git.oblomov.eu Git - wine/blob - dlls/advapi32/security.c

   1 /*
   2  * Copyright 1999, 2000 Juergen Schmied <juergen.schmied@debitel.net>
   3  * Copyright 2003 CodeWeavers Inc. (Ulrich Czekalla)
   4  * Copyright 2006 Robert Reif
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  */
  21
  22 #include <stdarg.h>
  23 #include <string.h>
  24
  25 #include "ntstatus.h"
  26 #define WIN32_NO_STATUS
  27 #include "windef.h"
  28 #include "winbase.h"
  29 #include "winerror.h"
  30 #include "winreg.h"
  31 #include "winsafer.h"
  32 #include "winternl.h"
  33 #include "winioctl.h"
  34 #include "accctrl.h"
  35 #include "sddl.h"
  36 #include "winsvc.h"
  37 #include "aclapi.h"
  38 #include "objbase.h"
  39 #include "iads.h"
  40 #include "advapi32_misc.h"
  41 #include "lmcons.h"
  42
  43 #include "wine/debug.h"
  44 #include "wine/unicode.h"
  45
  46 WINE_DEFAULT_DEBUG_CHANNEL(advapi);
  47
  48 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes);
  49 static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags,
  50     PACL pAcl, LPDWORD cBytes);
  51 static BYTE ParseAceStringFlags(LPCWSTR* StringAcl);
  52 static BYTE ParseAceStringType(LPCWSTR* StringAcl);
  53 static DWORD ParseAceStringRights(LPCWSTR* StringAcl);
  54 static BOOL ParseStringSecurityDescriptorToSecurityDescriptor(
  55     LPCWSTR StringSecurityDescriptor,
  56     SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
  57     LPDWORD cBytes);
  58 static DWORD ParseAclStringFlags(LPCWSTR* StringAcl);
  59
  60 typedef struct _ACEFLAG
  61 {
  62    LPCWSTR wstr;
  63    DWORD value;
  64 } ACEFLAG, *LPACEFLAG;
  65
  66 typedef struct _MAX_SID
  67 {
  68     /* same fields as struct _SID */
  69     BYTE Revision;
  70     BYTE SubAuthorityCount;
  71     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  72     DWORD SubAuthority[SID_MAX_SUB_AUTHORITIES];
  73 } MAX_SID;
  74
  75 typedef struct WELLKNOWNSID
  76 {
  77     WCHAR wstr[2];
  78     WELL_KNOWN_SID_TYPE Type;
  79     MAX_SID Sid;
  80 } WELLKNOWNSID;
  81
  82 static const WELLKNOWNSID WellKnownSids[] =
  83 {
  84     { {0,0}, WinNullSid, { SID_REVISION, 1, { SECURITY_NULL_SID_AUTHORITY }, { SECURITY_NULL_RID } } },
  85     { {'W','D'}, WinWorldSid, { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY }, { SECURITY_WORLD_RID } } },
  86     { {0,0}, WinLocalSid, { SID_REVISION, 1, { SECURITY_LOCAL_SID_AUTHORITY }, { SECURITY_LOCAL_RID } } },
  87     { {'C','O'}, WinCreatorOwnerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_RID } } },
  88     { {'C','G'}, WinCreatorGroupSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_RID } } },
  89     { {0,0}, WinCreatorOwnerServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_OWNER_SERVER_RID } } },
  90     { {0,0}, WinCreatorGroupServerSid, { SID_REVISION, 1, { SECURITY_CREATOR_SID_AUTHORITY }, { SECURITY_CREATOR_GROUP_SERVER_RID } } },
  91     { {0,0}, WinNtAuthoritySid, { SID_REVISION, 0, { SECURITY_NT_AUTHORITY }, { SECURITY_NULL_RID } } },
  92     { {0,0}, WinDialupSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_DIALUP_RID } } },
  93     { {'N','U'}, WinNetworkSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_RID } } },
  94     { {0,0}, WinBatchSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BATCH_RID } } },
  95     { {'I','U'}, WinInteractiveSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_INTERACTIVE_RID } } },
  96     { {'S','U'}, WinServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_SERVICE_RID } } },
  97     { {'A','N'}, WinAnonymousSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ANONYMOUS_LOGON_RID } } },
  98     { {0,0}, WinProxySid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PROXY_RID } } },
  99     { {'E','D'}, WinEnterpriseControllersSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_ENTERPRISE_CONTROLLERS_RID } } },
 100     { {'P','S'}, WinSelfSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_PRINCIPAL_SELF_RID } } },
 101     { {'A','U'}, WinAuthenticatedUserSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_AUTHENTICATED_USER_RID } } },
 102     { {'R','C'}, WinRestrictedCodeSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_RESTRICTED_CODE_RID } } },
 103     { {0,0}, WinTerminalServerSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_TERMINAL_SERVER_RID } } },
 104     { {0,0}, WinRemoteLogonIdSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_REMOTE_LOGON_RID } } },
 105     { {'S','Y'}, WinLocalSystemSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SYSTEM_RID } } },
 106     { {'L','S'}, WinLocalServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_LOCAL_SERVICE_RID } } },
 107     { {'N','S'}, WinNetworkServiceSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_NETWORK_SERVICE_RID } } },
 108     { {0,0}, WinBuiltinDomainSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID } } },
 109     { {'B','A'}, WinBuiltinAdministratorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } } },
 110     { {'B','U'}, WinBuiltinUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_USERS } } },
 111     { {'B','G'}, WinBuiltinGuestsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_GUESTS } } },
 112     { {'P','U'}, WinBuiltinPowerUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_POWER_USERS } } },
 113     { {'A','O'}, WinBuiltinAccountOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ACCOUNT_OPS } } },
 114     { {'S','O'}, WinBuiltinSystemOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_SYSTEM_OPS } } },
 115     { {'P','O'}, WinBuiltinPrintOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PRINT_OPS } } },
 116     { {'B','O'}, WinBuiltinBackupOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_BACKUP_OPS } } },
 117     { {'R','E'}, WinBuiltinReplicatorSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REPLICATOR } } },
 118     { {'R','U'}, WinBuiltinPreWindows2000CompatibleAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_PREW2KCOMPACCESS } } },
 119     { {'R','D'}, WinBuiltinRemoteDesktopUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS } } },
 120     { {'N','O'}, WinBuiltinNetworkConfigurationOperatorsSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS } } },
 121     { {0,0}, WinNTLMAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_NTLM_RID } } },
 122     { {0,0}, WinDigestAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_DIGEST_RID } } },
 123     { {0,0}, WinSChannelAuthenticationSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_PACKAGE_BASE_RID, SECURITY_PACKAGE_SCHANNEL_RID } } },
 124     { {0,0}, WinThisOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_THIS_ORGANIZATION_RID } } },
 125     { {0,0}, WinOtherOrganizationSid, { SID_REVISION, 1, { SECURITY_NT_AUTHORITY }, { SECURITY_OTHER_ORGANIZATION_RID } } },
 126     { {0,0}, WinBuiltinIncomingForestTrustBuildersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS  } } },
 127     { {0,0}, WinBuiltinPerfMonitoringUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_MONITORING_USERS } } },
 128     { {0,0}, WinBuiltinPerfLoggingUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_LOGGING_USERS } } },
 129     { {0,0}, WinBuiltinAuthorizationAccessSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS } } },
 130     { {0,0}, WinBuiltinTerminalServerLicenseServersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS } } },
 131     { {0,0}, WinBuiltinDCOMUsersSid, { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_DCOM_USERS } } },
 132     { {'L','W'}, WinLowLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_LOW_RID} } },
 133     { {'M','E'}, WinMediumLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_MEDIUM_RID } } },
 134     { {'H','I'}, WinHighLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_HIGH_RID } } },
 135     { {'S','I'}, WinSystemLabelSid, { SID_REVISION, 1, { SECURITY_MANDATORY_LABEL_AUTHORITY}, { SECURITY_MANDATORY_SYSTEM_RID } } },
 136 };
 137
 138 /* these SIDs must be constructed as relative to some domain - only the RID is well-known */
 139 typedef struct WELLKNOWNRID
 140 {
 141     WCHAR wstr[2];
 142     WELL_KNOWN_SID_TYPE Type;
 143     DWORD Rid;
 144 } WELLKNOWNRID;
 145
 146 static const WELLKNOWNRID WellKnownRids[] = {
 147     { {'L','A'}, WinAccountAdministratorSid,    DOMAIN_USER_RID_ADMIN },
 148     { {'L','G'}, WinAccountGuestSid,            DOMAIN_USER_RID_GUEST },
 149     { {0,0}, WinAccountKrbtgtSid,           DOMAIN_USER_RID_KRBTGT },
 150     { {0,0}, WinAccountDomainAdminsSid,     DOMAIN_GROUP_RID_ADMINS },
 151     { {0,0}, WinAccountDomainUsersSid,      DOMAIN_GROUP_RID_USERS },
 152     { {0,0}, WinAccountDomainGuestsSid,     DOMAIN_GROUP_RID_GUESTS },
 153     { {0,0}, WinAccountComputersSid,        DOMAIN_GROUP_RID_COMPUTERS },
 154     { {0,0}, WinAccountControllersSid,      DOMAIN_GROUP_RID_CONTROLLERS },
 155     { {0,0}, WinAccountCertAdminsSid,       DOMAIN_GROUP_RID_CERT_ADMINS },
 156     { {0,0}, WinAccountSchemaAdminsSid,     DOMAIN_GROUP_RID_SCHEMA_ADMINS },
 157     { {0,0}, WinAccountEnterpriseAdminsSid, DOMAIN_GROUP_RID_ENTERPRISE_ADMINS },
 158     { {0,0}, WinAccountPolicyAdminsSid,     DOMAIN_GROUP_RID_POLICY_ADMINS },
 159     { {0,0}, WinAccountRasAndIasServersSid, DOMAIN_ALIAS_RID_RAS_SERVERS },
 160 };
 161
 162
 163 static SID const sidWorld = { SID_REVISION, 1, { SECURITY_WORLD_SID_AUTHORITY} , { SECURITY_WORLD_RID } };
 164
 165 typedef struct _AccountSid {
 166     WELL_KNOWN_SID_TYPE type;
 167     LPCWSTR account;
 168     LPCWSTR domain;
 169     SID_NAME_USE name_use;
 170     LPCWSTR alias;
 171 } AccountSid;
 172
 173 static const WCHAR Account_Operators[] = { 'A','c','c','o','u','n','t',' ','O','p','e','r','a','t','o','r','s',0 };
 174 static const WCHAR Administrator[] = {'A','d','m','i','n','i','s','t','r','a','t','o','r',0 };
 175 static const WCHAR Administrators[] = { 'A','d','m','i','n','i','s','t','r','a','t','o','r','s',0 };
 176 static const WCHAR ANONYMOUS_LOGON[] = { 'A','N','O','N','Y','M','O','U','S',' ','L','O','G','O','N',0 };
 177 static const WCHAR Authenticated_Users[] = { 'A','u','t','h','e','n','t','i','c','a','t','e','d',' ','U','s','e','r','s',0 };
 178 static const WCHAR Backup_Operators[] = { 'B','a','c','k','u','p',' ','O','p','e','r','a','t','o','r','s',0 };
 179 static const WCHAR BATCH[] = { 'B','A','T','C','H',0 };
 180 static const WCHAR Blank[] = { 0 };
 181 static const WCHAR BUILTIN[] = { 'B','U','I','L','T','I','N',0 };
 182 static const WCHAR Cert_Publishers[] = { 'C','e','r','t',' ','P','u','b','l','i','s','h','e','r','s',0 };
 183 static const WCHAR CREATOR_GROUP[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',0 };
 184 static const WCHAR CREATOR_GROUP_SERVER[] = { 'C','R','E','A','T','O','R',' ','G','R','O','U','P',' ','S','E','R','V','E','R',0 };
 185 static const WCHAR CREATOR_OWNER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',0 };
 186 static const WCHAR CREATOR_OWNER_SERVER[] = { 'C','R','E','A','T','O','R',' ','O','W','N','E','R',' ','S','E','R','V','E','R',0 };
 187 static const WCHAR CURRENT_USER[] = { 'C','U','R','R','E','N','T','_','U','S','E','R',0 };
 188 static const WCHAR DIALUP[] = { 'D','I','A','L','U','P',0 };
 189 static const WCHAR Digest_Authentication[] = { 'D','i','g','e','s','t',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 190 static const WCHAR DOMAIN[] = {'D','O','M','A','I','N',0};
 191 static const WCHAR Domain_Admins[] = { 'D','o','m','a','i','n',' ','A','d','m','i','n','s',0 };
 192 static const WCHAR Domain_Computers[] = { 'D','o','m','a','i','n',' ','C','o','m','p','u','t','e','r','s',0 };
 193 static const WCHAR Domain_Controllers[] = { 'D','o','m','a','i','n',' ','C','o','n','t','r','o','l','l','e','r','s',0 };
 194 static const WCHAR Domain_Guests[] = { 'D','o','m','a','i','n',' ','G','u','e','s','t','s',0 };
 195 static const WCHAR Domain_Users[] = { 'D','o','m','a','i','n',' ','U','s','e','r','s',0 };
 196 static const WCHAR Enterprise_Admins[] = { 'E','n','t','e','r','p','r','i','s','e',' ','A','d','m','i','n','s',0 };
 197 static const WCHAR ENTERPRISE_DOMAIN_CONTROLLERS[] = { 'E','N','T','E','R','P','R','I','S','E',' ','D','O','M','A','I','N',' ','C','O','N','T','R','O','L','L','E','R','S',0 };
 198 static const WCHAR Everyone[] = { 'E','v','e','r','y','o','n','e',0 };
 199 static const WCHAR Group_Policy_Creator_Owners[] = { 'G','r','o','u','p',' ','P','o','l','i','c','y',' ','C','r','e','a','t','o','r',' ','O','w','n','e','r','s',0 };
 200 static const WCHAR Guest[] = { 'G','u','e','s','t',0 };
 201 static const WCHAR Guests[] = { 'G','u','e','s','t','s',0 };
 202 static const WCHAR INTERACTIVE[] = { 'I','N','T','E','R','A','C','T','I','V','E',0 };
 203 static const WCHAR LOCAL[] = { 'L','O','C','A','L',0 };
 204 static const WCHAR LOCAL_SERVICE[] = { 'L','O','C','A','L',' ','S','E','R','V','I','C','E',0 };
 205 static const WCHAR LOCAL_SERVICE2[] = { 'L','O','C','A','L','S','E','R','V','I','C','E',0 };
 206 static const WCHAR NETWORK[] = { 'N','E','T','W','O','R','K',0 };
 207 static const WCHAR Network_Configuration_Operators[] = { 'N','e','t','w','o','r','k',' ','C','o','n','f','i','g','u','r','a','t','i','o','n',' ','O','p','e','r','a','t','o','r','s',0 };
 208 static const WCHAR NETWORK_SERVICE[] = { 'N','E','T','W','O','R','K',' ','S','E','R','V','I','C','E',0 };
 209 static const WCHAR NETWORK_SERVICE2[] = { 'N','E','T','W','O','R','K','S','E','R','V','I','C','E',0 };
 210 static const WCHAR NT_AUTHORITY[] = { 'N','T',' ','A','U','T','H','O','R','I','T','Y',0 };
 211 static const WCHAR NT_Pseudo_Domain[] = { 'N','T',' ','P','s','e','u','d','o',' ','D','o','m','a','i','n',0 };
 212 static const WCHAR NTML_Authentication[] = { 'N','T','M','L',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 213 static const WCHAR NULL_SID[] = { 'N','U','L','L',' ','S','I','D',0 };
 214 static const WCHAR Other_Organization[] = { 'O','t','h','e','r',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 };
 215 static const WCHAR Performance_Log_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','L','o','g',' ','U','s','e','r','s',0 };
 216 static const WCHAR Performance_Monitor_Users[] = { 'P','e','r','f','o','r','m','a','n','c','e',' ','M','o','n','i','t','o','r',' ','U','s','e','r','s',0 };
 217 static const WCHAR Power_Users[] = { 'P','o','w','e','r',' ','U','s','e','r','s',0 };
 218 static const WCHAR Pre_Windows_2000_Compatible_Access[] = { 'P','r','e','-','W','i','n','d','o','w','s',' ','2','0','0','0',' ','C','o','m','p','a','t','i','b','l','e',' ','A','c','c','e','s','s',0 };
 219 static const WCHAR Print_Operators[] = { 'P','r','i','n','t',' ','O','p','e','r','a','t','o','r','s',0 };
 220 static const WCHAR PROXY[] = { 'P','R','O','X','Y',0 };
 221 static const WCHAR RAS_and_IAS_Servers[] = { 'R','A','S',' ','a','n','d',' ','I','A','S',' ','S','e','r','v','e','r','s',0 };
 222 static const WCHAR Remote_Desktop_Users[] = { 'R','e','m','o','t','e',' ','D','e','s','k','t','o','p',' ','U','s','e','r','s',0 };
 223 static const WCHAR REMOTE_INTERACTIVE_LOGON[] = { 'R','E','M','O','T','E',' ','I','N','T','E','R','A','C','T','I','V','E',' ','L','O','G','O','N',0 };
 224 static const WCHAR Replicators[] = { 'R','e','p','l','i','c','a','t','o','r','s',0 };
 225 static const WCHAR RESTRICTED[] = { 'R','E','S','T','R','I','C','T','E','D',0 };
 226 static const WCHAR SChannel_Authentication[] = { 'S','C','h','a','n','n','e','l',' ','A','u','t','h','e','n','t','i','c','a','t','i','o','n',0 };
 227 static const WCHAR Schema_Admins[] = { 'S','c','h','e','m','a',' ','A','d','m','i','n','s',0 };
 228 static const WCHAR SELF[] = { 'S','E','L','F',0 };
 229 static const WCHAR Server_Operators[] = { 'S','e','r','v','e','r',' ','O','p','e','r','a','t','o','r','s',0 };
 230 static const WCHAR SERVICE[] = { 'S','E','R','V','I','C','E',0 };
 231 static const WCHAR SYSTEM[] = { 'S','Y','S','T','E','M',0 };
 232 static const WCHAR TERMINAL_SERVER_USER[] = { 'T','E','R','M','I','N','A','L',' ','S','E','R','V','E','R',' ','U','S','E','R',0 };
 233 static const WCHAR This_Organization[] = { 'T','h','i','s',' ','O','r','g','a','n','i','z','a','t','i','o','n',0 };
 234 static const WCHAR Users[] = { 'U','s','e','r','s',0 };
 235
 236 static const AccountSid ACCOUNT_SIDS[] = {
 237     { WinNullSid, NULL_SID, Blank, SidTypeWellKnownGroup },
 238     { WinWorldSid, Everyone, Blank, SidTypeWellKnownGroup },
 239     { WinLocalSid, LOCAL, Blank, SidTypeWellKnownGroup },
 240     { WinCreatorOwnerSid, CREATOR_OWNER, Blank, SidTypeWellKnownGroup },
 241     { WinCreatorGroupSid, CREATOR_GROUP, Blank, SidTypeWellKnownGroup },
 242     { WinCreatorOwnerServerSid, CREATOR_OWNER_SERVER, Blank, SidTypeWellKnownGroup },
 243     { WinCreatorGroupServerSid, CREATOR_GROUP_SERVER, Blank, SidTypeWellKnownGroup },
 244     { WinNtAuthoritySid, NT_Pseudo_Domain, NT_Pseudo_Domain, SidTypeDomain },
 245     { WinDialupSid, DIALUP, NT_AUTHORITY, SidTypeWellKnownGroup },
 246     { WinNetworkSid, NETWORK, NT_AUTHORITY, SidTypeWellKnownGroup },
 247     { WinBatchSid, BATCH, NT_AUTHORITY, SidTypeWellKnownGroup },
 248     { WinInteractiveSid, INTERACTIVE, NT_AUTHORITY, SidTypeWellKnownGroup },
 249     { WinServiceSid, SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup },
 250     { WinAnonymousSid, ANONYMOUS_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup },
 251     { WinProxySid, PROXY, NT_AUTHORITY, SidTypeWellKnownGroup },
 252     { WinEnterpriseControllersSid, ENTERPRISE_DOMAIN_CONTROLLERS, NT_AUTHORITY, SidTypeWellKnownGroup },
 253     { WinSelfSid, SELF, NT_AUTHORITY, SidTypeWellKnownGroup },
 254     { WinAuthenticatedUserSid, Authenticated_Users, NT_AUTHORITY, SidTypeWellKnownGroup },
 255     { WinRestrictedCodeSid, RESTRICTED, NT_AUTHORITY, SidTypeWellKnownGroup },
 256     { WinTerminalServerSid, TERMINAL_SERVER_USER, NT_AUTHORITY, SidTypeWellKnownGroup },
 257     { WinRemoteLogonIdSid, REMOTE_INTERACTIVE_LOGON, NT_AUTHORITY, SidTypeWellKnownGroup },
 258     { WinLocalSystemSid, SYSTEM, NT_AUTHORITY, SidTypeWellKnownGroup },
 259     { WinLocalServiceSid, LOCAL_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup, LOCAL_SERVICE2 },
 260     { WinNetworkServiceSid, NETWORK_SERVICE, NT_AUTHORITY, SidTypeWellKnownGroup , NETWORK_SERVICE2},
 261     { WinBuiltinDomainSid, BUILTIN, BUILTIN, SidTypeDomain },
 262     { WinBuiltinAdministratorsSid, Administrators, BUILTIN, SidTypeAlias },
 263     { WinBuiltinUsersSid, Users, BUILTIN, SidTypeAlias },
 264     { WinBuiltinGuestsSid, Guests, BUILTIN, SidTypeAlias },
 265     { WinBuiltinPowerUsersSid, Power_Users, BUILTIN, SidTypeAlias },
