstrName))
3560 WARN("bad sid %p for trustee %d\n", pEntries[i].Trustee.ptstrName, i);
3561 ret = ERROR_INVALID_PARAMETER;
3565 case TRUSTEE_IS_NAME:
3567 DWORD sid_size = FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]);
3568 DWORD domain_size = MAX_COMPUTERNAME_LENGTH + 1;
3570 if (!strcmpW( pEntries[i].Trustee.ptstrName, CURRENT_USER ))
3572 if (!lookup_user_account_name( ppsid[i], &sid_size, NULL, &domain_size, &use ))
3574 ret = GetLastError();
3578 else if (!LookupAccountNameW(NULL, pEntries[i].Trustee.ptstrName, ppsid[i], &sid_size, NULL, &domain_size, &use))
3580 WARN("bad user name %s for trustee %d\n", debugstr_w(pEntries[i].Trustee.ptstrName), i);
3581 ret = ERROR_INVALID_PARAMETER;
3586 case TRUSTEE_IS_OBJECTS_AND_SID:
3587 FIXME("TRUSTEE_IS_OBJECTS_AND_SID unimplemented\n");
3589 case TRUSTEE_IS_OBJECTS_AND_NAME:
3590 FIXME("TRUSTEE_IS_OBJECTS_AND_NAME unimplemented\n");
3593 WARN("bad trustee form %d for trustee %d\n", pEntries[i].Trustee.TrusteeForm, i);
3594 ret = ERROR_INVALID_PARAMETER;
3598 /* Note: we overestimate the ACL size here as a tradeoff between
3599 * instructions (simplicity) and memory */
3600 switch (pEntries[i].grfAccessMode)
3604 acl_size += FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart) + GetLengthSid(ppsid[i]);
3607 acl_size += FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart) + GetLengthSid(ppsid[i]);
3609 case SET_AUDIT_SUCCESS:
3610 case SET_AUDIT_FAILURE:
3611 acl_size += FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart) + GetLengthSid(ppsid[i]);
3616 WARN("bad access mode %d for trustee %d\n", pEntries[i].grfAccessMode, i);
3617 ret = ERROR_INVALID_PARAMETER;
3624 ACL_SIZE_INFORMATION size_info;
3626 status = RtlQueryInformationAcl(OldAcl, &size_info, sizeof(size_info), AclSizeInformation);
3627 if (status != STATUS_SUCCESS)
3629 ret = RtlNtStatusToDosError(status);
3632 acl_size += size_info.AclBytesInUse - sizeof(ACL);
3635 *NewAcl = LocalAlloc(0, acl_size);
3638 ret = ERROR_OUTOFMEMORY;
3642 status = RtlCreateAcl( *NewAcl, acl_size, ACL_REVISION );
3643 if (status != STATUS_SUCCESS)
3645 ret = RtlNtStatusToDosError(status);
3649 for (i = 0; i < count; i++)
3651 switch (pEntries[i].grfAccessMode)
3654 status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION,
3655 pEntries[i].grfInheritance,
3656 pEntries[i].grfAccessPermissions,
3667 const ACE_HEADER *existing_ace_header;
3668 status = RtlGetAce(OldAcl, j, (LPVOID *)&existing_ace_header);
3669 if (status != STATUS_SUCCESS)
3671 if (pEntries[i].grfAccessMode == SET_ACCESS &&
3672 existing_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE &&
3673 EqualSid(ppsid[i], &((ACCESS_ALLOWED_ACE *)existing_ace_header)->SidStart))
3681 status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION,
3682 pEntries[i].grfInheritance,
3683 pEntries[i].grfAccessPermissions,
3688 status = RtlAddAccessDeniedAceEx(*NewAcl, ACL_REVISION,
3689 pEntries[i].grfInheritance,
3690 pEntries[i].grfAccessPermissions,
3693 case SET_AUDIT_SUCCESS:
3694 status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION,
3695 pEntries[i].grfInheritance,
3696 pEntries[i].grfAccessPermissions,
3697 ppsid[i], TRUE, FALSE);
3699 case SET_AUDIT_FAILURE:
3700 status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION,
3701 pEntries[i].grfInheritance,
3702 pEntries[i].grfAccessPermissions,
3703 ppsid[i], FALSE, TRUE);
3706 FIXME("unhandled access mode %d\n", pEntries[i].grfAccessMode);
3716 const ACE_HEADER *old_ace_header;
3717 status = RtlGetAce(OldAcl, i, (LPVOID *)&old_ace_header);
3718 if (status != STATUS_SUCCESS) break;
3719 for (j = 0; j < count; j++)
3721 if (pEntries[j].grfAccessMode == SET_ACCESS &&
3722 old_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE &&
3723 EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart))
3725 status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION, pEntries[j].grfInheritance, pEntries[j].grfAccessPermissions, ppsid[j]);
3729 else if (pEntries[j].grfAccessMode == REVOKE_ACCESS)
3731 switch (old_ace_header->AceType)
3733 case ACCESS_ALLOWED_ACE_TYPE:
3734 if (EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart))
3737 case ACCESS_DENIED_ACE_TYPE:
3738 if (EqualSid(ppsid[j], &((ACCESS_DENIED_ACE *)old_ace_header)->SidStart))
3741 case SYSTEM_AUDIT_ACE_TYPE:
3742 if (EqualSid(ppsid[j], &((SYSTEM_AUDIT_ACE *)old_ace_header)->SidStart))
3745 case SYSTEM_ALARM_ACE_TYPE:
3746 if (EqualSid(ppsid[j], &((SYSTEM_ALARM_ACE *)old_ace_header)->SidStart))
3750 FIXME("unhandled ace type %d\n", old_ace_header->AceType);
3758 status = RtlAddAce(*NewAcl, ACL_REVISION, 1, (PACE_HEADER)old_ace_header, old_ace_header->AceSize);
3759 if (status != STATUS_SUCCESS)
3761 WARN("RtlAddAce failed with error 0x%08x\n", status);
3762 ret = RtlNtStatusToDosError(status);
3769 HeapFree(GetProcessHeap(), 0, ppsid);
3773 /******************************************************************************
3774 * SetNamedSecurityInfoA [ADVAPI32.@]
3776 DWORD WINAPI SetNamedSecurityInfoA(LPSTR pObjectName,
3777 SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
3778 PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
3784 TRACE("%s %d %d %p %p %p %p\n", debugstr_a(pObjectName), ObjectType,
3785 SecurityInfo, psidOwner, psidGroup, pDacl, pSacl);
3789 len = MultiByteToWideChar( CP_ACP, 0, pObjectName, -1, NULL, 0 );
3790 wstr = HeapAlloc( GetProcessHeap(), 0, len*sizeof(WCHAR));
3791 MultiByteToWideChar( CP_ACP, 0, pObjectName, -1, wstr, len );
3794 r = SetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, psidOwner,
3795 psidGroup, pDacl, pSacl );
3797 HeapFree( GetProcessHeap(), 0, wstr );
3802 BOOL WINAPI SetPrivateObjectSecurity( SECURITY_INFORMATION SecurityInformation,
3803 PSECURITY_DESCRIPTOR ModificationDescriptor,
3804 PSECURITY_DESCRIPTOR* ObjectsSecurityDescriptor,
3805 PGENERIC_MAPPING GenericMapping,
3808 FIXME("0x%08x %p %p %p %p - stub\n", SecurityInformation, ModificationDescriptor,
3809 ObjectsSecurityDescriptor, GenericMapping, Token);
3814 BOOL WINAPI AreAllAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess )
3816 return RtlAreAllAccessesGranted( GrantedAccess, DesiredAccess );
3819 /******************************************************************************
3820 * AreAnyAccessesGranted [ADVAPI32.@]
3822 * Determines whether or not any of a set of specified access permissions have
3823 * been granted or not.