 266     { WinBuiltinAccountOperatorsSid, Account_Operators, BUILTIN, SidTypeAlias },
 267     { WinBuiltinSystemOperatorsSid, Server_Operators, BUILTIN, SidTypeAlias },
 268     { WinBuiltinPrintOperatorsSid, Print_Operators, BUILTIN, SidTypeAlias },
 269     { WinBuiltinBackupOperatorsSid, Backup_Operators, BUILTIN, SidTypeAlias },
 270     { WinBuiltinReplicatorSid, Replicators, BUILTIN, SidTypeAlias },
 271     { WinBuiltinPreWindows2000CompatibleAccessSid, Pre_Windows_2000_Compatible_Access, BUILTIN, SidTypeAlias },
 272     { WinBuiltinRemoteDesktopUsersSid, Remote_Desktop_Users, BUILTIN, SidTypeAlias },
 273     { WinBuiltinNetworkConfigurationOperatorsSid, Network_Configuration_Operators, BUILTIN, SidTypeAlias },
 274     { WinNTLMAuthenticationSid, NTML_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 275     { WinDigestAuthenticationSid, Digest_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 276     { WinSChannelAuthenticationSid, SChannel_Authentication, NT_AUTHORITY, SidTypeWellKnownGroup },
 277     { WinThisOrganizationSid, This_Organization, NT_AUTHORITY, SidTypeWellKnownGroup },
 278     { WinOtherOrganizationSid, Other_Organization, NT_AUTHORITY, SidTypeWellKnownGroup },
 279     { WinBuiltinPerfMonitoringUsersSid, Performance_Monitor_Users, BUILTIN, SidTypeAlias },
 280     { WinBuiltinPerfLoggingUsersSid, Performance_Log_Users, BUILTIN, SidTypeAlias },
 281 };
 282 /*
 283  * ACE access rights
 284  */
 285 static const WCHAR SDDL_READ_CONTROL[]     = {'R','C',0};
 286 static const WCHAR SDDL_WRITE_DAC[]        = {'W','D',0};
 287 static const WCHAR SDDL_WRITE_OWNER[]      = {'W','O',0};
 288 static const WCHAR SDDL_STANDARD_DELETE[]  = {'S','D',0};
 289
 290 static const WCHAR SDDL_READ_PROPERTY[]    = {'R','P',0};
 291 static const WCHAR SDDL_WRITE_PROPERTY[]   = {'W','P',0};
 292 static const WCHAR SDDL_CREATE_CHILD[]     = {'C','C',0};
 293 static const WCHAR SDDL_DELETE_CHILD[]     = {'D','C',0};
 294 static const WCHAR SDDL_LIST_CHILDREN[]    = {'L','C',0};
 295 static const WCHAR SDDL_SELF_WRITE[]       = {'S','W',0};
 296 static const WCHAR SDDL_LIST_OBJECT[]      = {'L','O',0};
 297 static const WCHAR SDDL_DELETE_TREE[]      = {'D','T',0};
 298 static const WCHAR SDDL_CONTROL_ACCESS[]   = {'C','R',0};
 299
 300 static const WCHAR SDDL_FILE_ALL[]         = {'F','A',0};
 301 static const WCHAR SDDL_FILE_READ[]        = {'F','R',0};
 302 static const WCHAR SDDL_FILE_WRITE[]       = {'F','W',0};
 303 static const WCHAR SDDL_FILE_EXECUTE[]     = {'F','X',0};
 304
 305 static const WCHAR SDDL_KEY_ALL[]          = {'K','A',0};
 306 static const WCHAR SDDL_KEY_READ[]         = {'K','R',0};
 307 static const WCHAR SDDL_KEY_WRITE[]        = {'K','W',0};
 308 static const WCHAR SDDL_KEY_EXECUTE[]      = {'K','X',0};
 309
 310 static const WCHAR SDDL_GENERIC_ALL[]      = {'G','A',0};
 311 static const WCHAR SDDL_GENERIC_READ[]     = {'G','R',0};
 312 static const WCHAR SDDL_GENERIC_WRITE[]    = {'G','W',0};
 313 static const WCHAR SDDL_GENERIC_EXECUTE[]  = {'G','X',0};
 314
 315 /*
 316  * ACL flags
 317  */
 318 static const WCHAR SDDL_PROTECTED[]             = {'P',0};
 319 static const WCHAR SDDL_AUTO_INHERIT_REQ[]      = {'A','R',0};
 320 static const WCHAR SDDL_AUTO_INHERITED[]        = {'A','I',0};
 321
 322 /*
 323  * ACE types
 324  */
 325 static const WCHAR SDDL_ACCESS_ALLOWED[]        = {'A',0};
 326 static const WCHAR SDDL_ACCESS_DENIED[]         = {'D',0};
 327 static const WCHAR SDDL_OBJECT_ACCESS_ALLOWED[] = {'O','A',0};
 328 static const WCHAR SDDL_OBJECT_ACCESS_DENIED[]  = {'O','D',0};
 329 static const WCHAR SDDL_AUDIT[]                 = {'A','U',0};
 330 static const WCHAR SDDL_ALARM[]                 = {'A','L',0};
 331 static const WCHAR SDDL_OBJECT_AUDIT[]          = {'O','U',0};
 332 static const WCHAR SDDL_OBJECT_ALARMp[]         = {'O','L',0};
 333
 334 /*
 335  * ACE flags
 336  */
 337 static const WCHAR SDDL_CONTAINER_INHERIT[]  = {'C','I',0};
 338 static const WCHAR SDDL_OBJECT_INHERIT[]     = {'O','I',0};
 339 static const WCHAR SDDL_NO_PROPAGATE[]       = {'N','P',0};
 340 static const WCHAR SDDL_INHERIT_ONLY[]       = {'I','O',0};
 341 static const WCHAR SDDL_INHERITED[]          = {'I','D',0};
 342 static const WCHAR SDDL_AUDIT_SUCCESS[]      = {'S','A',0};
 343 static const WCHAR SDDL_AUDIT_FAILURE[]      = {'F','A',0};
 344
 345 const char * debugstr_sid(PSID sid)
 346 {
 347     int auth = 0;
 348     SID * psid = sid;
 349
 350     if (psid == NULL)
 351         return "(null)";
 352
 353     auth = psid->IdentifierAuthority.Value[5] +
 354            (psid->IdentifierAuthority.Value[4] << 8) +
 355            (psid->IdentifierAuthority.Value[3] << 16) +
 356            (psid->IdentifierAuthority.Value[2] << 24);
 357
 358     switch (psid->SubAuthorityCount) {
 359     case 0:
 360         return wine_dbg_sprintf("S-%d-%d", psid->Revision, auth);
 361     case 1:
 362         return wine_dbg_sprintf("S-%d-%d-%u", psid->Revision, auth,
 363             psid->SubAuthority[0]);
 364     case 2:
 365         return wine_dbg_sprintf("S-%d-%d-%u-%u", psid->Revision, auth,
 366             psid->SubAuthority[0], psid->SubAuthority[1]);
 367     case 3:
 368         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u", psid->Revision, auth,
 369             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2]);
 370     case 4:
 371         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u", psid->Revision, auth,
 372             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 373             psid->SubAuthority[3]);
 374     case 5:
 375         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u", psid->Revision, auth,
 376             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 377             psid->SubAuthority[3], psid->SubAuthority[4]);
 378     case 6:
 379         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 380             psid->SubAuthority[3], psid->SubAuthority[1], psid->SubAuthority[2],
 381             psid->SubAuthority[0], psid->SubAuthority[4], psid->SubAuthority[5]);
 382     case 7:
 383         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 384             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 385             psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
 386             psid->SubAuthority[6]);
 387     case 8:
 388         return wine_dbg_sprintf("S-%d-%d-%u-%u-%u-%u-%u-%u-%u-%u", psid->Revision, auth,
 389             psid->SubAuthority[0], psid->SubAuthority[1], psid->SubAuthority[2],
 390             psid->SubAuthority[3], psid->SubAuthority[4], psid->SubAuthority[5],
 391             psid->SubAuthority[6], psid->SubAuthority[7]);
 392     }
 393     return "(too-big)";
 394 }
 395
 396 /* set last error code from NT status and get the proper boolean return value */
 397 /* used for functions that are a simple wrapper around the corresponding ntdll API */
 398 static inline BOOL set_ntstatus( NTSTATUS status )
 399 {
 400     if (status) SetLastError( RtlNtStatusToDosError( status ));
 401     return !status;
 402 }
 403
 404 #define WINE_SIZE_OF_WORLD_ACCESS_ACL   (sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD))
 405
 406 static void GetWorldAccessACL(PACL pACL)
 407 {
 408     PACCESS_ALLOWED_ACE pACE = (PACCESS_ALLOWED_ACE) (pACL + 1);
 409
 410     pACL->AclRevision = ACL_REVISION;
 411     pACL->Sbz1 = 0;
 412     pACL->AclSize = WINE_SIZE_OF_WORLD_ACCESS_ACL;
 413     pACL->AceCount = 1;
 414     pACL->Sbz2 = 0;
 415
 416     pACE->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
 417     pACE->Header.AceFlags = CONTAINER_INHERIT_ACE;
 418     pACE->Header.AceSize = sizeof(ACCESS_ALLOWED_ACE) + sizeof(sidWorld) - sizeof(DWORD);
 419     pACE->Mask = 0xf3ffffff; /* Everything except reserved bits */
 420     memcpy(&pACE->SidStart, &sidWorld, sizeof(sidWorld));
 421 }
 422
 423 /************************************************************
 424  *                ADVAPI_IsLocalComputer
 425  *
 426  * Checks whether the server name indicates local machine.
 427  */
 428 BOOL ADVAPI_IsLocalComputer(LPCWSTR ServerName)
 429 {
 430     DWORD dwSize = MAX_COMPUTERNAME_LENGTH + 1;
 431     BOOL Result;
 432     LPWSTR buf;
 433
 434     if (!ServerName || !ServerName[0])
 435         return TRUE;
 436
 437     buf = HeapAlloc(GetProcessHeap(), 0, dwSize * sizeof(WCHAR));
 438     Result = GetComputerNameW(buf,  &dwSize);
 439     if (Result && (ServerName[0] == '\\') && (ServerName[1] == '\\'))
 440         ServerName += 2;
 441     Result = Result && !lstrcmpW(ServerName, buf);
 442     HeapFree(GetProcessHeap(), 0, buf);
 443
 444     return Result;
 445 }
 446
 447 /************************************************************
 448  *                ADVAPI_GetComputerSid
 449  */
 450 BOOL ADVAPI_GetComputerSid(PSID sid)
 451 {
 452     static const struct /* same fields as struct SID */
 453     {
 454         BYTE Revision;
 455         BYTE SubAuthorityCount;
 456         SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
 457         DWORD SubAuthority[4];
 458     } computer_sid =
 459     { SID_REVISION, 4, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0 } };
 460
 461     memcpy( sid, &computer_sid, sizeof(computer_sid) );
 462     return TRUE;
 463 }
 464
 465 /*      ##############################
 466         ######  TOKEN FUNCTIONS ######
 467         ##############################
 468 */
 469
 470 /******************************************************************************
 471  * OpenProcessToken                     [ADVAPI32.@]
 472  * Opens the access token associated with a process handle.
 473  *
 474  * PARAMS
 475  *   ProcessHandle [I] Handle to process
 476  *   DesiredAccess [I] Desired access to process
 477  *   TokenHandle   [O] Pointer to handle of open access token
 478  *
 479  * RETURNS
 480  *  Success: TRUE. TokenHandle contains the access token.
 481  *  Failure: FALSE.
 482  *
 483  * NOTES
 484  *  See NtOpenProcessToken.
 485  */
 486 BOOL WINAPI
 487 OpenProcessToken( HANDLE ProcessHandle, DWORD DesiredAccess,
 488                   HANDLE *TokenHandle )
 489 {
 490         return set_ntstatus(NtOpenProcessToken( ProcessHandle, DesiredAccess, TokenHandle ));
 491 }
 492
 493 /******************************************************************************
 494  * OpenThreadToken [ADVAPI32.@]
 495  *
 496  * Opens the access token associated with a thread handle.
 497  *
 498  * PARAMS
 499  *   ThreadHandle  [I] Handle to process
 500  *   DesiredAccess [I] Desired access to the thread
 501  *   OpenAsSelf    [I] ???
 502  *   TokenHandle   [O] Destination for the token handle
 503  *
 504  * RETURNS
 505  *  Success: TRUE. TokenHandle contains the access token.
 506  *  Failure: FALSE.
 507  *
 508  * NOTES
 509  *  See NtOpenThreadToken.
 510  */
 511 BOOL WINAPI
 512 OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess,
 513                  BOOL OpenAsSelf, HANDLE *TokenHandle)
 514 {
 515         return set_ntstatus( NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle));
 516 }
 517
 518 BOOL WINAPI
 519 AdjustTokenGroups( HANDLE TokenHandle, BOOL ResetToDefault, PTOKEN_GROUPS NewState,
 520                    DWORD BufferLength, PTOKEN_GROUPS PreviousState, PDWORD ReturnLength )
 521 {
 522     return set_ntstatus( NtAdjustGroupsToken(TokenHandle, ResetToDefault, NewState, BufferLength,
 523                                              PreviousState, ReturnLength));
 524 }
 525
 526 /******************************************************************************
 527  * AdjustTokenPrivileges [ADVAPI32.@]
 528  *
 529  * Adjust the privileges of an open token handle.
 530  *
 531  * PARAMS
 532  *  TokenHandle          [I]   Handle from OpenProcessToken() or OpenThreadToken()
 533  *  DisableAllPrivileges [I]   TRUE=Remove all privileges, FALSE=Use NewState
 534  *  NewState             [I]   Desired new privileges of the token
 535  *  BufferLength         [I]   Length of NewState
 536  *  PreviousState        [O]   Destination for the previous state
 537  *  ReturnLength         [I/O] Size of PreviousState
 538  *
 539  *
 540  * RETURNS
 541  *  Success: TRUE. Privileges are set to NewState and PreviousState is updated.
 542  *  Failure: FALSE.
 543  *
 544  * NOTES
 545  *  See NtAdjustPrivilegesToken.
 546  */
 547 BOOL WINAPI
 548 AdjustTokenPrivileges( HANDLE TokenHandle, BOOL DisableAllPrivileges,
 549                        PTOKEN_PRIVILEGES NewState, DWORD BufferLength,
 550                        PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength )
 551 {
 552     NTSTATUS status;
 553
 554     TRACE("\n");
 555
 556     status = NtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges,
 557                                                      NewState, BufferLength, PreviousState,
 558                                                      ReturnLength);
 559     SetLastError( RtlNtStatusToDosError( status ));
 560     if ((status == STATUS_SUCCESS) || (status == STATUS_NOT_ALL_ASSIGNED))
 561         return TRUE;
 562     else
 563         return FALSE;
 564 }
 565
 566 /******************************************************************************
 567  * CheckTokenMembership [ADVAPI32.@]
 568  *
 569  * Determine if an access token is a member of a SID.
 570  *
 571  * PARAMS
 572  *   TokenHandle [I] Handle from OpenProcessToken() or OpenThreadToken()
 573  *   SidToCheck  [I] SID that possibly contains the token
 574  *   IsMember    [O] Destination for result.
 575  *
 576  * RETURNS
 577  *  Success: TRUE. IsMember is TRUE if TokenHandle is a member, FALSE otherwise.
 578  *  Failure: FALSE.
 579  */
 580 BOOL WINAPI
 581 CheckTokenMembership( HANDLE token, PSID sid_to_check,
 582                       PBOOL is_member )
 583 {
 584     PTOKEN_GROUPS token_groups = NULL;
 585     HANDLE thread_token = NULL;
 586     DWORD size, i;
 587     BOOL ret;
 588
 589     TRACE("(%p %s %p)\n", token, debugstr_sid(sid_to_check), is_member);
 590
 591     *is_member = FALSE;
 592
 593     if (!token)
 594     {
 595         if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &thread_token))
 596         {
 597             HANDLE process_token;
 598             ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE, &process_token);
 599             if (!ret)
 600                 goto exit;
 601             ret = DuplicateTokenEx(process_token, TOKEN_QUERY,
 602                 NULL, SecurityImpersonation, TokenImpersonation,
 603                 &thread_token);
 604             CloseHandle(process_token);
 605             if (!ret)
 606                 goto exit;
 607         }
 608         token = thread_token;
 609     }
 610     else
 611     {
 612         TOKEN_TYPE type;
 613
 614         ret = GetTokenInformation(token, TokenType, &type, sizeof(TOKEN_TYPE), &size);
 615         if (!ret) goto exit;
 616
 617         if (type == TokenPrimary)
 618         {
 619             SetLastError(ERROR_NO_IMPERSONATION_TOKEN);
 620             return FALSE;
 621         }
 622     }
 623
 624     ret = GetTokenInformation(token, TokenGroups, NULL, 0, &size);
 625     if (!ret && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
 626         goto exit;
 627
 628     token_groups = HeapAlloc(GetProcessHeap(), 0, size);
 629     if (!token_groups)
 630     {
 631         ret = FALSE;
 632         goto exit;
 633     }
 634
 635     ret = GetTokenInformation(token, TokenGroups, token_groups, size, &size);
 636     if (!ret)
 637         goto exit;
 638
 639     for (i = 0; i < token_groups->GroupCount; i++)
 640     {
 641         TRACE("Groups[%d]: {0x%x, %s}\n", i,
 642             token_groups->Groups[i].Attributes,
 643             debugstr_sid(token_groups->Groups[i].Sid));
 644         if ((token_groups->Groups[i].Attributes & SE_GROUP_ENABLED) &&
 645             EqualSid(sid_to_check, token_groups->Groups[i].Sid))
 646         {
 647             *is_member = TRUE;
 648             TRACE("sid enabled and found in token\n");
 649             break;
 650         }
 651     }
 652
 653 exit:
 654     HeapFree(GetProcessHeap(), 0, token_groups);
 655     if (thread_token != NULL) CloseHandle(thread_token);
 656
 657     return ret;
 658 }
 659
 660 /******************************************************************************
 661  * GetTokenInformation [ADVAPI32.@]
 662  *
 663  * Get a type of information about an access token.
 664  *
 665  * PARAMS
 666  *   token           [I] Handle from OpenProcessToken() or OpenThreadToken()
 667  *   tokeninfoclass  [I] A TOKEN_INFORMATION_CLASS from "winnt.h"
 668  *   tokeninfo       [O] Destination for token information
 669  *   tokeninfolength [I] Length of tokeninfo
 670  *   retlen          [O] Destination for returned token information length
 671  *
 672  * RETURNS
 673  *  Success: TRUE. tokeninfo contains retlen bytes of token information
 674  *  Failure: FALSE.
 675  *
 676  * NOTES
 677  *  See NtQueryInformationToken.
 678  */
 679 BOOL WINAPI
 680 GetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
 681                      LPVOID tokeninfo, DWORD tokeninfolength, LPDWORD retlen )
 682 {
 683     TRACE("(%p, %s, %p, %d, %p):\n",
 684           token,
 685           (tokeninfoclass == TokenUser) ? "TokenUser" :
 686           (tokeninfoclass == TokenGroups) ? "TokenGroups" :
 687           (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" :
 688           (tokeninfoclass == TokenOwner) ? "TokenOwner" :
 689           (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" :
 690           (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" :
 691           (tokeninfoclass == TokenSource) ? "TokenSource" :
 692           (tokeninfoclass == TokenType) ? "TokenType" :
 693           (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" :
 694           (tokeninfoclass == TokenStatistics) ? "TokenStatistics" :
 695           (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" :
 696           (tokeninfoclass == TokenSessionId) ? "TokenSessionId" :
 697           (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" :
 698           (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" :
 699           (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" :
 700           "Unknown",
 701           tokeninfo, tokeninfolength, retlen);
 702     return set_ntstatus( NtQueryInformationToken( token, tokeninfoclass, tokeninfo,
 703                                                   tokeninfolength, retlen));
 704 }
 705
 706 /******************************************************************************
 707  * SetTokenInformation [ADVAPI32.@]
 708  *
 709  * Set information for an access token.
 710  *
 711  * PARAMS
 712  *   token           [I] Handle from OpenProcessToken() or OpenThreadToken()
 713  *   tokeninfoclass  [I] A TOKEN_INFORMATION_CLASS from "winnt.h"
 714  *   tokeninfo       [I] Token information to set
 715  *   tokeninfolength [I] Length of tokeninfo
 716  *
 717  * RETURNS
 718  *  Success: TRUE. The information for the token is set to tokeninfo.
 719  *  Failure: FALSE.
 720  */
 721 BOOL WINAPI
 722 SetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
 723                      LPVOID tokeninfo, DWORD tokeninfolength )
 724 {
 725     TRACE("(%p, %s, %p, %d): stub\n",
 726           token,
 727           (tokeninfoclass == TokenUser) ? "TokenUser" :
 728           (tokeninfoclass == TokenGroups) ? "TokenGroups" :
 729           (tokeninfoclass == TokenPrivileges) ? "TokenPrivileges" :
 730           (tokeninfoclass == TokenOwner) ? "TokenOwner" :
 731           (tokeninfoclass == TokenPrimaryGroup) ? "TokenPrimaryGroup" :
 732           (tokeninfoclass == TokenDefaultDacl) ? "TokenDefaultDacl" :
 733           (tokeninfoclass == TokenSource) ? "TokenSource" :
 734           (tokeninfoclass == TokenType) ? "TokenType" :
 735           (tokeninfoclass == TokenImpersonationLevel) ? "TokenImpersonationLevel" :
 736           (tokeninfoclass == TokenStatistics) ? "TokenStatistics" :
 737           (tokeninfoclass == TokenRestrictedSids) ? "TokenRestrictedSids" :
 738           (tokeninfoclass == TokenSessionId) ? "TokenSessionId" :
 739           (tokeninfoclass == TokenGroupsAndPrivileges) ? "TokenGroupsAndPrivileges" :
 740           (tokeninfoclass == TokenSessionReference) ? "TokenSessionReference" :
 741           (tokeninfoclass == TokenSandBoxInert) ? "TokenSandBoxInert" :
 742           "Unknown",
 743           tokeninfo, tokeninfolength);
 744
 745     return set_ntstatus( NtSetInformationToken( token, tokeninfoclass, tokeninfo, tokeninfolength ));
 746 }
 747
 748 /*************************************************************************
 749  * SetThreadToken [ADVAPI32.@]
 750  *
 751  * Assigns an 'impersonation token' to a thread so it can assume the
 752  * security privileges of another thread or process.  Can also remove
 753  * a previously assigned token.
 754  *
 755  * PARAMS
 756  *   thread          [O] Handle to thread to set the token for
 757  *   token           [I] Token to set
 758  *
 759  * RETURNS
 760  *  Success: TRUE. The threads access token is set to token
 761  *  Failure: FALSE.
 762  *
 763  * NOTES
 764  *  Only supported on NT or higher. On Win9X this function does nothing.
 765  *  See SetTokenInformation.
 766  */
 767 BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token)
 768 {
 769     return set_ntstatus( NtSetInformationThread( thread ? *thread : GetCurrentThread(),
 770                                                  ThreadImpersonationToken, &token, sizeof token ));
 771 }
 772
 773 /*************************************************************************
 774  * CreateRestrictedToken [ADVAPI32.@]
 775  *
 776  * Create a new more restricted token from an existing token.
 777  *
 778  * PARAMS
 779  *   baseToken       [I] Token to base the new restricted token on
 780  *   flags           [I] Options
 781  *   nDisableSids    [I] Length of disableSids array
 782  *   disableSids     [I] Array of SIDs to disable in the new token
 783  *   nDeletePrivs    [I] Length of deletePrivs array
 784  *   deletePrivs     [I] Array of privileges to delete in the new token
 785  *   nRestrictSids   [I] Length of restrictSids array
 786  *   restrictSids    [I] Array of SIDs to restrict in the new token
 787  *   newToken        [O] Address where the new token is stored
 788  *
 789  * RETURNS
 790  *  Success: TRUE
 791  *  Failure: FALSE
 792  */
 793 BOOL WINAPI CreateRestrictedToken(
 794     HANDLE baseToken,
 795     DWORD flags,
 796     DWORD nDisableSids,
 797     PSID_AND_ATTRIBUTES disableSids,
 798     DWORD nDeletePrivs,
 799     PLUID_AND_ATTRIBUTES deletePrivs,
 800     DWORD nRestrictSids,
 801     PSID_AND_ATTRIBUTES restrictSids,
 802     PHANDLE newToken)
 803 {
 804     FIXME("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p): stub\n",
 805           baseToken, flags, nDisableSids, disableSids,
 806           nDeletePrivs, deletePrivs,
 807           nRestrictSids, restrictSids,
 808           newToken);
 809     SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
 810     return FALSE;
 811 }
 812
 813 /*      ##############################
 814         ######  SID FUNCTIONS   ######
 815         ##############################
 816 */
 817
 818 /******************************************************************************
 819  * AllocateAndInitializeSid [ADVAPI32.@]
 820  *
 821  * PARAMS
 822  *   pIdentifierAuthority []
 823  *   nSubAuthorityCount   []
 824  *   nSubAuthority0       []
 825  *   nSubAuthority1       []
 826  *   nSubAuthority2       []
 827  *   nSubAuthority3       []
 828  *   nSubAuthority4       []
 829  *   nSubAuthority5       []
 830  *   nSubAuthority6       []
 831  *   nSubAuthority7       []
 832  *   pSid                 []
 833  */
 834 BOOL WINAPI
 835 AllocateAndInitializeSid( PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
 836                           BYTE nSubAuthorityCount,
 837                           DWORD nSubAuthority0, DWORD nSubAuthority1,
 838                           DWORD nSubAuthority2, DWORD nSubAuthority3,
 839                           DWORD nSubAuthority4, DWORD nSubAuthority5,
 840                           DWORD nSubAuthority6, DWORD nSubAuthority7,
 841                           PSID *pSid )
 842 {
 843     return set_ntstatus( RtlAllocateAndInitializeSid(
 844                              pIdentifierAuthority, nSubAuthorityCount,
 845                              nSubAuthority0, nSubAuthority1, nSubAuthority2, nSubAuthority3,
 846                              nSubAuthority4, nSubAuthority5, nSubAuthority6, nSubAuthority7,
 847                              pSid ));
 848 }
 849
 850 /******************************************************************************
 851  * FreeSid [ADVAPI32.@]
 852  *
 853  * PARAMS
 854  *   pSid []
 855  */
 856 PVOID WINAPI
 857 FreeSid( PSID pSid )
 858 {
 859         RtlFreeSid(pSid);
 860         return NULL; /* is documented like this */
 861 }
 862
 863 /******************************************************************************
 864  * CopySid [ADVAPI32.@]
 865  *
 866  * PARAMS
 867  *   nDestinationSidLength []
 868  *   pDestinationSid       []
 869  *   pSourceSid            []
 870  */
 871 BOOL WINAPI
 872 CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid )
 873 {
 874         return RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid);
 875 }
 876
 877 /******************************************************************************
 878  * CreateWellKnownSid [ADVAPI32.@]
 879  */
 880 BOOL WINAPI
 881 CreateWellKnownSid( WELL_KNOWN_SID_TYPE WellKnownSidType,
 882                     PSID DomainSid,
 883                     PSID pSid,
 884                     DWORD* cbSid)
 885 {
 886     unsigned int i;
 887     TRACE("(%d, %s, %p, %p)\n", WellKnownSidType, debugstr_sid(DomainSid), pSid, cbSid);
 888
 889     if (cbSid == NULL || (DomainSid && !IsValidSid(DomainSid)))
 890     {
 891         SetLastError(ERROR_INVALID_PARAMETER);
 892         return FALSE;
 893     }
 894
 895     for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++) {
 896         if (WellKnownSids[i].Type == WellKnownSidType) {
 897             DWORD length = GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
 898
 899             if (*cbSid < length)
 900             {
 901                 *cbSid = length;
 902                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
 903                 return FALSE;
 904             }
 905             if (!pSid)
 906             {
 907                 SetLastError(ERROR_INVALID_PARAMETER);
 908                 return FALSE;
 909             }
 910             CopyMemory(pSid, &WellKnownSids[i].Sid.Revision, length);
 911             *cbSid = length;
 912             return TRUE;
 913         }
 914     }
 915
 916     if (DomainSid == NULL || *GetSidSubAuthorityCount(DomainSid) == SID_MAX_SUB_AUTHORITIES)
 917     {
 918         SetLastError(ERROR_INVALID_PARAMETER);
 919         return FALSE;
 920     }
 921
 922     for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
 923         if (WellKnownRids[i].Type == WellKnownSidType) {
 924             UCHAR domain_subauth = *GetSidSubAuthorityCount(DomainSid);
 925             DWORD domain_sid_length = GetSidLengthRequired(domain_subauth);
 926             DWORD output_sid_length = GetSidLengthRequired(domain_subauth + 1);
 927
 928             if (*cbSid < output_sid_length)
 929             {
 930                 *cbSid = output_sid_length;
 931                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
 932                 return FALSE;
 933             }
 934             if (!pSid)
 935             {
 936                 SetLastError(ERROR_INVALID_PARAMETER);
 937                 return FALSE;
 938             }
 939             CopyMemory(pSid, DomainSid, domain_sid_length);
 940             (*GetSidSubAuthorityCount(pSid))++;
 941             (*GetSidSubAuthority(pSid, domain_subauth)) = WellKnownRids[i].Rid;
 942             *cbSid = output_sid_length;
 943             return TRUE;
 944         }
 945
 946     SetLastError(ERROR_INVALID_PARAMETER);
 947     return FALSE;
 948 }
 949
 950 /******************************************************************************
 951  * IsWellKnownSid [ADVAPI32.@]
 952  */
 953 BOOL WINAPI
 954 IsWellKnownSid( PSID pSid, WELL_KNOWN_SID_TYPE WellKnownSidType )
 955 {
 956     unsigned int i;
 957     TRACE("(%s, %d)\n", debugstr_sid(pSid), WellKnownSidType);
 958
 959     for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
 960         if (WellKnownSids[i].Type == WellKnownSidType)
 961             if (EqualSid(pSid, (PSID)&(WellKnownSids[i].Sid.Revision)))
 962                 return TRUE;
 963
 964     return FALSE;
 965 }
 966
 967 BOOL WINAPI
 968 IsTokenRestricted( HANDLE TokenHandle )
 969 {
 970     TOKEN_GROUPS *groups;
 971     DWORD size;
 972     NTSTATUS status;
 973     BOOL restricted;
 974
 975     TRACE("(%p)\n", TokenHandle);
 976
 977     status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, NULL, 0, &size);
 978     if (status != STATUS_BUFFER_TOO_SMALL)
 979         return FALSE;
 980
 981     groups = HeapAlloc(GetProcessHeap(), 0, size);
 982     if (!groups)
 983     {
 984         SetLastError(ERROR_OUTOFMEMORY);
 985         return FALSE;
 986     }
 987
 988     status = NtQueryInformationToken(TokenHandle, TokenRestrictedSids, groups, size, &size);
 989     if (status != STATUS_SUCCESS)
 990     {
 991         HeapFree(GetProcessHeap(), 0, groups);
 992         return set_ntstatus(status);
 993     }
 994
 995     if (groups->GroupCount)
 996         restricted = TRUE;
 997     else
 998         restricted = FALSE;
 999
1000     HeapFree(GetProcessHeap(), 0, groups);
1001
1002     return restricted;
1003 }
1004
1005 /******************************************************************************
1006  * IsValidSid [ADVAPI32.@]
1007  *
1008  * PARAMS
1009  *   pSid []
1010  */
1011 BOOL WINAPI
1012 IsValidSid( PSID pSid )
1013 {
1014         return RtlValidSid( pSid );
1015 }
1016
1017 /******************************************************************************
1018  * EqualSid [ADVAPI32.@]
1019  *
1020  * PARAMS
1021  *   pSid1 []
1022  *   pSid2 []
1023  */
1024 BOOL WINAPI
1025 EqualSid( PSID pSid1, PSID pSid2 )
1026 {
1027         BOOL ret = RtlEqualSid( pSid1, pSid2 );
1028         SetLastError(ERROR_SUCCESS);
1029         return ret;
1030 }
1031
1032 /******************************************************************************
1033  * EqualPrefixSid [ADVAPI32.@]
1034  */
1035 BOOL WINAPI EqualPrefixSid (PSID pSid1, PSID pSid2)
1036 {
1037         return RtlEqualPrefixSid(pSid1, pSid2);
1038 }
1039
1040 /******************************************************************************
1041  * GetSidLengthRequired [ADVAPI32.@]
1042  *
1043  * PARAMS
1044  *   nSubAuthorityCount []
1045  */
1046 DWORD WINAPI
1047 GetSidLengthRequired( BYTE nSubAuthorityCount )
1048 {
1049         return RtlLengthRequiredSid(nSubAuthorityCount);
1050 }
1051
1052 /******************************************************************************
1053  * InitializeSid [ADVAPI32.@]
1054  *
1055  * PARAMS
1056  *   pIdentifierAuthority []
1057  */
1058 BOOL WINAPI
1059 InitializeSid (
1060         PSID pSid,
1061         PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
1062         BYTE nSubAuthorityCount)
1063 {
1064         return RtlInitializeSid(pSid, pIdentifierAuthority, nSubAuthorityCount);
1065 }
1066
1067 DWORD WINAPI
1068 GetEffectiveRightsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pAccessRights )
1069 {
1070     FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights);
1071
1072     *pAccessRights = STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL;
1073     return 0;
1074 }
1075
1076 DWORD WINAPI
1077 GetEffectiveRightsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pAccessRights )
1078 {
1079     FIXME("%p %p %p - stub\n", pacl, pTrustee, pAccessRights);
1080
1081     return 1;
1082 }
1083
1084 /******************************************************************************
1085  * GetSidIdentifierAuthority [ADVAPI32.@]
1086  *
1087  * PARAMS
1088  *   pSid []
1089  */
1090 PSID_IDENTIFIER_AUTHORITY WINAPI
1091 GetSidIdentifierAuthority( PSID pSid )
1092 {
1093         return RtlIdentifierAuthoritySid(pSid);
1094 }
1095
1096 /******************************************************************************
1097  * GetSidSubAuthority [ADVAPI32.@]
1098  *
1099  * PARAMS
1100  *   pSid          []
1101  *   nSubAuthority []
1102  */
1103 PDWORD WINAPI
1104 GetSidSubAuthority( PSID pSid, DWORD nSubAuthority )
1105 {
1106         SetLastError(ERROR_SUCCESS);
1107         return RtlSubAuthoritySid(pSid, nSubAuthority);
1108 }
1109
1110 /******************************************************************************
1111  * GetSidSubAuthorityCount [ADVAPI32.@]
1112  *
1113  * PARAMS
1114  *   pSid []
1115  */
1116 PUCHAR WINAPI
1117 GetSidSubAuthorityCount (PSID pSid)
1118 {
1119         SetLastError(ERROR_SUCCESS);
1120         return RtlSubAuthorityCountSid(pSid);
1121 }
1122
1123 /******************************************************************************
1124  * GetLengthSid [ADVAPI32.@]
1125  *
1126  * PARAMS
1127  *   pSid []
1128  */
1129 DWORD WINAPI
1130 GetLengthSid (PSID pSid)
1131 {
1132         return RtlLengthSid(pSid);
1133 }
1134
1135 /*      ##############################################
1136         ######  SECURITY DESCRIPTOR FUNCTIONS   ######
1137         ##############################################
1138 */
1139
1140  /******************************************************************************
1141  * BuildSecurityDescriptorA [ADVAPI32.@]
1142  *
1143  * Builds a SD from
1144  *
1145  * PARAMS
1146  *  pOwner                [I]
1147  *  pGroup                [I]
1148  *  cCountOfAccessEntries [I]
1149  *  pListOfAccessEntries  [I]
1150  *  cCountOfAuditEntries  [I]
1151  *  pListofAuditEntries   [I]
1152  *  pOldSD                [I]
1153  *  lpdwBufferLength      [I/O]
1154  *  pNewSD                [O]
1155  *
1156  * RETURNS
1157  *  Success: ERROR_SUCCESS
1158  *  Failure: nonzero error code from Winerror.h
1159  */
1160 DWORD WINAPI BuildSecurityDescriptorA(
1161     IN PTRUSTEEA pOwner,
1162     IN PTRUSTEEA pGroup,
1163     IN ULONG cCountOfAccessEntries,
1164     IN PEXPLICIT_ACCESSA pListOfAccessEntries,
1165     IN ULONG cCountOfAuditEntries,
1166     IN PEXPLICIT_ACCESSA pListofAuditEntries,
1167     IN PSECURITY_DESCRIPTOR pOldSD,
1168     IN OUT PULONG lpdwBufferLength,
1169     OUT PSECURITY_DESCRIPTOR* pNewSD)
1170 {
1171     FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup,
1172           cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries,
1173           pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD);
1174
1175     return ERROR_CALL_NOT_IMPLEMENTED;
1176 }
1177
1178 /******************************************************************************
1179  * BuildSecurityDescriptorW [ADVAPI32.@]
1180  *
1181  * See BuildSecurityDescriptorA.