3826 * GrantedAccess [I] The permissions that have been granted.
3827 * DesiredAccess [I] The permissions that you want to have.
3830 * Nonzero if any of the permissions have been granted, zero if none of the
3831 * permissions have been granted.
3834 BOOL WINAPI AreAnyAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess )
3836 return RtlAreAnyAccessesGranted( GrantedAccess, DesiredAccess );
3839 /******************************************************************************
3840 * SetNamedSecurityInfoW [ADVAPI32.@]
3842 DWORD WINAPI SetNamedSecurityInfoW(LPWSTR pObjectName,
3843 SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
3844 PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
3846 FIXME("%s %d %d %p %p %p %p\n", debugstr_w(pObjectName), ObjectType,
3847 SecurityInfo, psidOwner, psidGroup, pDacl, pSacl);
3848 return ERROR_SUCCESS;
3851 /******************************************************************************
3852 * GetExplicitEntriesFromAclA [ADVAPI32.@]
3854 DWORD WINAPI GetExplicitEntriesFromAclA( PACL pacl, PULONG pcCountOfExplicitEntries,
3855 PEXPLICIT_ACCESSA* pListOfExplicitEntries)
3857 FIXME("%p %p %p\n",pacl, pcCountOfExplicitEntries, pListOfExplicitEntries);
3858 return ERROR_CALL_NOT_IMPLEMENTED;
3861 /******************************************************************************
3862 * GetExplicitEntriesFromAclW [ADVAPI32.@]
3864 DWORD WINAPI GetExplicitEntriesFromAclW( PACL pacl, PULONG pcCountOfExplicitEntries,
3865 PEXPLICIT_ACCESSW* pListOfExplicitEntries)
3867 FIXME("%p %p %p\n",pacl, pcCountOfExplicitEntries, pListOfExplicitEntries);
3868 return ERROR_CALL_NOT_IMPLEMENTED;
3871 /******************************************************************************
3872 * GetAuditedPermissionsFromAclA [ADVAPI32.@]
3874 DWORD WINAPI GetAuditedPermissionsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pSuccessfulAuditedRights,
3875 PACCESS_MASK pFailedAuditRights)
3877 FIXME("%p %p %p %p\n",pacl, pTrustee, pSuccessfulAuditedRights, pFailedAuditRights);
3878 return ERROR_CALL_NOT_IMPLEMENTED;
3882 /******************************************************************************
3883 * GetAuditedPermissionsFromAclW [ADVAPI32.@]
3885 DWORD WINAPI GetAuditedPermissionsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pSuccessfulAuditedRights,
3886 PACCESS_MASK pFailedAuditRights)
3888 FIXME("%p %p %p %p\n",pacl, pTrustee, pSuccessfulAuditedRights, pFailedAuditRights);
3889 return ERROR_CALL_NOT_IMPLEMENTED;
3893 /******************************************************************************
3894 * ParseAclStringFlags
3896 static DWORD ParseAclStringFlags(LPCWSTR* StringAcl)
3899 LPCWSTR szAcl = *StringAcl;
3901 while (*szAcl != '(')
3905 flags |= SE_DACL_PROTECTED;
3907 else if (*szAcl == 'A')
3911 flags |= SE_DACL_AUTO_INHERIT_REQ;
3912 else if (*szAcl == 'I')
3913 flags |= SE_DACL_AUTO_INHERITED;
3922 /******************************************************************************
3923 * ParseAceStringType
3925 static const ACEFLAG AceType[] =
3927 { SDDL_ALARM, SYSTEM_ALARM_ACE_TYPE },
3928 { SDDL_AUDIT, SYSTEM_AUDIT_ACE_TYPE },
3929 { SDDL_ACCESS_ALLOWED, ACCESS_ALLOWED_ACE_TYPE },
3930 { SDDL_ACCESS_DENIED, ACCESS_DENIED_ACE_TYPE },
3932 { SDDL_OBJECT_ACCESS_ALLOWED, ACCESS_ALLOWED_OBJECT_ACE_TYPE },
3933 { SDDL_OBJECT_ACCESS_DENIED, ACCESS_DENIED_OBJECT_ACE_TYPE },
3934 { SDDL_OBJECT_ALARM, SYSTEM_ALARM_OBJECT_ACE_TYPE },
3935 { SDDL_OBJECT_AUDIT, SYSTEM_AUDIT_OBJECT_ACE_TYPE },
3940 static BYTE ParseAceStringType(LPCWSTR* StringAcl)
3943 LPCWSTR szAcl = *StringAcl;
3944 const ACEFLAG *lpaf = AceType;
3946 while (*szAcl == ' ')
3949 while (lpaf->wstr &&
3950 (len = strlenW(lpaf->wstr)) &&
3951 strncmpW(lpaf->wstr, szAcl, len))
3957 *StringAcl = szAcl + len;
3962 /******************************************************************************
3963 * ParseAceStringFlags
3965 static const ACEFLAG AceFlags[] =
3967 { SDDL_CONTAINER_INHERIT, CONTAINER_INHERIT_ACE },
3968 { SDDL_AUDIT_FAILURE, FAILED_ACCESS_ACE_FLAG },
3969 { SDDL_INHERITED, INHERITED_ACE },
3970 { SDDL_INHERIT_ONLY, INHERIT_ONLY_ACE },
3971 { SDDL_NO_PROPAGATE, NO_PROPAGATE_INHERIT_ACE },
3972 { SDDL_OBJECT_INHERIT, OBJECT_INHERIT_ACE },
3973 { SDDL_AUDIT_SUCCESS, SUCCESSFUL_ACCESS_ACE_FLAG },
3977 static BYTE ParseAceStringFlags(LPCWSTR* StringAcl)
3981 LPCWSTR szAcl = *StringAcl;
3983 while (*szAcl == ' ')
3986 while (*szAcl != ';')
3988 const ACEFLAG *lpaf = AceFlags;
3990 while (lpaf->wstr &&
3991 (len = strlenW(lpaf->wstr)) &&
3992 strncmpW(lpaf->wstr, szAcl, len))
3998 flags |= lpaf->value;
4007 /******************************************************************************
4008 * ParseAceStringRights
4010 static const ACEFLAG AceRights[] =
4012 { SDDL_GENERIC_ALL, GENERIC_ALL },
4013 { SDDL_GENERIC_READ, GENERIC_READ },
4014 { SDDL_GENERIC_WRITE, GENERIC_WRITE },
4015 { SDDL_GENERIC_EXECUTE, GENERIC_EXECUTE },
4017 { SDDL_READ_CONTROL, READ_CONTROL },
4018 { SDDL_STANDARD_DELETE, DELETE },
4019 { SDDL_WRITE_DAC, WRITE_DAC },
4020 { SDDL_WRITE_OWNER, WRITE_OWNER },
4022 { SDDL_READ_PROPERTY, ADS_RIGHT_DS_READ_PROP},
4023 { SDDL_WRITE_PROPERTY, ADS_RIGHT_DS_WRITE_PROP},
4024 { SDDL_CREATE_CHILD, ADS_RIGHT_DS_CREATE_CHILD},
4025 { SDDL_DELETE_CHILD, ADS_RIGHT_DS_DELETE_CHILD},
4026 { SDDL_LIST_CHILDREN, ADS_RIGHT_ACTRL_DS_LIST},
4027 { SDDL_SELF_WRITE, ADS_RIGHT_DS_SELF},
4028 { SDDL_LIST_OBJECT, ADS_RIGHT_DS_LIST_OBJECT},