1182  */
1183 DWORD WINAPI BuildSecurityDescriptorW(
1184     IN PTRUSTEEW pOwner,
1185     IN PTRUSTEEW pGroup,
1186     IN ULONG cCountOfAccessEntries,
1187     IN PEXPLICIT_ACCESSW pListOfAccessEntries,
1188     IN ULONG cCountOfAuditEntries,
1189     IN PEXPLICIT_ACCESSW pListofAuditEntries,
1190     IN PSECURITY_DESCRIPTOR pOldSD,
1191     IN OUT PULONG lpdwBufferLength,
1192     OUT PSECURITY_DESCRIPTOR* pNewSD)
1193 {
1194     FIXME("(%p,%p,%d,%p,%d,%p,%p,%p,%p) stub!\n",pOwner,pGroup,
1195           cCountOfAccessEntries,pListOfAccessEntries,cCountOfAuditEntries,
1196           pListofAuditEntries,pOldSD,lpdwBufferLength,pNewSD);
1197
1198     return ERROR_CALL_NOT_IMPLEMENTED;
1199 }
1200
1201 /******************************************************************************
1202  * InitializeSecurityDescriptor [ADVAPI32.@]
1203  *
1204  * PARAMS
1205  *   pDescr   []
1206  *   revision []
1207  */
1208 BOOL WINAPI
1209 InitializeSecurityDescriptor( PSECURITY_DESCRIPTOR pDescr, DWORD revision )
1210 {
1211         return set_ntstatus( RtlCreateSecurityDescriptor(pDescr, revision ));
1212 }
1213
1214
1215 /******************************************************************************
1216  * MakeAbsoluteSD [ADVAPI32.@]
1217  */
1218 BOOL WINAPI MakeAbsoluteSD (
1219         IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
1220         OUT PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
1221         OUT LPDWORD lpdwAbsoluteSecurityDescriptorSize,
1222         OUT PACL pDacl,
1223         OUT LPDWORD lpdwDaclSize,
1224         OUT PACL pSacl,
1225         OUT LPDWORD lpdwSaclSize,
1226         OUT PSID pOwner,
1227         OUT LPDWORD lpdwOwnerSize,
1228         OUT PSID pPrimaryGroup,
1229         OUT LPDWORD lpdwPrimaryGroupSize)
1230 {
1231     return set_ntstatus( RtlSelfRelativeToAbsoluteSD(pSelfRelativeSecurityDescriptor,
1232                                                      pAbsoluteSecurityDescriptor,
1233                                                      lpdwAbsoluteSecurityDescriptorSize,
1234                                                      pDacl, lpdwDaclSize, pSacl, lpdwSaclSize,
1235                                                      pOwner, lpdwOwnerSize,
1236                                                      pPrimaryGroup, lpdwPrimaryGroupSize));
1237 }
1238
1239 /******************************************************************************
1240  * GetKernelObjectSecurity [ADVAPI32.@]
1241  */
1242 BOOL WINAPI GetKernelObjectSecurity(
1243         HANDLE Handle,
1244         SECURITY_INFORMATION RequestedInformation,
1245         PSECURITY_DESCRIPTOR pSecurityDescriptor,
1246         DWORD nLength,
1247         LPDWORD lpnLengthNeeded )
1248 {
1249     TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", Handle, RequestedInformation,
1250           pSecurityDescriptor, nLength, lpnLengthNeeded);
1251
1252     return set_ntstatus( NtQuerySecurityObject(Handle, RequestedInformation, pSecurityDescriptor,
1253                                                nLength, lpnLengthNeeded ));
1254 }
1255
1256 /******************************************************************************
1257  * GetPrivateObjectSecurity [ADVAPI32.@]
1258  */
1259 BOOL WINAPI GetPrivateObjectSecurity(
1260         PSECURITY_DESCRIPTOR ObjectDescriptor,
1261         SECURITY_INFORMATION SecurityInformation,
1262         PSECURITY_DESCRIPTOR ResultantDescriptor,
1263         DWORD DescriptorLength,
1264         PDWORD ReturnLength )
1265 {
1266     SECURITY_DESCRIPTOR desc;
1267     BOOL defaulted, present;
1268     PACL pacl;
1269     PSID psid;
1270
1271     TRACE("(%p,0x%08x,%p,0x%08x,%p)\n", ObjectDescriptor, SecurityInformation,
1272           ResultantDescriptor, DescriptorLength, ReturnLength);
1273
1274     if (!InitializeSecurityDescriptor(&desc, SECURITY_DESCRIPTOR_REVISION))
1275         return FALSE;
1276
1277     if (SecurityInformation & OWNER_SECURITY_INFORMATION)
1278     {
1279         if (!GetSecurityDescriptorOwner(ObjectDescriptor, &psid, &defaulted))
1280             return FALSE;
1281         SetSecurityDescriptorOwner(&desc, psid, defaulted);
1282     }
1283
1284     if (SecurityInformation & GROUP_SECURITY_INFORMATION)
1285     {
1286         if (!GetSecurityDescriptorGroup(ObjectDescriptor, &psid, &defaulted))
1287             return FALSE;
1288         SetSecurityDescriptorGroup(&desc, psid, defaulted);
1289     }
1290
1291     if (SecurityInformation & DACL_SECURITY_INFORMATION)
1292     {
1293         if (!GetSecurityDescriptorDacl(ObjectDescriptor, &present, &pacl, &defaulted))
1294             return FALSE;
1295         SetSecurityDescriptorDacl(&desc, present, pacl, defaulted);
1296     }
1297
1298     if (SecurityInformation & SACL_SECURITY_INFORMATION)
1299     {
1300         if (!GetSecurityDescriptorSacl(ObjectDescriptor, &present, &pacl, &defaulted))
1301             return FALSE;
1302         SetSecurityDescriptorSacl(&desc, present, pacl, defaulted);
1303     }
1304
1305     *ReturnLength = DescriptorLength;
1306     return MakeSelfRelativeSD(&desc, ResultantDescriptor, ReturnLength);
1307 }
1308
1309 /******************************************************************************
1310  * GetSecurityDescriptorLength [ADVAPI32.@]
1311  */
1312 DWORD WINAPI GetSecurityDescriptorLength( PSECURITY_DESCRIPTOR pDescr)
1313 {
1314         return RtlLengthSecurityDescriptor(pDescr);
1315 }
1316
1317 /******************************************************************************
1318  * GetSecurityDescriptorOwner [ADVAPI32.@]
1319  *
1320  * PARAMS
1321  *   pOwner            []
1322  *   lpbOwnerDefaulted []
1323  */
1324 BOOL WINAPI
1325 GetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pDescr, PSID *pOwner,
1326                             LPBOOL lpbOwnerDefaulted )
1327 {
1328     BOOLEAN defaulted;
1329     BOOL ret = set_ntstatus( RtlGetOwnerSecurityDescriptor( pDescr, pOwner, &defaulted ));
1330     *lpbOwnerDefaulted = defaulted;
1331     return ret;
1332 }
1333
1334 /******************************************************************************
1335  * SetSecurityDescriptorOwner [ADVAPI32.@]
1336  *
1337  * PARAMS
1338  */
1339 BOOL WINAPI SetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1340                                    PSID pOwner, BOOL bOwnerDefaulted)
1341 {
1342     return set_ntstatus( RtlSetOwnerSecurityDescriptor(pSecurityDescriptor, pOwner, bOwnerDefaulted));
1343 }
1344 /******************************************************************************
1345  * GetSecurityDescriptorGroup                   [ADVAPI32.@]
1346  */
1347 BOOL WINAPI GetSecurityDescriptorGroup(
1348         PSECURITY_DESCRIPTOR SecurityDescriptor,
1349         PSID *Group,
1350         LPBOOL GroupDefaulted)
1351 {
1352     BOOLEAN defaulted;
1353     BOOL ret = set_ntstatus( RtlGetGroupSecurityDescriptor(SecurityDescriptor, Group, &defaulted ));
1354     *GroupDefaulted = defaulted;
1355     return ret;
1356 }
1357 /******************************************************************************
1358  * SetSecurityDescriptorGroup [ADVAPI32.@]
1359  */
1360 BOOL WINAPI SetSecurityDescriptorGroup ( PSECURITY_DESCRIPTOR SecurityDescriptor,
1361                                            PSID Group, BOOL GroupDefaulted)
1362 {
1363     return set_ntstatus( RtlSetGroupSecurityDescriptor( SecurityDescriptor, Group, GroupDefaulted));
1364 }
1365
1366 /******************************************************************************
1367  * IsValidSecurityDescriptor [ADVAPI32.@]
1368  *
1369  * PARAMS
1370  *   lpsecdesc []
1371  */
1372 BOOL WINAPI
1373 IsValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor )
1374 {
1375     return set_ntstatus( RtlValidSecurityDescriptor(SecurityDescriptor));
1376 }
1377
1378 /******************************************************************************
1379  *  GetSecurityDescriptorDacl                   [ADVAPI32.@]
1380  */
1381 BOOL WINAPI GetSecurityDescriptorDacl(
1382         IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
1383         OUT LPBOOL lpbDaclPresent,
1384         OUT PACL *pDacl,
1385         OUT LPBOOL lpbDaclDefaulted)
1386 {
1387     BOOLEAN present, defaulted;
1388     BOOL ret = set_ntstatus( RtlGetDaclSecurityDescriptor(pSecurityDescriptor, &present, pDacl, &defaulted));
1389     *lpbDaclPresent = present;
1390     *lpbDaclDefaulted = defaulted;
1391     return ret;
1392 }
1393
1394 /******************************************************************************
1395  *  SetSecurityDescriptorDacl                   [ADVAPI32.@]
1396  */
1397 BOOL WINAPI
1398 SetSecurityDescriptorDacl (
1399         PSECURITY_DESCRIPTOR lpsd,
1400         BOOL daclpresent,
1401         PACL dacl,
1402         BOOL dacldefaulted )
1403 {
1404     return set_ntstatus( RtlSetDaclSecurityDescriptor (lpsd, daclpresent, dacl, dacldefaulted ) );
1405 }
1406 /******************************************************************************
1407  *  GetSecurityDescriptorSacl                   [ADVAPI32.@]
1408  */
1409 BOOL WINAPI GetSecurityDescriptorSacl(
1410         IN PSECURITY_DESCRIPTOR lpsd,
1411         OUT LPBOOL lpbSaclPresent,
1412         OUT PACL *pSacl,
1413         OUT LPBOOL lpbSaclDefaulted)
1414 {
1415     BOOLEAN present, defaulted;
1416     BOOL ret = set_ntstatus( RtlGetSaclSecurityDescriptor(lpsd, &present, pSacl, &defaulted) );
1417     *lpbSaclPresent = present;
1418     *lpbSaclDefaulted = defaulted;
1419     return ret;
1420 }
1421
1422 /**************************************************************************
1423  * SetSecurityDescriptorSacl                    [ADVAPI32.@]
1424  */
1425 BOOL WINAPI SetSecurityDescriptorSacl (
1426         PSECURITY_DESCRIPTOR lpsd,
1427         BOOL saclpresent,
1428         PACL lpsacl,
1429         BOOL sacldefaulted)
1430 {
1431     return set_ntstatus (RtlSetSaclSecurityDescriptor(lpsd, saclpresent, lpsacl, sacldefaulted));
1432 }
1433 /******************************************************************************
1434  * MakeSelfRelativeSD [ADVAPI32.@]
1435  *
1436  * PARAMS
1437  *   lpabssecdesc  []
1438  *   lpselfsecdesc []
1439  *   lpbuflen      []
1440  */
1441 BOOL WINAPI
1442 MakeSelfRelativeSD(
1443         IN PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
1444         IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
1445         IN OUT LPDWORD lpdwBufferLength)
1446 {
1447     return set_ntstatus( RtlMakeSelfRelativeSD( pAbsoluteSecurityDescriptor,
1448                                                 pSelfRelativeSecurityDescriptor, lpdwBufferLength));
1449 }
1450
1451 /******************************************************************************
1452  * GetSecurityDescriptorControl                 [ADVAPI32.@]
1453  */
1454
1455 BOOL WINAPI GetSecurityDescriptorControl ( PSECURITY_DESCRIPTOR  pSecurityDescriptor,
1456                  PSECURITY_DESCRIPTOR_CONTROL pControl, LPDWORD lpdwRevision)
1457 {
1458     return set_ntstatus( RtlGetControlSecurityDescriptor(pSecurityDescriptor,pControl,lpdwRevision));
1459 }
1460
1461 /******************************************************************************
1462  * SetSecurityDescriptorControl                 [ADVAPI32.@]
1463  */
1464 BOOL WINAPI SetSecurityDescriptorControl( PSECURITY_DESCRIPTOR pSecurityDescriptor,
1465   SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest,
1466   SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet )
1467 {
1468     return set_ntstatus( RtlSetControlSecurityDescriptor(
1469         pSecurityDescriptor, ControlBitsOfInterest, ControlBitsToSet ) );
1470 }
1471
1472 /*      ##############################
1473         ######  ACL FUNCTIONS   ######
1474         ##############################
1475 */
1476
1477 /*************************************************************************
1478  * InitializeAcl [ADVAPI32.@]
1479  */
1480 BOOL WINAPI InitializeAcl(PACL acl, DWORD size, DWORD rev)
1481 {
1482     return set_ntstatus( RtlCreateAcl(acl, size, rev));
1483 }
1484
1485 BOOL WINAPI ImpersonateNamedPipeClient( HANDLE hNamedPipe )
1486 {
1487     IO_STATUS_BLOCK io_block;
1488
1489     TRACE("(%p)\n", hNamedPipe);
1490
1491     return set_ntstatus( NtFsControlFile(hNamedPipe, NULL, NULL, NULL,
1492                          &io_block, FSCTL_PIPE_IMPERSONATE, NULL, 0, NULL, 0) );
1493 }
1494
1495 /******************************************************************************
1496  *  AddAccessAllowedAce [ADVAPI32.@]
1497  */
1498 BOOL WINAPI AddAccessAllowedAce(
1499         IN OUT PACL pAcl,
1500         IN DWORD dwAceRevision,
1501         IN DWORD AccessMask,
1502         IN PSID pSid)
1503 {
1504     return set_ntstatus(RtlAddAccessAllowedAce(pAcl, dwAceRevision, AccessMask, pSid));
1505 }
1506
1507 /******************************************************************************
1508  *  AddAccessAllowedAceEx [ADVAPI32.@]
1509  */
1510 BOOL WINAPI AddAccessAllowedAceEx(
1511         IN OUT PACL pAcl,
1512         IN DWORD dwAceRevision,
1513         IN DWORD AceFlags,
1514         IN DWORD AccessMask,
1515         IN PSID pSid)
1516 {
1517     return set_ntstatus(RtlAddAccessAllowedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid));
1518 }
1519
1520 /******************************************************************************
1521  *  AddAccessDeniedAce [ADVAPI32.@]
1522  */
1523 BOOL WINAPI AddAccessDeniedAce(
1524         IN OUT PACL pAcl,
1525         IN DWORD dwAceRevision,
1526         IN DWORD AccessMask,
1527         IN PSID pSid)
1528 {
1529     return set_ntstatus(RtlAddAccessDeniedAce(pAcl, dwAceRevision, AccessMask, pSid));
1530 }
1531
1532 /******************************************************************************
1533  *  AddAccessDeniedAceEx [ADVAPI32.@]
1534  */
1535 BOOL WINAPI AddAccessDeniedAceEx(
1536         IN OUT PACL pAcl,
1537         IN DWORD dwAceRevision,
1538         IN DWORD AceFlags,
1539         IN DWORD AccessMask,
1540         IN PSID pSid)
1541 {
1542     return set_ntstatus(RtlAddAccessDeniedAceEx(pAcl, dwAceRevision, AceFlags, AccessMask, pSid));
1543 }
1544
1545 /******************************************************************************
1546  *  AddAce [ADVAPI32.@]
1547  */
1548 BOOL WINAPI AddAce(
1549         IN OUT PACL pAcl,
1550         IN DWORD dwAceRevision,
1551         IN DWORD dwStartingAceIndex,
1552         LPVOID pAceList,
1553         DWORD nAceListLength)
1554 {
1555     return set_ntstatus(RtlAddAce(pAcl, dwAceRevision, dwStartingAceIndex, pAceList, nAceListLength));
1556 }
1557
1558 /******************************************************************************
1559  * DeleteAce [ADVAPI32.@]
1560  */
1561 BOOL WINAPI DeleteAce(PACL pAcl, DWORD dwAceIndex)
1562 {
1563     return set_ntstatus(RtlDeleteAce(pAcl, dwAceIndex));
1564 }
1565
1566 /******************************************************************************
1567  *  FindFirstFreeAce [ADVAPI32.@]
1568  */
1569 BOOL WINAPI FindFirstFreeAce(IN PACL pAcl, LPVOID * pAce)
1570 {
1571         return RtlFirstFreeAce(pAcl, (PACE_HEADER *)pAce);
1572 }
1573
1574 /******************************************************************************
1575  * GetAce [ADVAPI32.@]
1576  */
1577 BOOL WINAPI GetAce(PACL pAcl,DWORD dwAceIndex,LPVOID *pAce )
1578 {
1579     return set_ntstatus(RtlGetAce(pAcl, dwAceIndex, pAce));
1580 }
1581
1582 /******************************************************************************
1583  * GetAclInformation [ADVAPI32.@]
1584  */
1585 BOOL WINAPI GetAclInformation(
1586   PACL pAcl,
1587   LPVOID pAclInformation,
1588   DWORD nAclInformationLength,
1589   ACL_INFORMATION_CLASS dwAclInformationClass)
1590 {
1591     return set_ntstatus(RtlQueryInformationAcl(pAcl, pAclInformation,
1592                                                nAclInformationLength, dwAclInformationClass));
1593 }
1594
1595 /******************************************************************************
1596  *  IsValidAcl [ADVAPI32.@]
1597  */
1598 BOOL WINAPI IsValidAcl(IN PACL pAcl)
1599 {
1600         return RtlValidAcl(pAcl);
1601 }
1602
1603 /*      ##############################
1604         ######  MISC FUNCTIONS  ######
1605         ##############################
1606 */
1607
1608 /******************************************************************************
1609  * AllocateLocallyUniqueId [ADVAPI32.@]
1610  *
1611  * PARAMS
1612  *   lpLuid []
1613  */
1614 BOOL WINAPI AllocateLocallyUniqueId( PLUID lpLuid )
1615 {
1616     return set_ntstatus(NtAllocateLocallyUniqueId(lpLuid));
1617 }
1618
1619 static const WCHAR SE_CREATE_TOKEN_NAME_W[] =
1620  { 'S','e','C','r','e','a','t','e','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 };
1621 static const WCHAR SE_ASSIGNPRIMARYTOKEN_NAME_W[] =
1622  { 'S','e','A','s','s','i','g','n','P','r','i','m','a','r','y','T','o','k','e','n','P','r','i','v','i','l','e','g','e',0 };
1623 static const WCHAR SE_LOCK_MEMORY_NAME_W[] =
1624  { 'S','e','L','o','c','k','M','e','m','o','r','y','P','r','i','v','i','l','e','g','e',0 };
1625 static const WCHAR SE_INCREASE_QUOTA_NAME_W[] =
1626  { 'S','e','I','n','c','r','e','a','s','e','Q','u','o','t','a','P','r','i','v','i','l','e','g','e',0 };
1627 static const WCHAR SE_MACHINE_ACCOUNT_NAME_W[] =
1628  { 'S','e','M','a','c','h','i','n','e','A','c','c','o','u','n','t','P','r','i','v','i','l','e','g','e',0 };
1629 static const WCHAR SE_TCB_NAME_W[] =
1630  { 'S','e','T','c','b','P','r','i','v','i','l','e','g','e',0 };
1631 static const WCHAR SE_SECURITY_NAME_W[] =
1632  { 'S','e','S','e','c','u','r','i','t','y','P','r','i','v','i','l','e','g','e',0 };
1633 static const WCHAR SE_TAKE_OWNERSHIP_NAME_W[] =
1634  { 'S','e','T','a','k','e','O','w','n','e','r','s','h','i','p','P','r','i','v','i','l','e','g','e',0 };
1635 static const WCHAR SE_LOAD_DRIVER_NAME_W[] =
1636  { 'S','e','L','o','a','d','D','r','i','v','e','r','P','r','i','v','i','l','e','g','e',0 };
1637 static const WCHAR SE_SYSTEM_PROFILE_NAME_W[] =
1638  { 'S','e','S','y','s','t','e','m','P','r','o','f','i','l','e','P','r','i','v','i','l','e','g','e',0 };
1639 static const WCHAR SE_SYSTEMTIME_NAME_W[] =
1640  { 'S','e','S','y','s','t','e','m','t','i','m','e','P','r','i','v','i','l','e','g','e',0 };
1641 static const WCHAR SE_PROF_SINGLE_PROCESS_NAME_W[] =
1642  { 'S','e','P','r','o','f','i','l','e','S','i','n','g','l','e','P','r','o','c','e','s','s','P','r','i','v','i','l','e','g','e',0 };
1643 static const WCHAR SE_INC_BASE_PRIORITY_NAME_W[] =
1644  { 'S','e','I','n','c','r','e','a','s','e','B','a','s','e','P','r','i','o','r','i','t','y','P','r','i','v','i','l','e','g','e',0 };
1645 static const WCHAR SE_CREATE_PAGEFILE_NAME_W[] =
1646  { 'S','e','C','r','e','a','t','e','P','a','g','e','f','i','l','e','P','r','i','v','i','l','e','g','e',0 };
1647 static const WCHAR SE_CREATE_PERMANENT_NAME_W[] =
1648  { 'S','e','C','r','e','a','t','e','P','e','r','m','a','n','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1649 static const WCHAR SE_BACKUP_NAME_W[] =
1650  { 'S','e','B','a','c','k','u','p','P','r','i','v','i','l','e','g','e',0 };
1651 static const WCHAR SE_RESTORE_NAME_W[] =
1652  { 'S','e','R','e','s','t','o','r','e','P','r','i','v','i','l','e','g','e',0 };
1653 static const WCHAR SE_SHUTDOWN_NAME_W[] =
1654  { 'S','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 };
1655 static const WCHAR SE_DEBUG_NAME_W[] =
1656  { 'S','e','D','e','b','u','g','P','r','i','v','i','l','e','g','e',0 };
1657 static const WCHAR SE_AUDIT_NAME_W[] =
1658  { 'S','e','A','u','d','i','t','P','r','i','v','i','l','e','g','e',0 };
1659 static const WCHAR SE_SYSTEM_ENVIRONMENT_NAME_W[] =
1660  { 'S','e','S','y','s','t','e','m','E','n','v','i','r','o','n','m','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1661 static const WCHAR SE_CHANGE_NOTIFY_NAME_W[] =
1662  { 'S','e','C','h','a','n','g','e','N','o','t','i','f','y','P','r','i','v','i','l','e','g','e',0 };
1663 static const WCHAR SE_REMOTE_SHUTDOWN_NAME_W[] =
1664  { 'S','e','R','e','m','o','t','e','S','h','u','t','d','o','w','n','P','r','i','v','i','l','e','g','e',0 };
1665 static const WCHAR SE_UNDOCK_NAME_W[] =
1666  { 'S','e','U','n','d','o','c','k','P','r','i','v','i','l','e','g','e',0 };
1667 static const WCHAR SE_SYNC_AGENT_NAME_W[] =
1668  { 'S','e','S','y','n','c','A','g','e','n','t','P','r','i','v','i','l','e','g','e',0 };
1669 static const WCHAR SE_ENABLE_DELEGATION_NAME_W[] =
1670  { 'S','e','E','n','a','b','l','e','D','e','l','e','g','a','t','i','o','n','P','r','i','v','i','l','e','g','e',0 };
1671 static const WCHAR SE_MANAGE_VOLUME_NAME_W[] =
1672  { 'S','e','M','a','n','a','g','e','V','o','l','u','m','e','P','r','i','v','i','l','e','g','e',0 };
1673 static const WCHAR SE_IMPERSONATE_NAME_W[] =
1674  { 'S','e','I','m','p','e','r','s','o','n','a','t','e','P','r','i','v','i','l','e','g','e',0 };
1675 static const WCHAR SE_CREATE_GLOBAL_NAME_W[] =
1676  { 'S','e','C','r','e','a','t','e','G','l','o','b','a','l','P','r','i','v','i','l','e','g','e',0 };
1677
1678 static const WCHAR * const WellKnownPrivNames[SE_MAX_WELL_KNOWN_PRIVILEGE + 1] =
1679 {
1680     NULL,
1681     NULL,
1682     SE_CREATE_TOKEN_NAME_W,
1683     SE_ASSIGNPRIMARYTOKEN_NAME_W,
1684     SE_LOCK_MEMORY_NAME_W,
1685     SE_INCREASE_QUOTA_NAME_W,
1686     SE_MACHINE_ACCOUNT_NAME_W,
1687     SE_TCB_NAME_W,
1688     SE_SECURITY_NAME_W,
1689     SE_TAKE_OWNERSHIP_NAME_W,
1690     SE_LOAD_DRIVER_NAME_W,
1691     SE_SYSTEM_PROFILE_NAME_W,
1692     SE_SYSTEMTIME_NAME_W,
1693     SE_PROF_SINGLE_PROCESS_NAME_W,
1694     SE_INC_BASE_PRIORITY_NAME_W,
1695     SE_CREATE_PAGEFILE_NAME_W,
1696     SE_CREATE_PERMANENT_NAME_W,
1697     SE_BACKUP_NAME_W,
1698     SE_RESTORE_NAME_W,
1699     SE_SHUTDOWN_NAME_W,
1700     SE_DEBUG_NAME_W,
1701     SE_AUDIT_NAME_W,
1702     SE_SYSTEM_ENVIRONMENT_NAME_W,
1703     SE_CHANGE_NOTIFY_NAME_W,
1704     SE_REMOTE_SHUTDOWN_NAME_W,
1705     SE_UNDOCK_NAME_W,
1706     SE_SYNC_AGENT_NAME_W,
1707     SE_ENABLE_DELEGATION_NAME_W,
1708     SE_MANAGE_VOLUME_NAME_W,
1709     SE_IMPERSONATE_NAME_W,
1710     SE_CREATE_GLOBAL_NAME_W,
1711 };
1712
1713 /******************************************************************************
1714  * LookupPrivilegeValueW                        [ADVAPI32.@]
1715  *
1716  * See LookupPrivilegeValueA.
1717  */
1718 BOOL WINAPI
1719 LookupPrivilegeValueW( LPCWSTR lpSystemName, LPCWSTR lpName, PLUID lpLuid )
1720 {
1721     UINT i;
1722
1723     TRACE("%s,%s,%p\n",debugstr_w(lpSystemName), debugstr_w(lpName), lpLuid);
1724
1725     if (!ADVAPI_IsLocalComputer(lpSystemName))
1726     {
1727         SetLastError(RPC_S_SERVER_UNAVAILABLE);
1728         return FALSE;
1729     }
1730     if (!lpName)
1731     {
1732         SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1733         return FALSE;
1734     }
1735     for( i=SE_MIN_WELL_KNOWN_PRIVILEGE; i<=SE_MAX_WELL_KNOWN_PRIVILEGE; i++ )
1736     {
1737         if( !WellKnownPrivNames[i] )
1738             continue;
1739         if( strcmpiW( WellKnownPrivNames[i], lpName) )
1740             continue;
1741         lpLuid->LowPart = i;
1742         lpLuid->HighPart = 0;
1743         TRACE( "%s -> %08x-%08x\n",debugstr_w( lpSystemName ),
1744                lpLuid->HighPart, lpLuid->LowPart );
1745         return TRUE;
1746     }
1747     SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1748     return FALSE;
1749 }
1750
1751 /******************************************************************************
1752  * LookupPrivilegeValueA                        [ADVAPI32.@]
1753  *
1754  * Retrieves LUID used on a system to represent the privilege name.
1755  *
1756  * PARAMS
1757  *  lpSystemName [I] Name of the system
1758  *  lpName       [I] Name of the privilege
1759  *  lpLuid       [O] Destination for the resulting LUID
1760  *
1761  * RETURNS
1762  *  Success: TRUE. lpLuid contains the requested LUID.
1763  *  Failure: FALSE.
1764  */
1765 BOOL WINAPI
1766 LookupPrivilegeValueA( LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid )
1767 {
1768     UNICODE_STRING lpSystemNameW;
1769     UNICODE_STRING lpNameW;
1770     BOOL ret;
1771
1772     RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
1773     RtlCreateUnicodeStringFromAsciiz(&lpNameW,lpName);
1774     ret = LookupPrivilegeValueW(lpSystemNameW.Buffer, lpNameW.Buffer, lpLuid);
1775     RtlFreeUnicodeString(&lpNameW);
1776     RtlFreeUnicodeString(&lpSystemNameW);
1777     return ret;
1778 }
1779
1780 BOOL WINAPI LookupPrivilegeDisplayNameA( LPCSTR lpSystemName, LPCSTR lpName, LPSTR lpDisplayName,
1781                                          LPDWORD cchDisplayName, LPDWORD lpLanguageId )
1782 {
1783     FIXME("%s %s %s %p %p - stub\n", debugstr_a(lpSystemName), debugstr_a(lpName),
1784           debugstr_a(lpDisplayName), cchDisplayName, lpLanguageId);
1785
1786     return FALSE;
1787 }
1788
1789 BOOL WINAPI LookupPrivilegeDisplayNameW( LPCWSTR lpSystemName, LPCWSTR lpName, LPWSTR lpDisplayName,
1790                                          LPDWORD cchDisplayName, LPDWORD lpLanguageId )
1791 {
1792     FIXME("%s %s %s %p %p - stub\n", debugstr_w(lpSystemName), debugstr_w(lpName),
1793           debugstr_w(lpDisplayName), cchDisplayName, lpLanguageId);
1794
1795     return FALSE;
1796 }
1797
1798 /******************************************************************************
1799  * LookupPrivilegeNameA                 [ADVAPI32.@]
1800  *
1801  * See LookupPrivilegeNameW.
1802  */
1803 BOOL WINAPI
1804 LookupPrivilegeNameA( LPCSTR lpSystemName, PLUID lpLuid, LPSTR lpName,
1805  LPDWORD cchName)
1806 {
1807     UNICODE_STRING lpSystemNameW;
1808     BOOL ret;
1809     DWORD wLen = 0;
1810
1811     TRACE("%s %p %p %p\n", debugstr_a(lpSystemName), lpLuid, lpName, cchName);
1812
1813     RtlCreateUnicodeStringFromAsciiz(&lpSystemNameW, lpSystemName);
1814     ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, NULL, &wLen);
1815     if (!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
1816     {
1817         LPWSTR lpNameW = HeapAlloc(GetProcessHeap(), 0, wLen * sizeof(WCHAR));
1818
1819         ret = LookupPrivilegeNameW(lpSystemNameW.Buffer, lpLuid, lpNameW,
1820          &wLen);
1821         if (ret)
1822         {
1823             /* Windows crashes if cchName is NULL, so will I */
1824             unsigned int len = WideCharToMultiByte(CP_ACP, 0, lpNameW, -1, lpName,
1825              *cchName, NULL, NULL);
1826
1827             if (len == 0)
1828             {
1829                 /* WideCharToMultiByte failed */
1830                 ret = FALSE;
1831             }
1832             else if (len > *cchName)
1833             {
1834                 *cchName = len;
1835                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
1836                 ret = FALSE;
1837             }
1838             else
1839             {
1840                 /* WideCharToMultiByte succeeded, output length needs to be
1841                  * length not including NULL terminator
1842                  */
1843                 *cchName = len - 1;
1844             }
1845         }
1846         HeapFree(GetProcessHeap(), 0, lpNameW);
1847     }
1848     RtlFreeUnicodeString(&lpSystemNameW);
1849     return ret;
1850 }
1851
1852 /******************************************************************************
1853  * LookupPrivilegeNameW                 [ADVAPI32.@]
1854  *
1855  * Retrieves the privilege name referred to by the LUID lpLuid.
1856  *
1857  * PARAMS
1858  *  lpSystemName [I]   Name of the system
1859  *  lpLuid       [I]   Privilege value
1860  *  lpName       [O]   Name of the privilege
1861  *  cchName      [I/O] Number of characters in lpName.
1862  *
1863  * RETURNS
1864  *  Success: TRUE. lpName contains the name of the privilege whose value is
1865  *  *lpLuid.
1866  *  Failure: FALSE.
1867  *
1868  * REMARKS
1869  *  Only well-known privilege names (those defined in winnt.h) can be retrieved
1870  *  using this function.
1871  *  If the length of lpName is too small, on return *cchName will contain the
1872  *  number of WCHARs needed to contain the privilege, including the NULL
1873  *  terminator, and GetLastError will return ERROR_INSUFFICIENT_BUFFER.
1874  *  On success, *cchName will contain the number of characters stored in
1875  *  lpName, NOT including the NULL terminator.
1876  */
1877 BOOL WINAPI
1878 LookupPrivilegeNameW( LPCWSTR lpSystemName, PLUID lpLuid, LPWSTR lpName,
1879  LPDWORD cchName)
1880 {
1881     size_t privNameLen;
1882
1883     TRACE("%s,%p,%p,%p\n",debugstr_w(lpSystemName), lpLuid, lpName, cchName);
1884
1885     if (!ADVAPI_IsLocalComputer(lpSystemName))
1886     {
1887         SetLastError(RPC_S_SERVER_UNAVAILABLE);
1888         return FALSE;
1889     }
1890     if (lpLuid->HighPart || (lpLuid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
1891      lpLuid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE))
1892     {
1893         SetLastError(ERROR_NO_SUCH_PRIVILEGE);
1894         return FALSE;
1895     }
1896     privNameLen = strlenW(WellKnownPrivNames[lpLuid->LowPart]);
1897     /* Windows crashes if cchName is NULL, so will I */
1898     if (*cchName <= privNameLen)
1899     {
1900         *cchName = privNameLen + 1;
1901         SetLastError(ERROR_INSUFFICIENT_BUFFER);
1902         return FALSE;
1903     }
1904     else
1905     {
1906         strcpyW(lpName, WellKnownPrivNames[lpLuid->LowPart]);
1907         *cchName = privNameLen;
1908         return TRUE;
1909     }
1910 }
1911
1912 /******************************************************************************
1913  * GetFileSecurityA [ADVAPI32.@]
1914  *
1915  * Obtains Specified information about the security of a file or directory.
1916  *
1917  * PARAMS
1918  *  lpFileName           [I] Name of the file to get info for
1919  *  RequestedInformation [I] SE_ flags from "winnt.h"
1920  *  pSecurityDescriptor  [O] Destination for security information
1921  *  nLength              [I] Length of pSecurityDescriptor
1922  *  lpnLengthNeeded      [O] Destination for length of returned security information
1923  *
1924  * RETURNS
1925  *  Success: TRUE. pSecurityDescriptor contains the requested information.
1926  *  Failure: FALSE. lpnLengthNeeded contains the required space to return the info.
1927  *
1928  * NOTES
1929  *  The information returned is constrained by the callers access rights and
1930  *  privileges.
1931  */
1932 BOOL WINAPI
1933 GetFileSecurityA( LPCSTR lpFileName,
1934                     SECURITY_INFORMATION RequestedInformation,
1935                     PSECURITY_DESCRIPTOR pSecurityDescriptor,
1936                     DWORD nLength, LPDWORD lpnLengthNeeded )
1937 {
1938     BOOL r;
1939     LPWSTR name;
1940
1941     name = SERV_dup(lpFileName);
1942     r = GetFileSecurityW( name, RequestedInformation, pSecurityDescriptor,
1943                           nLength, lpnLengthNeeded );
1944     HeapFree( GetProcessHeap(), 0, name );
1945
1946     return r;
1947 }
1948
1949 /******************************************************************************
1950  * GetFileSecurityW [ADVAPI32.@]
1951  *
1952  * See GetFileSecurityA.
1953  */
1954 BOOL WINAPI
1955 GetFileSecurityW( LPCWSTR lpFileName,
1956                     SECURITY_INFORMATION RequestedInformation,
1957                     PSECURITY_DESCRIPTOR pSecurityDescriptor,
1958                     DWORD nLength, LPDWORD lpnLengthNeeded )
1959 {
1960     HANDLE hfile;
1961     NTSTATUS status;
1962     DWORD access = 0;
1963
1964     TRACE("(%s,%d,%p,%d,%p)\n", debugstr_w(lpFileName),
1965           RequestedInformation, pSecurityDescriptor,
1966           nLength, lpnLengthNeeded);
1967
1968     if (RequestedInformation & (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|
1969                                 DACL_SECURITY_INFORMATION))
1970         access |= READ_CONTROL;
1971     if (RequestedInformation & SACL_SECURITY_INFORMATION)
1972         access |= ACCESS_SYSTEM_SECURITY;
1973
1974     hfile = CreateFileW( lpFileName, access, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
1975                          NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, 0 );
1976     if ( hfile == INVALID_HANDLE_VALUE )
1977         return FALSE;
1978
1979     status = NtQuerySecurityObject( hfile, RequestedInformation, pSecurityDescriptor,
1980                                     nLength, lpnLengthNeeded );
1981     CloseHandle( hfile );
1982     return set_ntstatus( status );
1983 }
1984
1985
1986 /******************************************************************************
1987  * LookupAccountSidA [ADVAPI32.@]
1988  */
1989 BOOL WINAPI
1990 LookupAccountSidA(
1991         IN LPCSTR system,
1992         IN PSID sid,
1993         OUT LPSTR account,
1994         IN OUT LPDWORD accountSize,
1995         OUT LPSTR domain,
1996         IN OUT LPDWORD domainSize,
1997         OUT PSID_NAME_USE name_use )
1998 {
1999     DWORD len;
2000     BOOL r;
2001     LPWSTR systemW;
2002     LPWSTR accountW = NULL;
2003     LPWSTR domainW = NULL;
2004     DWORD accountSizeW = *accountSize;
2005     DWORD domainSizeW = *domainSize;
2006
2007     systemW = SERV_dup(system);
2008     if (account)
2009         accountW = HeapAlloc( GetProcessHeap(), 0, accountSizeW * sizeof(WCHAR) );
2010     if (domain)
2011         domainW = HeapAlloc( GetProcessHeap(), 0, domainSizeW * sizeof(WCHAR) );
2012
2013     r = LookupAccountSidW( systemW, sid, accountW, &accountSizeW, domainW, &domainSizeW, name_use );
2014
2015     if (r) {
2016         if (accountW && *accountSize) {
2017             len = WideCharToMultiByte( CP_ACP, 0, accountW, -1, NULL, 0, NULL, NULL );
2018             WideCharToMultiByte( CP_ACP, 0, accountW, -1, account, len, NULL, NULL );
2019             *accountSize = len;
2020         } else
2021             *accountSize = accountSizeW + 1;
2022
2023         if (domainW && *domainSize) {
2024             len = WideCharToMultiByte( CP_ACP, 0, domainW, -1, NULL, 0, NULL, NULL );
2025             WideCharToMultiByte( CP_ACP, 0, domainW, -1, domain, len, NULL, NULL );
2026             *domainSize = len;
2027         } else
2028             *domainSize = domainSizeW + 1;
2029     }
2030     else
2031     {
2032         *accountSize = accountSizeW + 1;
2033         *domainSize = domainSizeW + 1;
2034     }
2035
2036     HeapFree( GetProcessHeap(), 0, systemW );
2037     HeapFree( GetProcessHeap(), 0, accountW );
2038     HeapFree( GetProcessHeap(), 0, domainW );
2039
2040     return r;
2041 }
2042
2043 /******************************************************************************
2044  * LookupAccountSidW [ADVAPI32.@]
2045  *
2046  * PARAMS
2047  *   system      []
2048  *   sid         []
2049  *   account     []
2050  *   accountSize []
2051  *   domain      []
2052  *   domainSize  []
2053  *   name_use    []
2054  */
2055
2056 BOOL WINAPI
2057 LookupAccountSidW(
2058         IN LPCWSTR system,
2059         IN PSID sid,
2060         OUT LPWSTR account,
2061         IN OUT LPDWORD accountSize,
2062         OUT LPWSTR domain,
2063         IN OUT LPDWORD domainSize,
2064         OUT PSID_NAME_USE name_use )
2065 {
2066     unsigned int i, j;
2067     const WCHAR * ac = NULL;
2068     const WCHAR * dm = NULL;
2069     SID_NAME_USE use = 0;
2070     LPWSTR computer_name = NULL;
2071     LPWSTR account_name = NULL;
2072
2073     TRACE("(%s,sid=%s,%p,%p(%u),%p,%p(%u),%p)\n",
2074           debugstr_w(system),debugstr_sid(sid),
2075           account,accountSize,accountSize?*accountSize:0,
2076           domain,domainSize,domainSize?*domainSize:0,
2077           name_use);
2078
2079     if (!ADVAPI_IsLocalComputer(system)) {
2080         FIXME("Only local computer supported!\n");
2081         SetLastError(RPC_S_SERVER_UNAVAILABLE);
2082         return FALSE;
2083     }
2084
2085     /* check the well known SIDs first */
2086     for (i = 0; i <= 60; i++) {
2087         if (IsWellKnownSid(sid, i)) {
2088             for (j = 0; j < (sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0])); j++) {
2089                 if (ACCOUNT_SIDS[j].type == i) {
2090                     ac = ACCOUNT_SIDS[j].account;
2091                     dm = ACCOUNT_SIDS[j].domain;
2092                     use = ACCOUNT_SIDS[j].name_use;
2093                 }
2094             }
2095             break;
2096         }
2097     }
2098
2099     if (dm == NULL) {
2100         MAX_SID local;
2101
2102         /* check for the local computer next */
2103         if (ADVAPI_GetComputerSid(&local)) {
2104             DWORD size = MAX_COMPUTERNAME_LENGTH + 1;
2105             BOOL result;
2106
2107             computer_name = HeapAlloc(GetProcessHeap(), 0, size * sizeof(WCHAR));
2108             result = GetComputerNameW(computer_name,  &size);
2109
2110             if (result) {
2111                 if (EqualSid(sid, &local)) {
2112                     dm = computer_name;
2113                     ac = Blank;
2114                     use = 3;
2115                 } else {
2116                     local.SubAuthorityCount++;
2117
2118                     if (EqualPrefixSid(sid, &local)) {
2119                         dm = computer_name;
2120                         use = 1;
2121                         switch (((MAX_SID *)sid)->SubAuthority[4]) {
2122                         case DOMAIN_USER_RID_ADMIN:
2123                             ac = Administrator;
2124                             break;
2125                         case DOMAIN_USER_RID_GUEST:
2126                             ac = Guest;
2127                             break;
2128                         case DOMAIN_GROUP_RID_ADMINS:
2129                             ac = Domain_Admins;
2130                             break;
2131                         case DOMAIN_GROUP_RID_USERS:
2132                             ac = Domain_Users;
2133                             break;
2134                         case DOMAIN_GROUP_RID_GUESTS:
2135                             ac = Domain_Guests;
2136                             break;
2137                         case DOMAIN_GROUP_RID_COMPUTERS:
2138                             ac = Domain_Computers;
2139                             break;
2140                         case DOMAIN_GROUP_RID_CONTROLLERS:
2141                             ac = Domain_Controllers;
2142                             break;
2143                         case DOMAIN_GROUP_RID_CERT_ADMINS:
2144                             ac = Cert_Publishers;
2145                             break;
2146                         case DOMAIN_GROUP_RID_SCHEMA_ADMINS:
2147                             ac = Schema_Admins;
2148                             break;
2149                         case DOMAIN_GROUP_RID_ENTERPRISE_ADMINS:
2150                             ac = Enterprise_Admins;
2151                             break;
2152                         case DOMAIN_GROUP_RID_POLICY_ADMINS:
2153                             ac = Group_Policy_Creator_Owners;
2154                             break;
2155                         case DOMAIN_ALIAS_RID_RAS_SERVERS:
2156                             ac = RAS_and_IAS_Servers;
2157                             break;
2158                         case 1000:      /* first user account */
2159                             size = UNLEN + 1;
2160                             account_name = HeapAlloc(
2161                                 GetProcessHeap(), 0, size * sizeof(WCHAR));
2162                             if (GetUserNameW(account_name, &size))
2163                                 ac = account_name;
2164                             else
2165                                 dm = NULL;
2166
2167                             break;
2168                         default:
2169                             dm = NULL;
2170                             break;
2171                         }
2172                     }
2173                 }
2174             }
2175         }
2176     }
2177
2178     if (dm) {
2179         DWORD ac_len = lstrlenW(ac);
2180         DWORD dm_len = lstrlenW(dm);
2181         BOOL status = TRUE;
2182
2183         if (*accountSize > ac_len) {
2184             if (account)
2185                 lstrcpyW(account, ac);
2186         }
2187         if (*domainSize > dm_len) {
2188             if (domain)
2189                 lstrcpyW(domain, dm);
2190         }
2191         if ((*accountSize && *accountSize < ac_len) ||
2192             (!account && !*accountSize && ac_len)   ||
2193             (*domainSize && *domainSize < dm_len)   ||
2194             (!domain && !*domainSize && dm_len))
2195         {
2196             SetLastError(ERROR_INSUFFICIENT_BUFFER);
2197             status = FALSE;
2198         }
2199         if (*domainSize)
2200             *domainSize = dm_len;
2201         else
2202             *domainSize = dm_len + 1;
2203         if (*accountSize)
2204             *accountSize = ac_len;
2205         else
2206             *accountSize = ac_len + 1;
2207
2208         HeapFree(GetProcessHeap(), 0, account_name);
2209         HeapFree(GetProcessHeap(), 0, computer_name);
2210         if (status) *name_use = use;
2211         return status;
2212     }
2213
2214     HeapFree(GetProcessHeap(), 0, account_name);
2215     HeapFree(GetProcessHeap(), 0, computer_name);
2216     SetLastError(ERROR_NONE_MAPPED);
2217     return FALSE;
2218 }
2219
2220 /******************************************************************************
2221  * SetFileSecurityA [ADVAPI32.@]
2222  *
2223  * See SetFileSecurityW.