4029 { SDDL_DELETE_TREE, ADS_RIGHT_DS_DELETE_TREE},
4030 { SDDL_CONTROL_ACCESS, ADS_RIGHT_DS_CONTROL_ACCESS},
4032 { SDDL_FILE_ALL, FILE_ALL_ACCESS },
4033 { SDDL_FILE_READ, FILE_GENERIC_READ },
4034 { SDDL_FILE_WRITE, FILE_GENERIC_WRITE },
4035 { SDDL_FILE_EXECUTE, FILE_GENERIC_EXECUTE },
4037 { SDDL_KEY_ALL, KEY_ALL_ACCESS },
4038 { SDDL_KEY_READ, KEY_READ },
4039 { SDDL_KEY_WRITE, KEY_WRITE },
4040 { SDDL_KEY_EXECUTE, KEY_EXECUTE },
4044 static DWORD ParseAceStringRights(LPCWSTR* StringAcl)
4048 LPCWSTR szAcl = *StringAcl;
4050 while (*szAcl == ' ')
4053 if ((*szAcl == '0') && (*(szAcl + 1) == 'x'))
4057 while (*p && *p != ';')
4060 if (p - szAcl <= 10 /* 8 hex digits + "0x" */ )
4062 rights = strtoulW(szAcl, NULL, 16);
4066 WARN("Invalid rights string format: %s\n", debugstr_wn(szAcl, p - szAcl));
4070 while (*szAcl != ';')
4072 const ACEFLAG *lpaf = AceRights;
4074 while (lpaf->wstr &&
4075 (len = strlenW(lpaf->wstr)) &&
4076 strncmpW(lpaf->wstr, szAcl, len))
4084 rights |= lpaf->value;
4094 /******************************************************************************
4095 * ParseStringAclToAcl
4097 * dacl_flags(string_ace1)(string_ace2)... (string_acen)
4099 static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags,
4100 PACL pAcl, LPDWORD cBytes)
4104 DWORD length = sizeof(ACL);
4107 PACCESS_ALLOWED_ACE pAce = NULL; /* pointer to current ACE */
4108 DWORD error = ERROR_INVALID_ACL;
4110 TRACE("%s\n", debugstr_w(StringAcl));
4115 if (pAcl) /* pAce is only useful if we're setting values */
4116 pAce = (PACCESS_ALLOWED_ACE) (pAcl + 1);
4118 /* Parse ACL flags */
4119 *lpdwFlags = ParseAclStringFlags(&StringAcl);
4122 while (*StringAcl == '(')
4126 /* Parse ACE type */
4127 val = ParseAceStringType(&StringAcl);
4129 pAce->Header.AceType = (BYTE) val;
4130 if (*StringAcl != ';')
4132 error = RPC_S_INVALID_STRING_UUID;
4137 /* Parse ACE flags */
4138 val = ParseAceStringFlags(&StringAcl);
4140 pAce->Header.AceFlags = (BYTE) val;
4141 if (*StringAcl != ';')
4145 /* Parse ACE rights */
4146 val = ParseAceStringRights(&StringAcl);
4149 if (*StringAcl != ';')
4153 /* Parse ACE object guid */
4154 while (*StringAcl == ' ')
4156 if (*StringAcl != ';')
4158 FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
4163 /* Parse ACE inherit object guid */
4164 while (*StringAcl == ' ')
4166 if (*StringAcl != ';')
4168 FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
4173 /* Parse ACE account sid */
4174 if (ParseStringSidToSid(StringAcl, pAce ? &pAce->SidStart : NULL, &sidlen))
4176 while (*StringAcl && *StringAcl != ')')
4180 if (*StringAcl != ')')
4184 acesize = sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) + sidlen;
4188 pAce->Header.AceSize = acesize;
4189 pAce = (PACCESS_ALLOWED_ACE)((LPBYTE)pAce + acesize);
4196 if (length > 0xffff)
4198 ERR("ACL too large\n");
4204 pAcl->AclRevision = ACL_REVISION;
4206 pAcl->AclSize = length;
4207 pAcl->AceCount = acecount++;
4213 SetLastError(error);
4214 WARN("Invalid ACE string format\n");
4219 /******************************************************************************
4220 * ParseStringSecurityDescriptorToSecurityDescriptor
4222 static BOOL ParseStringSecurityDescriptorToSecurityDescriptor(
4223 LPCWSTR StringSecurityDescriptor,
4224 SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
4229 WCHAR tok[MAX_PATH];
4231 LPBYTE lpNext = NULL;
4234 *cBytes = sizeof(SECURITY_DESCRIPTOR);
4236 if (SecurityDescriptor)
4237 lpNext = (LPBYTE)(SecurityDescriptor + 1);
4239 while (*StringSecurityDescriptor == ' ')
4240 StringSecurityDescriptor++;
4242 while (*StringSecurityDescriptor)
4244 toktype = *StringSecurityDescriptor;
4246 /* Expect char identifier followed by ':' */
4247 StringSecurityDescriptor++;
4248 if (*StringSecurityDescriptor != ':')
4250 SetLastError(ERROR_INVALID_PARAMETER);
4253 StringSecurityDescriptor++;
4256 lptoken = StringSecurityDescriptor;
4257 while (*lptoken && *lptoken != ':')
4263 len = lptoken - StringSecurityDescriptor;
4264 memcpy( tok, StringSecurityDescriptor, len * sizeof(WCHAR) );
4273 if (!ParseStringSidToSid(tok, lpNext, &bytes))
4276 if (SecurityDescriptor)
4278 SecurityDescriptor->Owner = lpNext - (LPBYTE)SecurityDescriptor;
4279 lpNext += bytes; /* Advance to next token */
4291 if (!ParseStringSidToSid(tok, lpNext, &bytes))
4294 if (SecurityDescriptor)
4296 SecurityDescriptor->Group = lpNext - (LPBYTE)SecurityDescriptor;
4297 lpNext += bytes; /* Advance to next token */
4310 if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
4313 if (SecurityDescriptor)
4315 SecurityDescriptor->Control |= SE_DACL_PRESENT | flags;
4316 SecurityDescriptor->Dacl = lpNext - (LPBYTE)SecurityDescriptor;
4317 lpNext += bytes; /* Advance to next token */
4330 if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
4333 if (SecurityDescriptor)
4335 SecurityDescriptor->Control |= SE_SACL_PRESENT | flags;
4336 SecurityDescriptor->Sacl = lpNext - (LPBYTE)SecurityDescriptor;
4337 lpNext += bytes; /* Advance to next token */
4346 FIXME("Unknown token\n");
4347 SetLastError(ERROR_INVALID_PARAMETER);
4351 StringSecurityDescriptor = lptoken;
4360 /******************************************************************************
4361 * ConvertStringSecurityDescriptorToSecurityDescriptorA [ADVAPI32.@]
4363 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorA(
4364 LPCSTR StringSecurityDescriptor,
4365 DWORD StringSDRevision,
4366 PSECURITY_DESCRIPTOR* SecurityDescriptor,
4367 PULONG SecurityDescriptorSize)
4371 LPWSTR StringSecurityDescriptorW;
4373 len = MultiByteToWideChar(CP_ACP, 0, StringSecurityDescriptor, -1, NULL, 0);
4374 StringSecurityDescriptorW = HeapAlloc(GetProcessHeap(), 0, len * sizeof(WCHAR));
4376 if (StringSecurityDescriptorW)
4378 MultiByteToWideChar(CP_ACP, 0, StringSecurityDescriptor, -1, StringSecurityDescriptorW, len);
4380 ret = ConvertStringSecurityDescriptorToSecurityDescriptorW(StringSecurityDescriptorW,
4381 StringSDRevision, SecurityDescriptor,
4382 SecurityDescriptorSize);
4383 HeapFree(GetProcessHeap(), 0, StringSecurityDescriptorW);
4389 /******************************************************************************
4390 * ConvertStringSecurityDescriptorToSecurityDescriptorW [ADVAPI32.@]
4392 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorW(
4393 LPCWSTR StringSecurityDescriptor,
4394 DWORD StringSDRevision,
4395 PSECURITY_DESCRIPTOR* SecurityDescriptor,
4396 PULONG SecurityDescriptorSize)
4399 SECURITY_DESCRIPTOR* psd;
4402 TRACE("%s\n", debugstr_w(StringSecurityDescriptor));
4404 if (GetVersion() & 0x80000000)
4406 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4409 else if (!StringSecurityDescriptor || !SecurityDescriptor)
4411 SetLastError(ERROR_INVALID_PARAMETER);
4414 else if (StringSDRevision != SID_REVISION)
4416 SetLastError(ERROR_UNKNOWN_REVISION);
4420 /* Compute security descriptor length */
4421 if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
4425 psd = *SecurityDescriptor = LocalAlloc(GMEM_ZEROINIT, cBytes);
4426 if (!psd) goto lend;
4428 psd->Revision = SID_REVISION;
4429 psd->Control |= SE_SELF_RELATIVE;
4431 if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
4432 (SECURITY_DESCRIPTOR_RELATIVE *)psd, &cBytes))
4438 if (SecurityDescriptorSize)
4439 *SecurityDescriptorSize = cBytes;
4444 TRACE(" ret=%d\n", bret);
4448 static void DumpString(LPCWSTR string, int cch, WCHAR **pwptr, ULONG *plen)
4451 cch = strlenW(string);
4458 memcpy(*pwptr, string, sizeof(WCHAR)*cch);
4463 static BOOL DumpSidNumeric(PSID psid, WCHAR **pwptr, ULONG *plen)
4466 WCHAR fmt[] = { 'S','-','%','u','-','%','d',0 };
4467 WCHAR subauthfmt[] = { '-','%','u',0 };
4471 if( !IsValidSid( psid ) || pisid->Revision != SDDL_REVISION)
4473 SetLastError(ERROR_INVALID_SID);
4477 if (pisid->IdentifierAuthority.Value[0] ||
4478 pisid->IdentifierAuthority.Value[1])
4480 FIXME("not matching MS' bugs\n");
4481 SetLastError(ERROR_INVALID_SID);
4485 sprintfW( buf, fmt, pisid->Revision,
4487 MAKEWORD( pisid->IdentifierAuthority.Value[5],
4488 pisid->IdentifierAuthority.Value[4] ),
4489 MAKEWORD( pisid->IdentifierAuthority.Value[3],
4490 pisid->IdentifierAuthority.Value[2] )
4492 DumpString(buf, -1, pwptr, plen);
4494 for( i=0; i<pisid->SubAuthorityCount; i++ )
4496 sprintfW( buf, subauthfmt, pisid->SubAuthority[i] );
4497 DumpString(buf, -1, pwptr, plen);
4502 static BOOL DumpSid(PSID psid, WCHAR **pwptr, ULONG *plen)
4505 for (i = 0; i < sizeof(WellKnownSids) / sizeof(WellKnownSids[0]); i++)
4507 if (WellKnownSids[i].wstr[0] && EqualSid(psid, (PSID)&(WellKnownSids[i].Sid.Revision)))
4509 DumpString(WellKnownSids[i].wstr, 2, pwptr, plen);
4514 return DumpSidNumeric(psid, pwptr, plen);
4517 static const LPCWSTR AceRightBitNames[32] = {
4518 SDDL_CREATE_CHILD, /* 0 */
4522 SDDL_READ_PROPERTY, /* 4 */
4523 SDDL_WRITE_PROPERTY,
4526 SDDL_CONTROL_ACCESS, /* 8 */
4534 SDDL_STANDARD_DELETE, /* 16 */
4546 SDDL_GENERIC_ALL, /* 28 */
4547 SDDL_GENERIC_EXECUTE,
4552 static void DumpRights(DWORD mask, WCHAR **pwptr, ULONG *plen)
4554 static const WCHAR fmtW[] = {'0','x','%','x',0};
4561 /* first check if the right have name */
4562 for (i = 0; i < sizeof(AceRights)/sizeof(AceRights[0]); i++)
4564 if (AceRights[i].wstr == NULL)
4566 if (mask == AceRights[i].value)
4568 DumpString(AceRights[i].wstr, -1, pwptr, plen);
4573 /* then check if it can be built from bit names */
4574 for (i = 0; i < 32; i++)
4576 if ((mask & (1 << i)) && (AceRightBitNames[i] == NULL))
4578 /* can't be built from bit names */
4579 sprintfW(buf, fmtW, mask);
4580 DumpString(buf, -1, pwptr, plen);
4585 /* build from bit names */
4586 for (i = 0; i < 32; i++)
4587 if (mask & (1 << i))
4588 DumpString(AceRightBitNames[i], -1, pwptr, plen);
4591 static BOOL DumpAce(LPVOID pace, WCHAR **pwptr, ULONG *plen)
4593 ACCESS_ALLOWED_ACE *piace; /* all the supported ACEs have the same memory layout */
4594 static const WCHAR openbr = '(';
4595 static const WCHAR closebr = ')';
4596 static const WCHAR semicolon = ';';
4598 if (((PACE_HEADER)pace)->AceType > SYSTEM_ALARM_ACE_TYPE || ((PACE_HEADER)pace)->AceSize < sizeof(ACCESS_ALLOWED_ACE))
4600 SetLastError(ERROR_INVALID_ACL);
4605 DumpString(&openbr, 1, pwptr, plen);
4606 switch (piace->Header.AceType)
4608 case ACCESS_ALLOWED_ACE_TYPE:
4609 DumpString(SDDL_ACCESS_ALLOWED, -1, pwptr, plen);
4611 case ACCESS_DENIED_ACE_TYPE:
4612 DumpString(SDDL_ACCESS_DENIED, -1, pwptr, plen);
4614 case SYSTEM_AUDIT_ACE_TYPE:
4615 DumpString(SDDL_AUDIT, -1, pwptr, plen);
4617 case SYSTEM_ALARM_ACE_TYPE:
4618 DumpString(SDDL_ALARM, -1, pwptr, plen);
4621 DumpString(&semicolon, 1, pwptr, plen);
4623 if (piace->Header.AceFlags & OBJECT_INHERIT_ACE)
4624 DumpString(SDDL_OBJECT_INHERIT, -1, pwptr, plen);
4625 if (piace->Header.AceFlags & CONTAINER_INHERIT_ACE)
4626 DumpString(SDDL_CONTAINER_INHERIT, -1, pwptr, plen);
4627 if (piace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE)