2224  */
2225 BOOL WINAPI SetFileSecurityA( LPCSTR lpFileName,
2226                                 SECURITY_INFORMATION RequestedInformation,
2227                                 PSECURITY_DESCRIPTOR pSecurityDescriptor)
2228 {
2229     BOOL r;
2230     LPWSTR name;
2231
2232     name = SERV_dup(lpFileName);
2233     r = SetFileSecurityW( name, RequestedInformation, pSecurityDescriptor );
2234     HeapFree( GetProcessHeap(), 0, name );
2235
2236     return r;
2237 }
2238
2239 /******************************************************************************
2240  * SetFileSecurityW [ADVAPI32.@]
2241  *
2242  * Sets the security of a file or directory.
2243  *
2244  * PARAMS
2245  *   lpFileName           []
2246  *   RequestedInformation []
2247  *   pSecurityDescriptor  []
2248  *
2249  * RETURNS
2250  *  Success: TRUE.
2251  *  Failure: FALSE.
2252  */
2253 BOOL WINAPI
2254 SetFileSecurityW( LPCWSTR lpFileName,
2255                     SECURITY_INFORMATION RequestedInformation,
2256                     PSECURITY_DESCRIPTOR pSecurityDescriptor )
2257 {
2258     HANDLE file;
2259     DWORD access = 0;
2260     NTSTATUS status;
2261
2262     TRACE("(%s, 0x%x, %p)\n", debugstr_w(lpFileName), RequestedInformation,
2263           pSecurityDescriptor );
2264
2265     if (RequestedInformation & OWNER_SECURITY_INFORMATION ||
2266         RequestedInformation & GROUP_SECURITY_INFORMATION)
2267         access |= WRITE_OWNER;
2268     if (RequestedInformation & SACL_SECURITY_INFORMATION)
2269         access |= ACCESS_SYSTEM_SECURITY;
2270     if (RequestedInformation & DACL_SECURITY_INFORMATION)
2271         access |= WRITE_DAC;
2272
2273     file = CreateFileW( lpFileName, access, FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
2274                         NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL );
2275     if (file == INVALID_HANDLE_VALUE)
2276         return FALSE;
2277
2278     status = NtSetSecurityObject( file, RequestedInformation, pSecurityDescriptor );
2279     CloseHandle( file );
2280     return set_ntstatus( status );
2281 }
2282
2283 /******************************************************************************
2284  * QueryWindows31FilesMigration [ADVAPI32.@]
2285  *
2286  * PARAMS
2287  *   x1 []
2288  */
2289 BOOL WINAPI
2290 QueryWindows31FilesMigration( DWORD x1 )
2291 {
2292         FIXME("(%d):stub\n",x1);
2293         return TRUE;
2294 }
2295
2296 /******************************************************************************
2297  * SynchronizeWindows31FilesAndWindowsNTRegistry [ADVAPI32.@]
2298  *
2299  * PARAMS
2300  *   x1 []
2301  *   x2 []
2302  *   x3 []
2303  *   x4 []
2304  */
2305 BOOL WINAPI
2306 SynchronizeWindows31FilesAndWindowsNTRegistry( DWORD x1, DWORD x2, DWORD x3,
2307                                                DWORD x4 )
2308 {
2309         FIXME("(0x%08x,0x%08x,0x%08x,0x%08x):stub\n",x1,x2,x3,x4);
2310         return TRUE;
2311 }
2312
2313 /******************************************************************************
2314  * NotifyBootConfigStatus [ADVAPI32.@]
2315  *
2316  * PARAMS
2317  *   x1 []
2318  */
2319 BOOL WINAPI
2320 NotifyBootConfigStatus( BOOL x1 )
2321 {
2322         FIXME("(0x%08d):stub\n",x1);
2323         return 1;
2324 }
2325
2326 /******************************************************************************
2327  * RevertToSelf [ADVAPI32.@]
2328  *
2329  * Ends the impersonation of a user.
2330  *
2331  * PARAMS
2332  *   void []
2333  *
2334  * RETURNS
2335  *  Success: TRUE.
2336  *  Failure: FALSE.
2337  */
2338 BOOL WINAPI
2339 RevertToSelf( void )
2340 {
2341     HANDLE Token = NULL;
2342     return set_ntstatus( NtSetInformationThread( GetCurrentThread(),
2343         ThreadImpersonationToken, &Token, sizeof(Token) ) );
2344 }
2345
2346 /******************************************************************************
2347  * ImpersonateSelf [ADVAPI32.@]
2348  *
2349  * Makes an impersonation token that represents the process user and assigns
2350  * to the current thread.
2351  *
2352  * PARAMS
2353  *  ImpersonationLevel [I] Level at which to impersonate.
2354  *
2355  * RETURNS
2356  *  Success: TRUE.
2357  *  Failure: FALSE.
2358  */
2359 BOOL WINAPI
2360 ImpersonateSelf(SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
2361 {
2362     return set_ntstatus( RtlImpersonateSelf( ImpersonationLevel ) );
2363 }
2364
2365 /******************************************************************************
2366  * ImpersonateLoggedOnUser [ADVAPI32.@]
2367  */
2368 BOOL WINAPI ImpersonateLoggedOnUser(HANDLE hToken)
2369 {
2370     DWORD size;
2371     NTSTATUS Status;
2372     HANDLE ImpersonationToken;
2373     TOKEN_TYPE Type;
2374     static BOOL warn = TRUE;
2375
2376     if (warn)
2377     {
2378         FIXME( "(%p)\n", hToken );
2379         warn = FALSE;
2380     }
2381     if (!GetTokenInformation( hToken, TokenType, &Type,
2382                               sizeof(TOKEN_TYPE), &size ))
2383         return FALSE;
2384
2385     if (Type == TokenPrimary)
2386     {
2387         OBJECT_ATTRIBUTES ObjectAttributes;
2388
2389         InitializeObjectAttributes( &ObjectAttributes, NULL, 0, NULL, NULL );
2390
2391         Status = NtDuplicateToken( hToken,
2392                                    TOKEN_IMPERSONATE | TOKEN_QUERY,
2393                                    &ObjectAttributes,
2394                                    SecurityImpersonation,
2395                                    TokenImpersonation,
2396                                    &ImpersonationToken );
2397         if (Status != STATUS_SUCCESS)
2398         {
2399             ERR( "NtDuplicateToken failed with error 0x%08x\n", Status );
2400             SetLastError( RtlNtStatusToDosError( Status ) );
2401             return FALSE;
2402         }
2403     }
2404     else
2405         ImpersonationToken = hToken;
2406
2407     Status = NtSetInformationThread( GetCurrentThread(),
2408                                      ThreadImpersonationToken,
2409                                      &ImpersonationToken,
2410                                      sizeof(ImpersonationToken) );
2411
2412     if (Type == TokenPrimary)
2413         NtClose( ImpersonationToken );
2414
2415     if (Status != STATUS_SUCCESS)
2416     {
2417         ERR( "NtSetInformationThread failed with error 0x%08x\n", Status );
2418         SetLastError( RtlNtStatusToDosError( Status ) );
2419         return FALSE;
2420     }
2421
2422     return TRUE;
2423 }
2424
2425 /******************************************************************************
2426  * AccessCheck [ADVAPI32.@]
2427  */
2428 BOOL WINAPI
2429 AccessCheck(
2430         PSECURITY_DESCRIPTOR SecurityDescriptor,
2431         HANDLE ClientToken,
2432         DWORD DesiredAccess,
2433         PGENERIC_MAPPING GenericMapping,
2434         PPRIVILEGE_SET PrivilegeSet,
2435         LPDWORD PrivilegeSetLength,
2436         LPDWORD GrantedAccess,
2437         LPBOOL AccessStatus)
2438 {
2439     NTSTATUS access_status;
2440     BOOL ret = set_ntstatus( NtAccessCheck(SecurityDescriptor, ClientToken, DesiredAccess,
2441                                            GenericMapping, PrivilegeSet, PrivilegeSetLength,
2442                                            GrantedAccess, &access_status) );
2443     if (ret) *AccessStatus = set_ntstatus( access_status );
2444     return ret;
2445 }
2446
2447
2448 /******************************************************************************
2449  * AccessCheckByType [ADVAPI32.@]
2450  */
2451 BOOL WINAPI AccessCheckByType(
2452     PSECURITY_DESCRIPTOR pSecurityDescriptor,
2453     PSID PrincipalSelfSid,
2454     HANDLE ClientToken,
2455     DWORD DesiredAccess,
2456     POBJECT_TYPE_LIST ObjectTypeList,
2457     DWORD ObjectTypeListLength,
2458     PGENERIC_MAPPING GenericMapping,
2459     PPRIVILEGE_SET PrivilegeSet,
2460     LPDWORD PrivilegeSetLength,
2461     LPDWORD GrantedAccess,
2462     LPBOOL AccessStatus)
2463 {
2464         FIXME("stub\n");
2465
2466         *AccessStatus = TRUE;
2467
2468         return !*AccessStatus;
2469 }
2470
2471 /******************************************************************************
2472  * MapGenericMask [ADVAPI32.@]
2473  *
2474  * Maps generic access rights into specific access rights according to the
2475  * supplied mapping.
2476  *
2477  * PARAMS
2478  *  AccessMask     [I/O] Access rights.
2479  *  GenericMapping [I] The mapping between generic and specific rights.
2480  *
2481  * RETURNS
2482  *  Nothing.
2483  */
2484 VOID WINAPI MapGenericMask( PDWORD AccessMask, PGENERIC_MAPPING GenericMapping )
2485 {
2486     RtlMapGenericMask( AccessMask, GenericMapping );
2487 }
2488
2489 /*************************************************************************
2490  * SetKernelObjectSecurity [ADVAPI32.@]
2491  */
2492 BOOL WINAPI SetKernelObjectSecurity (
2493         IN HANDLE Handle,
2494         IN SECURITY_INFORMATION SecurityInformation,
2495         IN PSECURITY_DESCRIPTOR SecurityDescriptor )
2496 {
2497     return set_ntstatus (NtSetSecurityObject (Handle, SecurityInformation, SecurityDescriptor));
2498 }
2499
2500
2501 /******************************************************************************
2502  *  AddAuditAccessAce [ADVAPI32.@]
2503  */
2504 BOOL WINAPI AddAuditAccessAce(
2505     IN OUT PACL pAcl,
2506     IN DWORD dwAceRevision,
2507     IN DWORD dwAccessMask,
2508     IN PSID pSid,
2509     IN BOOL bAuditSuccess,
2510     IN BOOL bAuditFailure)
2511 {
2512     return set_ntstatus( RtlAddAuditAccessAce(pAcl, dwAceRevision, dwAccessMask, pSid,
2513                                               bAuditSuccess, bAuditFailure) );
2514 }
2515
2516 /******************************************************************************
2517  *  AddAuditAccessAce [ADVAPI32.@]
2518  */
2519 BOOL WINAPI AddAuditAccessAceEx(
2520     IN OUT PACL pAcl,
2521     IN DWORD dwAceRevision,
2522     IN DWORD dwAceFlags,
2523     IN DWORD dwAccessMask,
2524     IN PSID pSid,
2525     IN BOOL bAuditSuccess,
2526     IN BOOL bAuditFailure)
2527 {
2528     return set_ntstatus( RtlAddAuditAccessAceEx(pAcl, dwAceRevision, dwAceFlags, dwAccessMask, pSid,
2529                                               bAuditSuccess, bAuditFailure) );
2530 }
2531
2532 /******************************************************************************
2533  * LookupAccountNameA [ADVAPI32.@]
2534  */
2535 BOOL WINAPI
2536 LookupAccountNameA(
2537         IN LPCSTR system,
2538         IN LPCSTR account,
2539         OUT PSID sid,
2540         OUT LPDWORD cbSid,
2541         LPSTR ReferencedDomainName,
2542         IN OUT LPDWORD cbReferencedDomainName,
2543         OUT PSID_NAME_USE name_use )
2544 {
2545     BOOL ret;
2546     UNICODE_STRING lpSystemW;
2547     UNICODE_STRING lpAccountW;
2548     LPWSTR lpReferencedDomainNameW = NULL;
2549
2550     RtlCreateUnicodeStringFromAsciiz(&lpSystemW, system);
2551     RtlCreateUnicodeStringFromAsciiz(&lpAccountW, account);
2552
2553     if (ReferencedDomainName)
2554         lpReferencedDomainNameW = HeapAlloc(GetProcessHeap(), 0, *cbReferencedDomainName * sizeof(WCHAR));
2555
2556     ret = LookupAccountNameW(lpSystemW.Buffer, lpAccountW.Buffer, sid, cbSid, lpReferencedDomainNameW,
2557         cbReferencedDomainName, name_use);
2558
2559     if (ret && lpReferencedDomainNameW)
2560     {
2561         WideCharToMultiByte(CP_ACP, 0, lpReferencedDomainNameW, -1,
2562             ReferencedDomainName, *cbReferencedDomainName+1, NULL, NULL);
2563     }
2564
2565     RtlFreeUnicodeString(&lpSystemW);
2566     RtlFreeUnicodeString(&lpAccountW);
2567     HeapFree(GetProcessHeap(), 0, lpReferencedDomainNameW);
2568
2569     return ret;
2570 }
2571
2572 /******************************************************************************
2573  * lookup_user_account_name
2574  */
2575 static BOOL lookup_user_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName,
2576                                      LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2577 {
2578     char buffer[sizeof(TOKEN_USER) + sizeof(SID) + sizeof(DWORD)*SID_MAX_SUB_AUTHORITIES];
2579     DWORD len = sizeof(buffer);
2580     HANDLE token;
2581     BOOL ret;
2582     PSID pSid;
2583     WCHAR domainName[MAX_COMPUTERNAME_LENGTH + 1];
2584     DWORD nameLen;
2585
2586     if (!OpenThreadToken(GetCurrentThread(), TOKEN_READ, TRUE, &token))
2587     {
2588         if (GetLastError() != ERROR_NO_TOKEN) return FALSE;
2589         if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &token)) return FALSE;
2590     }
2591
2592     ret = GetTokenInformation(token, TokenUser, buffer, len, &len);
2593     CloseHandle( token );
2594
2595     if (!ret) return FALSE;
2596
2597     pSid = ((TOKEN_USER *)buffer)->User.Sid;
2598
2599     if (Sid != NULL && (*cbSid >= GetLengthSid(pSid)))
2600        CopySid(*cbSid, Sid, pSid);
2601     if (*cbSid < GetLengthSid(pSid))
2602     {
2603        SetLastError(ERROR_INSUFFICIENT_BUFFER);
2604        ret = FALSE;
2605     }
2606     *cbSid = GetLengthSid(pSid);
2607
2608     nameLen = MAX_COMPUTERNAME_LENGTH + 1;
2609     if (!GetComputerNameW(domainName, &nameLen))
2610     {
2611         domainName[0] = 0;
2612         nameLen = 0;
2613     }
2614     if (*cchReferencedDomainName <= nameLen || !ret)
2615     {
2616         SetLastError(ERROR_INSUFFICIENT_BUFFER);
2617         nameLen += 1;
2618         ret = FALSE;
2619     }
2620     else if (ReferencedDomainName)
2621         strcpyW(ReferencedDomainName, domainName);
2622
2623     *cchReferencedDomainName = nameLen;
2624
2625     if (ret)
2626         *peUse = SidTypeUser;
2627
2628     return ret;
2629 }
2630
2631 /******************************************************************************
2632  * lookup_computer_account_name
2633  */
2634 static BOOL lookup_computer_account_name(PSID Sid, PDWORD cbSid, LPWSTR ReferencedDomainName,
2635                                          LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2636 {
2637     MAX_SID local;
2638     BOOL ret;
2639     WCHAR domainName[MAX_COMPUTERNAME_LENGTH + 1];
2640     DWORD nameLen;
2641
2642     if ((ret = ADVAPI_GetComputerSid(&local)))
2643     {
2644         if (Sid != NULL && (*cbSid >= GetLengthSid(&local)))
2645            CopySid(*cbSid, Sid, &local);
2646         if (*cbSid < GetLengthSid(&local))
2647         {
2648            SetLastError(ERROR_INSUFFICIENT_BUFFER);
2649            ret = FALSE;
2650         }
2651         *cbSid = GetLengthSid(&local);
2652     }
2653
2654     nameLen = MAX_COMPUTERNAME_LENGTH + 1;
2655     if (!GetComputerNameW(domainName, &nameLen))
2656     {
2657         domainName[0] = 0;
2658         nameLen = 0;
2659     }
2660     if (*cchReferencedDomainName <= nameLen || !ret)
2661     {
2662         SetLastError(ERROR_INSUFFICIENT_BUFFER);
2663         nameLen += 1;
2664         ret = FALSE;
2665     }
2666     else if (ReferencedDomainName)
2667         strcpyW(ReferencedDomainName, domainName);
2668
2669     *cchReferencedDomainName = nameLen;
2670
2671     if (ret)
2672         *peUse = SidTypeDomain;
2673
2674     return ret;
2675 }
2676
2677 static void split_domain_account( const LSA_UNICODE_STRING *str, LSA_UNICODE_STRING *account,
2678                                   LSA_UNICODE_STRING *domain )
2679 {
2680     WCHAR *p = str->Buffer + str->Length / sizeof(WCHAR) - 1;
2681
2682     while (p > str->Buffer && *p != '\\') p--;
2683
2684     if (*p == '\\')
2685     {
2686         domain->Buffer = str->Buffer;
2687         domain->Length = (p - str->Buffer) * sizeof(WCHAR);
2688
2689         account->Buffer = p + 1;
2690         account->Length = str->Length - ((p - str->Buffer + 1) * sizeof(WCHAR));
2691     }
2692     else
2693     {
2694         domain->Buffer = NULL;
2695         domain->Length = 0;
2696
2697         account->Buffer = str->Buffer;
2698         account->Length = str->Length;
2699     }
2700 }
2701
2702 static BOOL match_domain( ULONG idx, const LSA_UNICODE_STRING *domain )
2703 {
2704     ULONG len = strlenW( ACCOUNT_SIDS[idx].domain );
2705
2706     if (len == domain->Length / sizeof(WCHAR) && !strncmpiW( domain->Buffer, ACCOUNT_SIDS[idx].domain, len ))
2707         return TRUE;
2708
2709     return FALSE;
2710 }
2711
2712 static BOOL match_account( ULONG idx, const LSA_UNICODE_STRING *account )
2713 {
2714     ULONG len = strlenW( ACCOUNT_SIDS[idx].account );
2715
2716     if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].account, len ))
2717         return TRUE;
2718
2719     if (ACCOUNT_SIDS[idx].alias)
2720     {
2721         len = strlenW( ACCOUNT_SIDS[idx].alias );
2722         if (len == account->Length / sizeof(WCHAR) && !strncmpiW( account->Buffer, ACCOUNT_SIDS[idx].alias, len ))
2723             return TRUE;
2724     }
2725     return FALSE;
2726 }
2727
2728 /*
2729  * Helper function for LookupAccountNameW
2730  */
2731 BOOL lookup_local_wellknown_name( const LSA_UNICODE_STRING *account_and_domain,
2732                                   PSID Sid, LPDWORD cbSid,
2733                                   LPWSTR ReferencedDomainName,
2734                                   LPDWORD cchReferencedDomainName,
2735                                   PSID_NAME_USE peUse, BOOL *handled )
2736 {
2737     PSID pSid;
2738     LSA_UNICODE_STRING account, domain;
2739     BOOL ret = TRUE;
2740     ULONG i;
2741
2742     *handled = FALSE;
2743     split_domain_account( account_and_domain, &account, &domain );
2744
2745     for (i = 0; i < sizeof(ACCOUNT_SIDS) / sizeof(ACCOUNT_SIDS[0]); i++)
2746     {
2747         /* check domain first */
2748         if (domain.Buffer && !match_domain( i, &domain )) continue;
2749
2750         if (match_account( i, &account ))
2751         {
2752             DWORD len, sidLen = SECURITY_MAX_SID_SIZE;
2753
2754             if (!(pSid = HeapAlloc( GetProcessHeap(), 0, sidLen ))) return FALSE;
2755
2756             if ((ret = CreateWellKnownSid( ACCOUNT_SIDS[i].type, NULL, pSid, &sidLen )))
2757             {
2758                 if (*cbSid < sidLen)
2759                 {
2760                     SetLastError(ERROR_INSUFFICIENT_BUFFER);
2761                     ret = FALSE;
2762                 }
2763                 else if (Sid)
2764                 {
2765                     CopySid(*cbSid, Sid, pSid);
2766                 }
2767                 *cbSid = sidLen;
2768             }
2769
2770             len = strlenW( ACCOUNT_SIDS[i].domain );
2771             if (*cchReferencedDomainName <= len || !ret)
2772             {
2773                 SetLastError(ERROR_INSUFFICIENT_BUFFER);
2774                 len++;
2775                 ret = FALSE;
2776             }
2777             else if (ReferencedDomainName)
2778             {
2779                 strcpyW( ReferencedDomainName, ACCOUNT_SIDS[i].domain );
2780             }
2781
2782             *cchReferencedDomainName = len;
2783             if (ret)
2784                 *peUse = ACCOUNT_SIDS[i].name_use;
2785
2786             HeapFree(GetProcessHeap(), 0, pSid);
2787             *handled = TRUE;