4628 DumpString(SDDL_NO_PROPAGATE, -1, pwptr, plen);
4629 if (piace->Header.AceFlags & INHERIT_ONLY_ACE)
4630 DumpString(SDDL_INHERIT_ONLY, -1, pwptr, plen);
4631 if (piace->Header.AceFlags & INHERITED_ACE)
4632 DumpString(SDDL_INHERITED, -1, pwptr, plen);
4633 if (piace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG)
4634 DumpString(SDDL_AUDIT_SUCCESS, -1, pwptr, plen);
4635 if (piace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG)
4636 DumpString(SDDL_AUDIT_FAILURE, -1, pwptr, plen);
4637 DumpString(&semicolon, 1, pwptr, plen);
4638 DumpRights(piace->Mask, pwptr, plen);
4639 DumpString(&semicolon, 1, pwptr, plen);
4640 /* objects not supported */
4641 DumpString(&semicolon, 1, pwptr, plen);
4642 /* objects not supported */
4643 DumpString(&semicolon, 1, pwptr, plen);
4644 if (!DumpSid(&piace->SidStart, pwptr, plen))
4646 DumpString(&closebr, 1, pwptr, plen);
4650 static BOOL DumpAcl(PACL pacl, WCHAR **pwptr, ULONG *plen, BOOL protected, BOOL autoInheritReq, BOOL autoInherited)
4656 DumpString(SDDL_PROTECTED, -1, pwptr, plen);
4658 DumpString(SDDL_AUTO_INHERIT_REQ, -1, pwptr, plen);
4660 DumpString(SDDL_AUTO_INHERITED, -1, pwptr, plen);
4665 if (!IsValidAcl(pacl))
4668 count = pacl->AceCount;
4669 for (i = 0; i < count; i++)
4672 if (!GetAce(pacl, i, &ace))
4674 if (!DumpAce(ace, pwptr, plen))
4681 static BOOL DumpOwner(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4683 static const WCHAR prefix[] = {'O',':',0};
4687 if (!GetSecurityDescriptorOwner(SecurityDescriptor, &psid, &bDefaulted))
4693 DumpString(prefix, -1, pwptr, plen);
4694 if (!DumpSid(psid, pwptr, plen))
4699 static BOOL DumpGroup(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4701 static const WCHAR prefix[] = {'G',':',0};
4705 if (!GetSecurityDescriptorGroup(SecurityDescriptor, &psid, &bDefaulted))
4711 DumpString(prefix, -1, pwptr, plen);
4712 if (!DumpSid(psid, pwptr, plen))
4717 static BOOL DumpDacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4719 static const WCHAR dacl[] = {'D',':',0};
4720 SECURITY_DESCRIPTOR_CONTROL control;
4721 BOOL present, defaulted;
4725 if (!GetSecurityDescriptorDacl(SecurityDescriptor, &present, &pacl, &defaulted))
4728 if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
4734 DumpString(dacl, 2, pwptr, plen);
4735 if (!DumpAcl(pacl, pwptr, plen, control & SE_DACL_PROTECTED, control & SE_DACL_AUTO_INHERIT_REQ, control & SE_DACL_AUTO_INHERITED))
4740 static BOOL DumpSacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4742 static const WCHAR sacl[] = {'S',':',0};
4743 SECURITY_DESCRIPTOR_CONTROL control;
4744 BOOL present, defaulted;
4748 if (!GetSecurityDescriptorSacl(SecurityDescriptor, &present, &pacl, &defaulted))
4751 if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
4757 DumpString(sacl, 2, pwptr, plen);
4758 if (!DumpAcl(pacl, pwptr, plen, control & SE_SACL_PROTECTED, control & SE_SACL_AUTO_INHERIT_REQ, control & SE_SACL_AUTO_INHERITED))
4763 /******************************************************************************
4764 * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
4766 BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorW(PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION RequestedInformation, LPWSTR *OutputString, PULONG OutputLen)
4771 if (SDRevision != SDDL_REVISION_1)
4773 ERR("Pogram requested unknown SDDL revision %d\n", SDRevision);
4774 SetLastError(ERROR_UNKNOWN_REVISION);
4779 if (RequestedInformation & OWNER_SECURITY_INFORMATION)
4780 if (!DumpOwner(SecurityDescriptor, NULL, &len))
4782 if (RequestedInformation & GROUP_SECURITY_INFORMATION)
4783 if (!DumpGroup(SecurityDescriptor, NULL, &len))
4785 if (RequestedInformation & DACL_SECURITY_INFORMATION)
4786 if (!DumpDacl(SecurityDescriptor, NULL, &len))
4788 if (RequestedInformation & SACL_SECURITY_INFORMATION)
4789 if (!DumpSacl(SecurityDescriptor, NULL, &len))
4792 wstr = wptr = LocalAlloc(0, (len + 1)*sizeof(WCHAR));
4793 if (RequestedInformation & OWNER_SECURITY_INFORMATION)
4794 if (!DumpOwner(SecurityDescriptor, &wptr, NULL))
4796 if (RequestedInformation & GROUP_SECURITY_INFORMATION)
4797 if (!DumpGroup(SecurityDescriptor, &wptr, NULL))
4799 if (RequestedInformation & DACL_SECURITY_INFORMATION)
4800 if (!DumpDacl(SecurityDescriptor, &wptr, NULL))
4802 if (RequestedInformation & SACL_SECURITY_INFORMATION)
4803 if (!DumpSacl(SecurityDescriptor, &wptr, NULL))
4807 TRACE("ret: %s, %d\n", wine_dbgstr_w(wstr), len);
4808 *OutputString = wstr;
4810 *OutputLen = strlenW(*OutputString)+1;
4814 /******************************************************************************
4815 * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
4817 BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorA(PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION Information, LPSTR *OutputString, PULONG OutputLen)
4821 if (ConvertSecurityDescriptorToStringSecurityDescriptorW(SecurityDescriptor, SDRevision, Information, &wstr, &len))
4825 lenA = WideCharToMultiByte(CP_ACP, 0, wstr, len, NULL, 0, NULL, NULL);
4826 *OutputString = HeapAlloc(GetProcessHeap(), 0, lenA);
4827 WideCharToMultiByte(CP_ACP, 0, wstr, len, *OutputString, lenA, NULL, NULL);
4830 if (OutputLen != NULL)
4836 *OutputString = NULL;
4843 /******************************************************************************
4844 * ConvertStringSidToSidW [ADVAPI32.@]
4846 BOOL WINAPI ConvertStringSidToSidW(LPCWSTR StringSid, PSID* Sid)
4851 TRACE("%s, %p\n", debugstr_w(StringSid), Sid);
4852 if (GetVersion() & 0x80000000)
4853 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4854 else if (!StringSid || !Sid)
4855 SetLastError(ERROR_INVALID_PARAMETER);
4856 else if (ParseStringSidToSid(StringSid, NULL, &cBytes))
4858 PSID pSid = *Sid = LocalAlloc(0, cBytes);
4860 bret = ParseStringSidToSid(StringSid, pSid, &cBytes);
4867 /******************************************************************************
4868 * ConvertStringSidToSidA [ADVAPI32.@]
4870 BOOL WINAPI ConvertStringSidToSidA(LPCSTR StringSid, PSID* Sid)
4874 TRACE("%s, %p\n", debugstr_a(StringSid), Sid);
4875 if (GetVersion() & 0x80000000)
4876 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4877 else if (!StringSid || !Sid)
4878 SetLastError(ERROR_INVALID_PARAMETER);
4881 UINT len = MultiByteToWideChar(CP_ACP, 0, StringSid, -1, NULL, 0);
4882 LPWSTR wStringSid = HeapAlloc(GetProcessHeap(), 0,
4883 len * sizeof(WCHAR));
4885 MultiByteToWideChar(CP_ACP, 0, StringSid, -1, wStringSid, len);
4886 bret = ConvertStringSidToSidW(wStringSid, Sid);
4887 HeapFree(GetProcessHeap(), 0, wStringSid);
4892 /******************************************************************************
4893 * ConvertSidToStringSidW [ADVAPI32.@]
4895 * format of SID string is:
4896 * S-<count>-<auth>-<subauth1>-<subauth2>-<subauth3>...
4898 * <rev> is the revision of the SID encoded as decimal
4899 * <auth> is the identifier authority encoded as hex
4900 * <subauthN> is the subauthority id encoded as decimal
4902 BOOL WINAPI ConvertSidToStringSidW( PSID pSid, LPWSTR *pstr )
4907 TRACE("%p %p\n", pSid, pstr );
4910 if (!DumpSidNumeric(pSid, NULL, &len))
4912 wstr = wptr = LocalAlloc(0, (len+1) * sizeof(WCHAR));
4913 DumpSidNumeric(pSid, &wptr, NULL);
4920 /******************************************************************************
4921 * ConvertSidToStringSidA [ADVAPI32.@]
4923 BOOL WINAPI ConvertSidToStringSidA(PSID pSid, LPSTR *pstr)
4929 TRACE("%p %p\n", pSid, pstr );
4931 if( !ConvertSidToStringSidW( pSid, &wstr ) )
4934 len = WideCharToMultiByte( CP_ACP, 0, wstr, -1, NULL, 0, NULL, NULL );
4935 str = LocalAlloc( 0, len );
4936 WideCharToMultiByte( CP_ACP, 0, wstr, -1, str, len, NULL, NULL );
4944 BOOL WINAPI ConvertToAutoInheritPrivateObjectSecurity(
4945 PSECURITY_DESCRIPTOR pdesc,
4946 PSECURITY_DESCRIPTOR cdesc,
4947 PSECURITY_DESCRIPTOR* ndesc,
4950 PGENERIC_MAPPING genmap )
4952 FIXME("%p %p %p %p %d %p - stub\n", pdesc, cdesc, ndesc, objtype, isdir, genmap);
4957 BOOL WINAPI CreatePrivateObjectSecurity(
4958 PSECURITY_DESCRIPTOR ParentDescriptor,
4959 PSECURITY_DESCRIPTOR CreatorDescriptor,
4960 PSECURITY_DESCRIPTOR* NewDescriptor,
4961 BOOL IsDirectoryObject,
4963 PGENERIC_MAPPING GenericMapping )
4965 FIXME("%p %p %p %d %p %p - stub\n", ParentDescriptor, CreatorDescriptor,
4966 NewDescriptor, IsDirectoryObject, Token, GenericMapping);
4971 BOOL WINAPI DestroyPrivateObjectSecurity( PSECURITY_DESCRIPTOR* ObjectDescriptor )
4973 FIXME("%p - stub\n", ObjectDescriptor);
4978 BOOL WINAPI CreateProcessAsUserA(
4980 LPCSTR lpApplicationName,
4981 LPSTR lpCommandLine,
4982 LPSECURITY_ATTRIBUTES lpProcessAttributes,
4983 LPSECURITY_ATTRIBUTES lpThreadAttributes,
4984 BOOL bInheritHandles,
4985 DWORD dwCreationFlags,
4986 LPVOID lpEnvironment,
4987 LPCSTR lpCurrentDirectory,
4988 LPSTARTUPINFOA lpStartupInfo,
4989 LPPROCESS_INFORMATION lpProcessInformation )
4991 FIXME("%p %s %s %p %p %d 0x%08x %p %s %p %p - stub\n", hToken, debugstr_a(lpApplicationName),
4992 debugstr_a(lpCommandLine), lpProcessAttributes, lpThreadAttributes, bInheritHandles,
4993 dwCreationFlags, lpEnvironment, debugstr_a(lpCurrentDirectory), lpStartupInfo, lpProcessInformation);
4998 BOOL WINAPI CreateProcessAsUserW(
5000 LPCWSTR lpApplicationName,
5001 LPWSTR lpCommandLine,
5002 LPSECURITY_ATTRIBUTES lpProcessAttributes,
5003 LPSECURITY_ATTRIBUTES lpThreadAttributes,
5004 BOOL bInheritHandles,
5005 DWORD dwCreationFlags,
5006 LPVOID lpEnvironment,
5007 LPCWSTR lpCurrentDirectory,
5008 LPSTARTUPINFOW lpStartupInfo,
5009 LPPROCESS_INFORMATION lpProcessInformation )
5011 FIXME("%p %s %s %p %p %d 0x%08x %p %s %p %p - semi- stub\n", hToken,
5012 debugstr_w(lpApplicationName), debugstr_w(lpCommandLine), lpProcessAttributes,
5013 lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment,
5014 debugstr_w(lpCurrentDirectory), lpStartupInfo, lpProcessInformation);
5016 /* We should create the process with a suspended main thread */
5017 if (!CreateProcessW (lpApplicationName,
5019 lpProcessAttributes,
5022 dwCreationFlags, /* CREATE_SUSPENDED */
5026 lpProcessInformation))
5034 /******************************************************************************
5035 * CreateProcessWithLogonW
5037 BOOL WINAPI CreateProcessWithLogonW( LPCWSTR lpUsername, LPCWSTR lpDomain, LPCWSTR lpPassword, DWORD dwLogonFlags,
5038 LPCWSTR lpApplicationName, LPWSTR lpCommandLine, DWORD dwCreationFlags, LPVOID lpEnvironment,
5039 LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation )
5041 FIXME("%s %s %s 0x%08x %s %s 0x%08x %p %s %p %p stub\n", debugstr_w(lpUsername), debugstr_w(lpDomain),
5042 debugstr_w(lpPassword), dwLogonFlags, debugstr_w(lpApplicationName),
5043 debugstr_w(lpCommandLine), dwCreationFlags, lpEnvironment, debugstr_w(lpCurrentDirectory),
5044 lpStartupInfo, lpProcessInformation);
5049 /******************************************************************************