2788             return ret;
2789         }
2790     }
2791     return ret;
2792 }
2793
2794 BOOL lookup_local_user_name( const LSA_UNICODE_STRING *account_and_domain,
2795                              PSID Sid, LPDWORD cbSid,
2796                              LPWSTR ReferencedDomainName,
2797                              LPDWORD cchReferencedDomainName,
2798                              PSID_NAME_USE peUse, BOOL *handled )
2799 {
2800     DWORD nameLen;
2801     LPWSTR userName = NULL;
2802     LSA_UNICODE_STRING account, domain;
2803     BOOL ret = TRUE;
2804
2805     *handled = FALSE;
2806     split_domain_account( account_and_domain, &account, &domain );
2807
2808     /* Let the current Unix user id masquerade as first Windows user account */
2809
2810     nameLen = UNLEN + 1;
2811     if (!(userName = HeapAlloc( GetProcessHeap(), 0, nameLen * sizeof(WCHAR) ))) return FALSE;
2812
2813     if (domain.Buffer)
2814     {
2815         /* check to make sure this account is on this computer */
2816         if (GetComputerNameW( userName, &nameLen ) &&
2817             (domain.Length / sizeof(WCHAR) != nameLen || strncmpW( domain.Buffer, userName, nameLen )))
2818         {
2819             SetLastError(ERROR_NONE_MAPPED);
2820             ret = FALSE;
2821         }
2822         nameLen = UNLEN + 1;
2823     }
2824
2825     if (GetUserNameW( userName, &nameLen ) &&
2826         account.Length / sizeof(WCHAR) == nameLen - 1 && !strncmpW( account.Buffer, userName, nameLen - 1 ))
2827     {
2828             ret = lookup_user_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse );
2829             *handled = TRUE;
2830     }
2831     else
2832     {
2833         nameLen = UNLEN + 1;
2834         if (GetComputerNameW( userName, &nameLen ) &&
2835             account.Length / sizeof(WCHAR) == nameLen && !strncmpW( account.Buffer, userName , nameLen ))
2836         {
2837             ret = lookup_computer_account_name( Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse );
2838             *handled = TRUE;
2839         }
2840     }
2841
2842     HeapFree(GetProcessHeap(), 0, userName);
2843     return ret;
2844 }
2845
2846 /******************************************************************************
2847  * LookupAccountNameW [ADVAPI32.@]
2848  */
2849 BOOL WINAPI LookupAccountNameW( LPCWSTR lpSystemName, LPCWSTR lpAccountName, PSID Sid,
2850                                 LPDWORD cbSid, LPWSTR ReferencedDomainName,
2851                                 LPDWORD cchReferencedDomainName, PSID_NAME_USE peUse )
2852 {
2853     BOOL ret, handled;
2854     LSA_UNICODE_STRING account;
2855
2856     TRACE("%s %s %p %p %p %p %p\n", debugstr_w(lpSystemName), debugstr_w(lpAccountName),
2857           Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse);
2858
2859     if (!ADVAPI_IsLocalComputer( lpSystemName ))
2860     {
2861         FIXME("remote computer not supported\n");
2862         SetLastError( RPC_S_SERVER_UNAVAILABLE );
2863         return FALSE;
2864     }
2865
2866     if (!lpAccountName || !strcmpW( lpAccountName, Blank ))
2867     {
2868         lpAccountName = BUILTIN;
2869     }
2870
2871     RtlInitUnicodeString( &account, lpAccountName );
2872
2873     /* Check well known SIDs first */
2874     ret = lookup_local_wellknown_name( &account, Sid, cbSid, ReferencedDomainName,
2875                                        cchReferencedDomainName, peUse, &handled );
2876     if (handled)
2877         return ret;
2878
2879     /* Check user names */
2880     ret = lookup_local_user_name( &account, Sid, cbSid, ReferencedDomainName,
2881                                   cchReferencedDomainName, peUse, &handled);
2882     if (handled)
2883         return ret;
2884
2885     SetLastError( ERROR_NONE_MAPPED );
2886     return FALSE;
2887 }
2888
2889 /******************************************************************************
2890  * PrivilegeCheck [ADVAPI32.@]
2891  */
2892 BOOL WINAPI PrivilegeCheck( HANDLE ClientToken, PPRIVILEGE_SET RequiredPrivileges, LPBOOL pfResult)
2893 {
2894     BOOL ret;
2895     BOOLEAN Result;
2896
2897     TRACE("%p %p %p\n", ClientToken, RequiredPrivileges, pfResult);
2898
2899     ret = set_ntstatus (NtPrivilegeCheck (ClientToken, RequiredPrivileges, &Result));
2900     if (ret)
2901         *pfResult = Result;
2902     return ret;
2903 }
2904
2905 /******************************************************************************
2906  * AccessCheckAndAuditAlarmA [ADVAPI32.@]
2907  */
2908 BOOL WINAPI AccessCheckAndAuditAlarmA(LPCSTR Subsystem, LPVOID HandleId, LPSTR ObjectTypeName,
2909   LPSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess,
2910   PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess,
2911   LPBOOL AccessStatus, LPBOOL pfGenerateOnClose)
2912 {
2913         FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_a(Subsystem),
2914                 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName),
2915                 SecurityDescriptor, DesiredAccess, GenericMapping,
2916                 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose);
2917         return TRUE;
2918 }
2919
2920 /******************************************************************************
2921  * AccessCheckAndAuditAlarmW [ADVAPI32.@]
2922  */
2923 BOOL WINAPI AccessCheckAndAuditAlarmW(LPCWSTR Subsystem, LPVOID HandleId, LPWSTR ObjectTypeName,
2924   LPWSTR ObjectName, PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD DesiredAccess,
2925   PGENERIC_MAPPING GenericMapping, BOOL ObjectCreation, LPDWORD GrantedAccess,
2926   LPBOOL AccessStatus, LPBOOL pfGenerateOnClose)
2927 {
2928         FIXME("stub (%s,%p,%s,%s,%p,%08x,%p,%x,%p,%p,%p)\n", debugstr_w(Subsystem),
2929                 HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName),
2930                 SecurityDescriptor, DesiredAccess, GenericMapping,
2931                 ObjectCreation, GrantedAccess, AccessStatus, pfGenerateOnClose);
2932         return TRUE;
2933 }
2934
2935 BOOL WINAPI ObjectCloseAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
2936 {
2937     FIXME("stub (%s,%p,%x)\n", debugstr_a(SubsystemName), HandleId, GenerateOnClose);
2938
2939     return TRUE;
2940 }
2941
2942 BOOL WINAPI ObjectCloseAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
2943 {
2944     FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose);
2945
2946     return TRUE;
2947 }
2948
2949 BOOL WINAPI ObjectDeleteAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, BOOL GenerateOnClose)
2950 {
2951     FIXME("stub (%s,%p,%x)\n", debugstr_w(SubsystemName), HandleId, GenerateOnClose);
2952
2953     return TRUE;
2954 }
2955
2956 BOOL WINAPI ObjectOpenAuditAlarmA(LPCSTR SubsystemName, LPVOID HandleId, LPSTR ObjectTypeName,
2957   LPSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess,
2958   DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted,
2959   LPBOOL GenerateOnClose)
2960 {
2961         FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_a(SubsystemName),
2962                 HandleId, debugstr_a(ObjectTypeName), debugstr_a(ObjectName), pSecurityDescriptor,
2963         ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted,
2964         GenerateOnClose);
2965
2966     return TRUE;
2967 }
2968
2969 BOOL WINAPI ObjectOpenAuditAlarmW(LPCWSTR SubsystemName, LPVOID HandleId, LPWSTR ObjectTypeName,
2970   LPWSTR ObjectName, PSECURITY_DESCRIPTOR pSecurityDescriptor, HANDLE ClientToken, DWORD DesiredAccess,
2971   DWORD GrantedAccess, PPRIVILEGE_SET Privileges, BOOL ObjectCreation, BOOL AccessGranted,
2972   LPBOOL GenerateOnClose)
2973 {
2974     FIXME("stub (%s,%p,%s,%s,%p,%p,0x%08x,0x%08x,%p,%x,%x,%p)\n", debugstr_w(SubsystemName),
2975         HandleId, debugstr_w(ObjectTypeName), debugstr_w(ObjectName), pSecurityDescriptor,
2976         ClientToken, DesiredAccess, GrantedAccess, Privileges, ObjectCreation, AccessGranted,
2977         GenerateOnClose);
2978
2979     return TRUE;
2980 }
2981
2982 BOOL WINAPI ObjectPrivilegeAuditAlarmA( LPCSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken,
2983   DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted)
2984 {
2985     FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_a(SubsystemName), HandleId, ClientToken,
2986           DesiredAccess, Privileges, AccessGranted);
2987
2988     return TRUE;
2989 }
2990
2991 BOOL WINAPI ObjectPrivilegeAuditAlarmW( LPCWSTR SubsystemName, LPVOID HandleId, HANDLE ClientToken,
2992   DWORD DesiredAccess, PPRIVILEGE_SET Privileges, BOOL AccessGranted)
2993 {
2994     FIXME("stub (%s,%p,%p,0x%08x,%p,%x)\n", debugstr_w(SubsystemName), HandleId, ClientToken,
2995           DesiredAccess, Privileges, AccessGranted);
2996
2997     return TRUE;
2998 }
2999
3000 BOOL WINAPI PrivilegedServiceAuditAlarmA( LPCSTR SubsystemName, LPCSTR ServiceName, HANDLE ClientToken,
3001                                    PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3002 {
3003     FIXME("stub (%s,%s,%p,%p,%x)\n", debugstr_a(SubsystemName), debugstr_a(ServiceName),
3004           ClientToken, Privileges, AccessGranted);
3005
3006     return TRUE;
3007 }
3008
3009 BOOL WINAPI PrivilegedServiceAuditAlarmW( LPCWSTR SubsystemName, LPCWSTR ServiceName, HANDLE ClientToken,
3010                                    PPRIVILEGE_SET Privileges, BOOL AccessGranted)
3011 {
3012     FIXME("stub %s,%s,%p,%p,%x)\n", debugstr_w(SubsystemName), debugstr_w(ServiceName),
3013           ClientToken, Privileges, AccessGranted);
3014
3015     return TRUE;
3016 }
3017
3018 /******************************************************************************
3019  * GetSecurityInfo [ADVAPI32.@]
3020  *
3021  * Retrieves a copy of the security descriptor associated with an object.
3022  *
3023  * PARAMS
3024  *  hObject              [I] A handle for the object.
3025  *  ObjectType           [I] The type of object.
3026  *  SecurityInfo         [I] A bitmask indicating what info to retrieve.
3027  *  ppsidOwner           [O] If non-null, receives a pointer to the owner SID.
3028  *  ppsidGroup           [O] If non-null, receives a pointer to the group SID.
3029  *  ppDacl               [O] If non-null, receives a pointer to the DACL.
3030  *  ppSacl               [O] If non-null, receives a pointer to the SACL.
3031  *  ppSecurityDescriptor [O] Receives a pointer to the security descriptor,
3032  *                           which must be freed with LocalFree.
3033  *
3034  * RETURNS
3035  *  ERROR_SUCCESS if all's well, and a WIN32 error code otherwise.
3036  */
3037 DWORD WINAPI GetSecurityInfo(
3038     HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3039     SECURITY_INFORMATION SecurityInfo, PSID *ppsidOwner,
3040     PSID *ppsidGroup, PACL *ppDacl, PACL *ppSacl,
3041     PSECURITY_DESCRIPTOR *ppSecurityDescriptor
3042 )
3043 {
3044     PSECURITY_DESCRIPTOR sd;
3045     NTSTATUS status;
3046     ULONG n1, n2;
3047     BOOL present, defaulted;
3048
3049     status = NtQuerySecurityObject(hObject, SecurityInfo, NULL, 0, &n1);
3050     if (status != STATUS_BUFFER_TOO_SMALL && status != STATUS_SUCCESS)
3051         return RtlNtStatusToDosError(status);
3052
3053     sd = LocalAlloc(0, n1);
3054     if (!sd)
3055         return ERROR_NOT_ENOUGH_MEMORY;
3056
3057     status = NtQuerySecurityObject(hObject, SecurityInfo, sd, n1, &n2);
3058     if (status != STATUS_SUCCESS)
3059     {
3060         LocalFree(sd);
3061         return RtlNtStatusToDosError(status);
3062     }
3063
3064     if (ppsidOwner)
3065     {
3066         *ppsidOwner = NULL;
3067         GetSecurityDescriptorOwner(sd, ppsidOwner, &defaulted);
3068     }
3069     if (ppsidGroup)
3070     {
3071         *ppsidGroup = NULL;
3072         GetSecurityDescriptorGroup(sd, ppsidGroup, &defaulted);
3073     }
3074     if (ppDacl)
3075     {
3076         *ppDacl = NULL;
3077         GetSecurityDescriptorDacl(sd, &present, ppDacl, &defaulted);
3078     }
3079     if (ppSacl)
3080     {
3081         *ppSacl = NULL;
3082         GetSecurityDescriptorSacl(sd, &present, ppSacl, &defaulted);
3083     }
3084     if (ppSecurityDescriptor)
3085         *ppSecurityDescriptor = sd;
3086
3087     /* The security descriptor (sd) cannot be freed if ppSecurityDescriptor is
3088      * NULL, because native happily returns the SIDs and ACLs that are requested
3089      * in this case.
3090      */
3091
3092     return ERROR_SUCCESS;
3093 }
3094
3095 /******************************************************************************
3096  * GetSecurityInfoExA [ADVAPI32.@]
3097  */
3098 DWORD WINAPI GetSecurityInfoExA(
3099         HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3100         SECURITY_INFORMATION SecurityInfo, LPCSTR lpProvider,
3101         LPCSTR lpProperty, PACTRL_ACCESSA *ppAccessList,
3102         PACTRL_AUDITA *ppAuditList, LPSTR *lppOwner, LPSTR *lppGroup
3103 )
3104 {
3105   FIXME("stub!\n");
3106   return ERROR_BAD_PROVIDER;
3107 }
3108
3109 /******************************************************************************
3110  * GetSecurityInfoExW [ADVAPI32.@]
3111  */
3112 DWORD WINAPI GetSecurityInfoExW(
3113         HANDLE hObject, SE_OBJECT_TYPE ObjectType,
3114         SECURITY_INFORMATION SecurityInfo, LPCWSTR lpProvider,
3115         LPCWSTR lpProperty, PACTRL_ACCESSW *ppAccessList,
3116         PACTRL_AUDITW *ppAuditList, LPWSTR *lppOwner, LPWSTR *lppGroup
3117 )
3118 {
3119   FIXME("stub!\n");
3120   return ERROR_BAD_PROVIDER;
3121 }
3122
3123 /******************************************************************************
3124  * BuildExplicitAccessWithNameA [ADVAPI32.@]
3125  */
3126 VOID WINAPI BuildExplicitAccessWithNameA( PEXPLICIT_ACCESSA pExplicitAccess,
3127                                           LPSTR pTrusteeName, DWORD AccessPermissions,
3128                                           ACCESS_MODE AccessMode, DWORD Inheritance )
3129 {
3130     TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_a(pTrusteeName),
3131           AccessPermissions, AccessMode, Inheritance);
3132
3133     pExplicitAccess->grfAccessPermissions = AccessPermissions;
3134     pExplicitAccess->grfAccessMode = AccessMode;
3135     pExplicitAccess->grfInheritance = Inheritance;
3136
3137     pExplicitAccess->Trustee.pMultipleTrustee = NULL;
3138     pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3139     pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3140     pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3141     pExplicitAccess->Trustee.ptstrName = pTrusteeName;
3142 }
3143
3144 /******************************************************************************
3145  * BuildExplicitAccessWithNameW [ADVAPI32.@]
3146  */
3147 VOID WINAPI BuildExplicitAccessWithNameW( PEXPLICIT_ACCESSW pExplicitAccess,
3148                                           LPWSTR pTrusteeName, DWORD AccessPermissions,
3149                                           ACCESS_MODE AccessMode, DWORD Inheritance )
3150 {
3151     TRACE("%p %s 0x%08x 0x%08x 0x%08x\n", pExplicitAccess, debugstr_w(pTrusteeName),
3152           AccessPermissions, AccessMode, Inheritance);
3153
3154     pExplicitAccess->grfAccessPermissions = AccessPermissions;
3155     pExplicitAccess->grfAccessMode = AccessMode;
3156     pExplicitAccess->grfInheritance = Inheritance;
3157
3158     pExplicitAccess->Trustee.pMultipleTrustee = NULL;
3159     pExplicitAccess->Trustee.MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3160     pExplicitAccess->Trustee.TrusteeForm = TRUSTEE_IS_NAME;
3161     pExplicitAccess->Trustee.TrusteeType = TRUSTEE_IS_UNKNOWN;
3162     pExplicitAccess->Trustee.ptstrName = pTrusteeName;
3163 }
3164
3165 /******************************************************************************
3166  * BuildTrusteeWithObjectsAndNameA [ADVAPI32.@]
3167  */
3168 VOID WINAPI BuildTrusteeWithObjectsAndNameA( PTRUSTEEA pTrustee, POBJECTS_AND_NAME_A pObjName,
3169                                              SE_OBJECT_TYPE ObjectType, LPSTR ObjectTypeName,
3170                                              LPSTR InheritedObjectTypeName, LPSTR Name )
3171 {
3172     DWORD ObjectsPresent = 0;
3173
3174     TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
3175           ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_a(Name));
3176
3177     /* Fill the OBJECTS_AND_NAME structure */
3178     pObjName->ObjectType = ObjectType;
3179     if (ObjectTypeName != NULL)
3180     {
3181         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3182     }
3183
3184     pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
3185     if (InheritedObjectTypeName != NULL)
3186     {
3187         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3188     }
3189
3190     pObjName->ObjectsPresent = ObjectsPresent;
3191     pObjName->ptstrName = Name;
3192
3193     /* Fill the TRUSTEE structure */
3194     pTrustee->pMultipleTrustee = NULL;
3195     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3196     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
3197     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3198     pTrustee->ptstrName = (LPSTR)pObjName;
3199 }
3200
3201 /******************************************************************************
3202  * BuildTrusteeWithObjectsAndNameW [ADVAPI32.@]
3203  */
3204 VOID WINAPI BuildTrusteeWithObjectsAndNameW( PTRUSTEEW pTrustee, POBJECTS_AND_NAME_W pObjName,
3205                                              SE_OBJECT_TYPE ObjectType, LPWSTR ObjectTypeName,
3206                                              LPWSTR InheritedObjectTypeName, LPWSTR Name )
3207 {
3208     DWORD ObjectsPresent = 0;
3209
3210     TRACE("%p %p 0x%08x %p %p %s\n", pTrustee, pObjName,
3211           ObjectType, ObjectTypeName, InheritedObjectTypeName, debugstr_w(Name));
3212
3213     /* Fill the OBJECTS_AND_NAME structure */
3214     pObjName->ObjectType = ObjectType;
3215     if (ObjectTypeName != NULL)
3216     {
3217         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3218     }
3219
3220     pObjName->InheritedObjectTypeName = InheritedObjectTypeName;
3221     if (InheritedObjectTypeName != NULL)
3222     {
3223         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3224     }
3225
3226     pObjName->ObjectsPresent = ObjectsPresent;
3227     pObjName->ptstrName = Name;
3228
3229     /* Fill the TRUSTEE structure */
3230     pTrustee->pMultipleTrustee = NULL;
3231     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3232     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_NAME;
3233     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3234     pTrustee->ptstrName = (LPWSTR)pObjName;
3235 }
3236
3237 /******************************************************************************
3238  * BuildTrusteeWithObjectsAndSidA [ADVAPI32.@]
3239  */
3240 VOID WINAPI BuildTrusteeWithObjectsAndSidA( PTRUSTEEA pTrustee, POBJECTS_AND_SID pObjSid,
3241                                             GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid )
3242 {
3243     DWORD ObjectsPresent = 0;
3244
3245     TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