5050 * DuplicateTokenEx [ADVAPI32.@]
5052 BOOL WINAPI DuplicateTokenEx(
5053 HANDLE ExistingTokenHandle, DWORD dwDesiredAccess,
5054 LPSECURITY_ATTRIBUTES lpTokenAttributes,
5055 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5056 TOKEN_TYPE TokenType,
5057 PHANDLE DuplicateTokenHandle )
5059 OBJECT_ATTRIBUTES ObjectAttributes;
5061 TRACE("%p 0x%08x 0x%08x 0x%08x %p\n", ExistingTokenHandle, dwDesiredAccess,
5062 ImpersonationLevel, TokenType, DuplicateTokenHandle);
5064 InitializeObjectAttributes(
5067 (lpTokenAttributes && lpTokenAttributes->bInheritHandle) ? OBJ_INHERIT : 0,
5069 lpTokenAttributes ? lpTokenAttributes->lpSecurityDescriptor : NULL );
5071 return set_ntstatus( NtDuplicateToken( ExistingTokenHandle,
5076 DuplicateTokenHandle ) );
5079 BOOL WINAPI DuplicateToken(
5080 HANDLE ExistingTokenHandle,
5081 SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5082 PHANDLE DuplicateTokenHandle )
5084 return DuplicateTokenEx( ExistingTokenHandle, TOKEN_IMPERSONATE | TOKEN_QUERY,
5085 NULL, ImpersonationLevel, TokenImpersonation,
5086 DuplicateTokenHandle );
5089 /******************************************************************************
5090 * ComputeStringSidSize
5092 static DWORD ComputeStringSidSize(LPCWSTR StringSid)
5094 if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I(-S)+ */
5099 if (*StringSid == '-')
5105 return GetSidLengthRequired(ctok - 2);
5107 else /* String constant format - Only available in winxp and above */
5111 for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
5112 if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
5113 return GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
5116 return GetSidLengthRequired(0);
5119 /******************************************************************************
5120 * ParseStringSidToSid
5122 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes)
5127 TRACE("%s, %p, %p\n", debugstr_w(StringSid), pSid, cBytes);
5130 SetLastError(ERROR_INVALID_PARAMETER);
5131 TRACE("StringSid is NULL, returning FALSE\n");
5135 while (*StringSid == ' ')
5138 *cBytes = ComputeStringSidSize(StringSid);
5139 if (!pisid) /* Simply compute the size */
5141 TRACE("only size requested, returning TRUE\n");
5145 if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I-S-S */
5147 DWORD i = 0, identAuth;
5148 DWORD csubauth = ((*cBytes - GetSidLengthRequired(0)) / sizeof(DWORD));
5150 StringSid += 2; /* Advance to Revision */
5151 pisid->Revision = atoiW(StringSid);
5153 if (pisid->Revision != SDDL_REVISION)
5155 TRACE("Revision %d is unknown\n", pisid->Revision);
5156 goto lend; /* ERROR_INVALID_SID */
5160 TRACE("SubAuthorityCount is 0\n");
5161 goto lend; /* ERROR_INVALID_SID */
5164 pisid->SubAuthorityCount = csubauth;
5166 /* Advance to identifier authority */
5167 while (*StringSid && *StringSid != '-')
5169 if (*StringSid == '-')
5172 /* MS' implementation can't handle values greater than 2^32 - 1, so
5173 * we don't either; assume most significant bytes are always 0
5175 pisid->IdentifierAuthority.Value[0] = 0;
5176 pisid->IdentifierAuthority.Value[1] = 0;
5177 identAuth = atoiW(StringSid);
5178 pisid->IdentifierAuthority.Value[5] = identAuth & 0xff;
5179 pisid->IdentifierAuthority.Value[4] = (identAuth & 0xff00) >> 8;
5180 pisid->IdentifierAuthority.Value[3] = (identAuth & 0xff0000) >> 16;
5181 pisid->IdentifierAuthority.Value[2] = (identAuth & 0xff000000) >> 24;
5183 /* Advance to first sub authority */
5184 while (*StringSid && *StringSid != '-')
5186 if (*StringSid == '-')
5191 pisid->SubAuthority[i++] = atoiW(StringSid);
5193 while (*StringSid && *StringSid != '-')
5195 if (*StringSid == '-')
5199 if (i != pisid->SubAuthorityCount)
5200 goto lend; /* ERROR_INVALID_SID */
5204 else /* String constant format - Only available in winxp and above */
5207 pisid->Revision = SDDL_REVISION;
5209 for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
5210 if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
5213 pisid->SubAuthorityCount = WellKnownSids[i].Sid.SubAuthorityCount;
5214 pisid->IdentifierAuthority = WellKnownSids[i].Sid.IdentifierAuthority;
5215 for (j = 0; j < WellKnownSids[i].Sid.SubAuthorityCount; j++)
5216 pisid->SubAuthority[j] = WellKnownSids[i].Sid.SubAuthority[j];
5221 FIXME("String constant not supported: %s\n", debugstr_wn(StringSid, 2));
5226 SetLastError(ERROR_INVALID_SID);
5228 TRACE("returning %s\n", bret ? "TRUE" : "FALSE");
5232 /******************************************************************************
5233 * GetNamedSecurityInfoA [ADVAPI32.@]
5235 DWORD WINAPI GetNamedSecurityInfoA(LPSTR pObjectName,
5236 SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
5237 PSID* ppsidOwner, PSID* ppsidGroup, PACL* ppDacl, PACL* ppSacl,
5238 PSECURITY_DESCRIPTOR* ppSecurityDescriptor)
5244 TRACE("%s %d %d %p %p %p %p %p\n", pObjectName, ObjectType, SecurityInfo,
5245 ppsidOwner, ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor);
5249 len = MultiByteToWideChar( CP_ACP, 0, pObjectName, -1, NULL, 0 );
5250 wstr = HeapAlloc( GetProcessHeap(), 0, len*sizeof(WCHAR));
5251 MultiByteToWideChar( CP_ACP, 0, pObjectName, -1, wstr, len );
5254 r = GetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, ppsidOwner,
5255 ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor );
5257 HeapFree( GetProcessHeap(), 0, wstr );
5262 /******************************************************************************
5263 * GetNamedSecurityInfoW [ADVAPI32.@]
5265 DWORD WINAPI GetNamedSecurityInfoW( LPWSTR name, SE_OBJECT_TYPE type,
5266 SECURITY_INFORMATION info, PSID* owner, PSID* group, PACL* dacl,
5267 PACL* sacl, PSECURITY_DESCRIPTOR* descriptor )
5269 DWORD needed, offset;
5270 SECURITY_DESCRIPTOR_RELATIVE *relative;
5273 TRACE( "%s %d %d %p %p %p %p %p\n", debugstr_w(name), type, info, owner,
5274 group, dacl, sacl, descriptor );
5276 if (!name || !descriptor) return ERROR_INVALID_PARAMETER;
5278 needed = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5279 if (info & OWNER_SECURITY_INFORMATION)
5280 needed += sizeof(sidWorld);
5281 if (info & GROUP_SECURITY_INFORMATION)
5282 needed += sizeof(sidWorld);
5283 if (info & DACL_SECURITY_INFORMATION)
5284 needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5285 if (info & SACL_SECURITY_INFORMATION)
5286 needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5288 /* must be freed by caller */
5289 *descriptor = HeapAlloc( GetProcessHeap(), 0, needed );
5290 if (!*descriptor) return ERROR_NOT_ENOUGH_MEMORY;
5292 if (!InitializeSecurityDescriptor( *descriptor, SECURITY_DESCRIPTOR_REVISION ))
5294 HeapFree( GetProcessHeap(), 0, *descriptor );
5295 return ERROR_INVALID_SECURITY_DESCR;
5298 relative = *descriptor;
5299 relative->Control |= SE_SELF_RELATIVE;
5300 buffer = (BYTE *)relative;
5301 offset = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5303 if (info & OWNER_SECURITY_INFORMATION)
5305 memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5306 relative->Owner = offset;
5308 *owner = buffer + offset;
5309 offset += sizeof(sidWorld);
5311 if (info & GROUP_SECURITY_INFORMATION)
5313 memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5314 relative->Group = offset;
5316 *group = buffer + offset;
5317 offset += sizeof(sidWorld);
5319 if (info & DACL_SECURITY_INFORMATION)
5321 relative->Control |= SE_DACL_PRESENT;
5322 GetWorldAccessACL( (PACL)(buffer + offset) );
5323 relative->Dacl = offset;
5325 *dacl = (PACL)(buffer + offset);
5326 offset += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5328 if (info & SACL_SECURITY_INFORMATION)
5330 relative->Control |= SE_SACL_PRESENT;
5331 GetWorldAccessACL( (PACL)(buffer + offset) );
5332 relative->Sacl = offset;
5334 *sacl = (PACL)(buffer + offset);
5336 return ERROR_SUCCESS;
5339 /******************************************************************************
5340 * DecryptFileW [ADVAPI32.@]
5342 BOOL WINAPI DecryptFileW(LPCWSTR lpFileName, DWORD dwReserved)
5344 FIXME("%s %08x\n", debugstr_w(lpFileName), dwReserved);
5348 /******************************************************************************
5349 * DecryptFileA [ADVAPI32.@]
5351 BOOL WINAPI DecryptFileA(LPCSTR lpFileName, DWORD dwReserved)
5353 FIXME("%s %08x\n", debugstr_a(lpFileName), dwReserved);
5357 /******************************************************************************
5358 * EncryptFileW [ADVAPI32.@]
5360 BOOL WINAPI EncryptFileW(LPCWSTR lpFileName)
5362 FIXME("%s\n", debugstr_w(lpFileName));
5366 /******************************************************************************
5367 * EncryptFileA [ADVAPI32.@]
5369 BOOL WINAPI EncryptFileA(LPCSTR lpFileName)
5371 FIXME("%s\n", debugstr_a(lpFileName));
5375 /******************************************************************************
5376 * FileEncryptionStatusW [ADVAPI32.@]
5378 BOOL WINAPI FileEncryptionStatusW(LPCWSTR lpFileName, LPDWORD lpStatus)
5380 FIXME("(%s %p): stub\n", debugstr_w(lpFileName), lpStatus);
5383 *lpStatus = FILE_SYSTEM_NOT_SUPPORT;
5387 /******************************************************************************
5388 * FileEncryptionStatusA [ADVAPI32.@]
5390 BOOL WINAPI FileEncryptionStatusA(LPCSTR lpFileName, LPDWORD lpStatus)
5392 FIXME("(%s %p): stub\n", debugstr_a(lpFileName), lpStatus);
5395 *lpStatus = FILE_SYSTEM_NOT_SUPPORT;
5399 /******************************************************************************
5400 * SetSecurityInfo [ADVAPI32.@]
5402 DWORD WINAPI SetSecurityInfo(HANDLE handle, SE_OBJECT_TYPE ObjectType,
5403 SECURITY_INFORMATION SecurityInfo, PSID psidOwner,
5404 PSID psidGroup, PACL pDacl, PACL pSacl) {
5406 return ERROR_SUCCESS;
5409 /******************************************************************************
5410 * SaferCreateLevel [ADVAPI32.@]
5412 BOOL WINAPI SaferCreateLevel(DWORD ScopeId, DWORD LevelId, DWORD OpenFlags,
5413 SAFER_LEVEL_HANDLE* LevelHandle, LPVOID lpReserved)
5415 FIXME("(%u, %x, %u, %p, %p) stub\n", ScopeId, LevelId, OpenFlags, LevelHandle, lpReserved);
5419 DWORD WINAPI TreeResetNamedSecurityInfoW( LPWSTR pObjectName,
5420 SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
5421 PSID pOwner, PSID pGroup, PACL pDacl, PACL pSacl,
5422 BOOL KeepExplicit, FN_PROGRESS fnProgress,
5423 PROG_INVOKE_SETTING ProgressInvokeSetting, PVOID Args)
5425 FIXME("(%s, %i, %i, %p, %p, %p, %p, %i, %p, %i, %p Stub\n",
5426 debugstr_w(pObjectName), ObjectType, SecurityInfo, pOwner, pGroup,
5427 pDacl, pSacl, KeepExplicit, fnProgress, ProgressInvokeSetting, Args);
5429 return ERROR_SUCCESS;
5432 /******************************************************************************
5433 * SaferGetPolicyInformation [ADVAPI32.@]
5435 BOOL WINAPI SaferGetPolicyInformation(DWORD scope, SAFER_POLICY_INFO_CLASS class, DWORD size,
5436 PVOID buffer, PDWORD required, LPVOID lpReserved)
5438 FIXME("(%u %u %u %p %p %p) stub\n", scope, class, size, buffer, required, lpReserved);