3246
3247     /* Fill the OBJECTS_AND_SID structure */
3248     if (pObjectGuid != NULL)
3249     {
3250         pObjSid->ObjectTypeGuid = *pObjectGuid;
3251         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3252     }
3253     else
3254     {
3255         ZeroMemory(&pObjSid->ObjectTypeGuid,
3256                    sizeof(GUID));
3257     }
3258
3259     if (pInheritedObjectGuid != NULL)
3260     {
3261         pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
3262         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3263     }
3264     else
3265     {
3266         ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
3267                    sizeof(GUID));
3268     }
3269
3270     pObjSid->ObjectsPresent = ObjectsPresent;
3271     pObjSid->pSid = pSid;
3272
3273     /* Fill the TRUSTEE structure */
3274     pTrustee->pMultipleTrustee = NULL;
3275     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3276     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
3277     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3278     pTrustee->ptstrName = (LPSTR) pObjSid;
3279 }
3280
3281 /******************************************************************************
3282  * BuildTrusteeWithObjectsAndSidW [ADVAPI32.@]
3283  */
3284 VOID WINAPI BuildTrusteeWithObjectsAndSidW( PTRUSTEEW pTrustee, POBJECTS_AND_SID pObjSid,
3285                                             GUID* pObjectGuid, GUID* pInheritedObjectGuid, PSID pSid )
3286 {
3287     DWORD ObjectsPresent = 0;
3288
3289     TRACE("%p %p %p %p %p\n", pTrustee, pObjSid, pObjectGuid, pInheritedObjectGuid, pSid);
3290
3291     /* Fill the OBJECTS_AND_SID structure */
3292     if (pObjectGuid != NULL)
3293     {
3294         pObjSid->ObjectTypeGuid = *pObjectGuid;
3295         ObjectsPresent |= ACE_OBJECT_TYPE_PRESENT;
3296     }
3297     else
3298     {
3299         ZeroMemory(&pObjSid->ObjectTypeGuid,
3300                    sizeof(GUID));
3301     }
3302
3303     if (pInheritedObjectGuid != NULL)
3304     {
3305         pObjSid->InheritedObjectTypeGuid = *pInheritedObjectGuid;
3306         ObjectsPresent |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
3307     }
3308     else
3309     {
3310         ZeroMemory(&pObjSid->InheritedObjectTypeGuid,
3311                    sizeof(GUID));
3312     }
3313
3314     pObjSid->ObjectsPresent = ObjectsPresent;
3315     pObjSid->pSid = pSid;
3316
3317     /* Fill the TRUSTEE structure */
3318     pTrustee->pMultipleTrustee = NULL;
3319     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3320     pTrustee->TrusteeForm = TRUSTEE_IS_OBJECTS_AND_SID;
3321     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3322     pTrustee->ptstrName = (LPWSTR) pObjSid;
3323 }
3324
3325 /******************************************************************************
3326  * BuildTrusteeWithSidA [ADVAPI32.@]
3327  */
3328 VOID WINAPI BuildTrusteeWithSidA(PTRUSTEEA pTrustee, PSID pSid)
3329 {
3330     TRACE("%p %p\n", pTrustee, pSid);
3331
3332     pTrustee->pMultipleTrustee = NULL;
3333     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3334     pTrustee->TrusteeForm = TRUSTEE_IS_SID;
3335     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3336     pTrustee->ptstrName = pSid;
3337 }
3338
3339 /******************************************************************************
3340  * BuildTrusteeWithSidW [ADVAPI32.@]
3341  */
3342 VOID WINAPI BuildTrusteeWithSidW(PTRUSTEEW pTrustee, PSID pSid)
3343 {
3344     TRACE("%p %p\n", pTrustee, pSid);
3345
3346     pTrustee->pMultipleTrustee = NULL;
3347     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3348     pTrustee->TrusteeForm = TRUSTEE_IS_SID;
3349     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3350     pTrustee->ptstrName = pSid;
3351 }
3352
3353 /******************************************************************************
3354  * BuildTrusteeWithNameA [ADVAPI32.@]
3355  */
3356 VOID WINAPI BuildTrusteeWithNameA(PTRUSTEEA pTrustee, LPSTR name)
3357 {
3358     TRACE("%p %s\n", pTrustee, debugstr_a(name) );
3359
3360     pTrustee->pMultipleTrustee = NULL;
3361     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3362     pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
3363     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3364     pTrustee->ptstrName = name;
3365 }
3366
3367 /******************************************************************************
3368  * BuildTrusteeWithNameW [ADVAPI32.@]
3369  */
3370 VOID WINAPI BuildTrusteeWithNameW(PTRUSTEEW pTrustee, LPWSTR name)
3371 {
3372     TRACE("%p %s\n", pTrustee, debugstr_w(name) );
3373
3374     pTrustee->pMultipleTrustee = NULL;
3375     pTrustee->MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
3376     pTrustee->TrusteeForm = TRUSTEE_IS_NAME;
3377     pTrustee->TrusteeType = TRUSTEE_IS_UNKNOWN;
3378     pTrustee->ptstrName = name;
3379 }
3380
3381 /******************************************************************************
3382  * GetTrusteeFormA [ADVAPI32.@]
3383  */
3384 TRUSTEE_FORM WINAPI GetTrusteeFormA(PTRUSTEEA pTrustee)
3385 {
3386     TRACE("(%p)\n", pTrustee);
3387
3388     if (!pTrustee)
3389         return TRUSTEE_BAD_FORM;
3390
3391     return pTrustee->TrusteeForm;
3392 }
3393
3394 /******************************************************************************
3395  * GetTrusteeFormW [ADVAPI32.@]
3396  */
3397 TRUSTEE_FORM WINAPI GetTrusteeFormW(PTRUSTEEW pTrustee)
3398 {
3399     TRACE("(%p)\n", pTrustee);
3400
3401     if (!pTrustee)
3402         return TRUSTEE_BAD_FORM;
3403
3404     return pTrustee->TrusteeForm;
3405 }
3406
3407 /******************************************************************************
3408  * GetTrusteeNameA [ADVAPI32.@]
3409  */
3410 LPSTR WINAPI GetTrusteeNameA(PTRUSTEEA pTrustee)
3411 {
3412     TRACE("(%p)\n", pTrustee);
3413
3414     if (!pTrustee)
3415         return NULL;
3416
3417     return pTrustee->ptstrName;
3418 }
3419
3420 /******************************************************************************
3421  * GetTrusteeNameW [ADVAPI32.@]
3422  */
3423 LPWSTR WINAPI GetTrusteeNameW(PTRUSTEEW pTrustee)
3424 {
3425     TRACE("(%p)\n", pTrustee);
3426
3427     if (!pTrustee)
3428         return NULL;
3429
3430     return pTrustee->ptstrName;
3431 }
3432
3433 /******************************************************************************
3434  * GetTrusteeTypeA [ADVAPI32.@]
3435  */
3436 TRUSTEE_TYPE WINAPI GetTrusteeTypeA(PTRUSTEEA pTrustee)
3437 {
3438     TRACE("(%p)\n", pTrustee);
3439
3440     if (!pTrustee)
3441         return TRUSTEE_IS_UNKNOWN;
3442
3443     return pTrustee->TrusteeType;
3444 }
3445
3446 /******************************************************************************
3447  * GetTrusteeTypeW [ADVAPI32.@]
3448  */
3449 TRUSTEE_TYPE WINAPI GetTrusteeTypeW(PTRUSTEEW pTrustee)
3450 {
3451     TRACE("(%p)\n", pTrustee);
3452
3453     if (!pTrustee)
3454         return TRUSTEE_IS_UNKNOWN;
3455
3456     return pTrustee->TrusteeType;
3457 }
3458
3459 BOOL WINAPI SetAclInformation( PACL pAcl, LPVOID pAclInformation,
3460                                DWORD nAclInformationLength,
3461                                ACL_INFORMATION_CLASS dwAclInformationClass )
3462 {
3463     FIXME("%p %p 0x%08x 0x%08x - stub\n", pAcl, pAclInformation,
3464           nAclInformationLength, dwAclInformationClass);
3465
3466     return TRUE;
3467 }
3468
3469 static DWORD trustee_name_A_to_W(TRUSTEE_FORM form, char *trustee_nameA, WCHAR **ptrustee_nameW)
3470 {
3471     switch (form)
3472     {
3473     case TRUSTEE_IS_NAME:
3474     {
3475         *ptrustee_nameW = SERV_dup(trustee_nameA);
3476         return ERROR_SUCCESS;
3477     }
3478     case TRUSTEE_IS_OBJECTS_AND_NAME:
3479     {
3480         OBJECTS_AND_NAME_A *objA = (OBJECTS_AND_NAME_A *)trustee_nameA;
3481         OBJECTS_AND_NAME_W *objW = NULL;
3482
3483         if (objA)
3484         {
3485             if (!(objW = HeapAlloc( GetProcessHeap(), 0, sizeof(OBJECTS_AND_NAME_W) )))
3486                 return ERROR_NOT_ENOUGH_MEMORY;
3487
3488             objW->ObjectsPresent = objA->ObjectsPresent;
3489             objW->ObjectType = objA->ObjectType;
3490             objW->ObjectTypeName = SERV_dup(objA->ObjectTypeName);
3491             objW->InheritedObjectTypeName = SERV_dup(objA->InheritedObjectTypeName);
3492             objW->ptstrName = SERV_dup(objA->ptstrName);
3493         }
3494
3495         *ptrustee_nameW = (WCHAR *)objW;
3496         return ERROR_SUCCESS;
3497     }
3498     /* These forms do not require conversion. */
3499     case TRUSTEE_IS_SID:
3500     case TRUSTEE_IS_OBJECTS_AND_SID:
3501         *ptrustee_nameW = (WCHAR *)trustee_nameA;
3502         return ERROR_SUCCESS;
3503     default:
3504         return ERROR_INVALID_PARAMETER;
3505     }
3506 }
3507
3508 static void free_trustee_name(TRUSTEE_FORM form, WCHAR *trustee_nameW)
3509 {
3510     switch (form)
3511     {
3512     case TRUSTEE_IS_NAME:
3513         HeapFree( GetProcessHeap(), 0, trustee_nameW );
3514         break;
3515     case TRUSTEE_IS_OBJECTS_AND_NAME:
3516     {
3517         OBJECTS_AND_NAME_W *objW = (OBJECTS_AND_NAME_W *)trustee_nameW;
3518
3519         if (objW)
3520         {
3521             HeapFree( GetProcessHeap(), 0, objW->ptstrName );
3522             HeapFree( GetProcessHeap(), 0, objW->InheritedObjectTypeName );
3523             HeapFree( GetProcessHeap(), 0, objW->ObjectTypeName );
3524             HeapFree( GetProcessHeap(), 0, objW );
3525         }
3526
3527         break;
3528     }
3529     /* Other forms did not require allocation, so no freeing is necessary. */
3530     default:
3531         break;
3532     }
3533 }
3534
3535 /******************************************************************************
3536  * SetEntriesInAclA [ADVAPI32.@]
3537  */
3538 DWORD WINAPI SetEntriesInAclA( ULONG count, PEXPLICIT_ACCESSA pEntries,
3539                                PACL OldAcl, PACL* NewAcl )
3540 {
3541     DWORD err = ERROR_SUCCESS;
3542     EXPLICIT_ACCESSW *pEntriesW;
3543     UINT alloc_index, free_index;
3544
3545     TRACE("%d %p %p %p\n", count, pEntries, OldAcl, NewAcl);
3546
3547     if (NewAcl)
3548         *NewAcl = NULL;
3549
3550     if (!count && !OldAcl)
3551         return ERROR_SUCCESS;
3552
3553     pEntriesW = HeapAlloc( GetProcessHeap(), 0, count * sizeof(EXPLICIT_ACCESSW) );
3554     if (!pEntriesW)
3555         return ERROR_NOT_ENOUGH_MEMORY;
3556
3557     for (alloc_index = 0; alloc_index < count; ++alloc_index)
3558     {
3559         pEntriesW[alloc_index].grfAccessPermissions = pEntries[alloc_index].grfAccessPermissions;
3560         pEntriesW[alloc_index].grfAccessMode = pEntries[alloc_index].grfAccessMode;
3561         pEntriesW[alloc_index].grfInheritance = pEntries[alloc_index].grfInheritance;
3562         pEntriesW[alloc_index].Trustee.pMultipleTrustee = NULL; /* currently not supported */
3563         pEntriesW[alloc_index].Trustee.MultipleTrusteeOperation = pEntries[alloc_index].Trustee.MultipleTrusteeOperation;
3564         pEntriesW[alloc_index].Trustee.TrusteeForm = pEntries[alloc_index].Trustee.TrusteeForm;
3565         pEntriesW[alloc_index].Trustee.TrusteeType = pEntries[alloc_index].Trustee.TrusteeType;
3566
3567         err = trustee_name_A_to_W( pEntries[alloc_index].Trustee.TrusteeForm,
3568                                    pEntries[alloc_index].Trustee.ptstrName,
3569                                    &pEntriesW[alloc_index].Trustee.ptstrName );
3570         if (err != ERROR_SUCCESS)
3571         {
3572             if (err == ERROR_INVALID_PARAMETER)
3573                 WARN("bad trustee form %d for trustee %d\n",
3574                      pEntries[alloc_index].Trustee.TrusteeForm, alloc_index);
3575
3576             goto cleanup;
3577         }
3578     }
3579
3580     err = SetEntriesInAclW( count, pEntriesW, OldAcl, NewAcl );
3581
3582 cleanup:
3583     /* Free any previously allocated trustee name buffers, taking into account
3584      * a possible out-of-memory condition while building the EXPLICIT_ACCESSW
3585      * list. */
3586     for (free_index = 0; free_index < alloc_index; ++free_index)
3587         free_trustee_name( pEntriesW[free_index].Trustee.TrusteeForm, pEntriesW[free_index].Trustee.ptstrName );
3588
3589     HeapFree( GetProcessHeap(), 0, pEntriesW );
3590     return err;
3591 }
3592
3593 /******************************************************************************
3594  * SetEntriesInAclW [ADVAPI32.@]
3595  */
3596 DWORD WINAPI SetEntriesInAclW( ULONG count, PEXPLICIT_ACCESSW pEntries,
3597                                PACL OldAcl, PACL* NewAcl )
3598 {
3599     ULONG i;
3600     PSID *ppsid;
3601     DWORD ret = ERROR_SUCCESS;
3602     DWORD acl_size = sizeof(ACL);
3603     NTSTATUS status;
3604
3605     TRACE("%d %p %p %p\n", count, pEntries, OldAcl, NewAcl);
3606
3607     if (NewAcl)
3608         *NewAcl = NULL;
3609
3610     if (!count && !OldAcl)
3611         return ERROR_SUCCESS;
3612
3613     /* allocate array of maximum sized sids allowed */
3614     ppsid = HeapAlloc(GetProcessHeap(), 0, count * (sizeof(SID *) + FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES])));
3615     if (!ppsid)
3616         return ERROR_OUTOFMEMORY;
3617
3618     for (i = 0; i < count; i++)
3619     {
3620         ppsid[i] = (char *)&ppsid[count] + i * FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]);
3621
3622         TRACE("[%d]:\n\tgrfAccessPermissions = 0x%x\n\tgrfAccessMode = %d\n\tgrfInheritance = 0x%x\n\t"
3623               "Trustee.pMultipleTrustee = %p\n\tMultipleTrusteeOperation = %d\n\tTrusteeForm = %d\n\t"
3624               "Trustee.TrusteeType = %d\n\tptstrName = %p\n", i,
3625               pEntries[i].grfAccessPermissions, pEntries[i].grfAccessMode, pEntries[i].grfInheritance,
3626               pEntries[i].Trustee.pMultipleTrustee, pEntries[i].Trustee.MultipleTrusteeOperation,
3627               pEntries[i].Trustee.TrusteeForm, pEntries[i].Trustee.TrusteeType,
3628               pEntries[i].Trustee.ptstrName);
3629
3630         if (pEntries[i].Trustee.MultipleTrusteeOperation == TRUSTEE_IS_IMPERSONATE)
3631         {
3632             WARN("bad multiple trustee operation %d for trustee %d\n", pEntries[i].Trustee.MultipleTrusteeOperation, i);
3633             ret = ERROR_INVALID_PARAMETER;
3634             goto exit;
3635         }
3636
3637         switch (pEntries[i].Trustee.TrusteeForm)
3638         {
3639         case TRUSTEE_IS_SID:
3640             if (!CopySid(FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]),
3641                          ppsid[i], pEntries[i].Trustee.ptstrName))
3642             {
3643                 WARN("bad sid %p for trustee %d\n", pEntries[i].Trustee.ptstrName, i);
3644                 ret = ERROR_INVALID_PARAMETER;
3645                 goto exit;
3646             }
3647             break;
3648         case TRUSTEE_IS_NAME:
3649         {
3650             DWORD sid_size = FIELD_OFFSET(SID, SubAuthority[SID_MAX_SUB_AUTHORITIES]);
3651             DWORD domain_size = MAX_COMPUTERNAME_LENGTH + 1;
3652             SID_NAME_USE use;
3653             if (!strcmpW( pEntries[i].Trustee.ptstrName, CURRENT_USER ))
3654             {
3655                 if (!lookup_user_account_name( ppsid[i], &sid_size, NULL, &domain_size, &use ))
3656                 {
3657                     ret = GetLastError();
3658                     goto exit;
3659                 }
3660             }
3661             else if (!LookupAccountNameW(NULL, pEntries[i].Trustee.ptstrName, ppsid[i], &sid_size, NULL, &domain_size, &use))
3662             {
3663                 WARN("bad user name %s for trustee %d\n", debugstr_w(pEntries[i].Trustee.ptstrName), i);
3664                 ret = ERROR_INVALID_PARAMETER;
3665                 goto exit;
3666             }
3667             break;
3668         }
3669         case TRUSTEE_IS_OBJECTS_AND_SID:
3670             FIXME("TRUSTEE_IS_OBJECTS_AND_SID unimplemented\n");
3671             break;
3672         case TRUSTEE_IS_OBJECTS_AND_NAME:
3673             FIXME("TRUSTEE_IS_OBJECTS_AND_NAME unimplemented\n");
3674             break;
3675         default:
3676             WARN("bad trustee form %d for trustee %d\n", pEntries[i].Trustee.TrusteeForm, i);
3677             ret = ERROR_INVALID_PARAMETER;
3678             goto exit;
3679         }
3680
3681         /* Note: we overestimate the ACL size here as a tradeoff between
3682          * instructions (simplicity) and memory */
3683         switch (pEntries[i].grfAccessMode)
3684         {
3685         case GRANT_ACCESS:
3686         case SET_ACCESS:
3687             acl_size += FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart) + GetLengthSid(ppsid[i]);
3688             break;
3689         case DENY_ACCESS:
3690             acl_size += FIELD_OFFSET(ACCESS_DENIED_ACE, SidStart) + GetLengthSid(ppsid[i]);
3691             break;
3692         case SET_AUDIT_SUCCESS:
3693         case SET_AUDIT_FAILURE:
3694             acl_size += FIELD_OFFSET(SYSTEM_AUDIT_ACE, SidStart) + GetLengthSid(ppsid[i]);
3695             break;
3696         case REVOKE_ACCESS:
3697             break;
3698         default:
3699             WARN("bad access mode %d for trustee %d\n", pEntries[i].grfAccessMode, i);
3700             ret = ERROR_INVALID_PARAMETER;
3701             goto exit;
3702         }
3703     }
3704
3705     if (OldAcl)
3706     {
3707         ACL_SIZE_INFORMATION size_info;
3708
3709         status = RtlQueryInformationAcl(OldAcl, &size_info, sizeof(size_info), AclSizeInformation);
3710         if (status != STATUS_SUCCESS)
3711         {
3712             ret = RtlNtStatusToDosError(status);
3713             goto exit;
3714         }
3715         acl_size += size_info.AclBytesInUse - sizeof(ACL);
3716     }
3717
3718     *NewAcl = LocalAlloc(0, acl_size);
3719     if (!*NewAcl)
3720     {
3721         ret = ERROR_OUTOFMEMORY;
3722         goto exit;
3723     }
3724
3725     status = RtlCreateAcl( *NewAcl, acl_size, ACL_REVISION );
3726     if (status != STATUS_SUCCESS)
3727     {
3728         ret = RtlNtStatusToDosError(status);
3729         goto exit;
3730     }
3731
3732     for (i = 0; i < count; i++)
3733     {
3734         switch (pEntries[i].grfAccessMode)
3735         {
3736         case GRANT_ACCESS:
3737             status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION,
3738                                               pEntries[i].grfInheritance,
3739                                               pEntries[i].grfAccessPermissions,
3740                                               ppsid[i]);
3741             break;
3742         case SET_ACCESS:
3743         {
3744             ULONG j;
3745             BOOL add = TRUE;
3746             if (OldAcl)
3747             {
3748                 for (j = 0; ; j++)
3749                 {
3750                     const ACE_HEADER *existing_ace_header;
3751                     status = RtlGetAce(OldAcl, j, (LPVOID *)&existing_ace_header);
3752                     if (status != STATUS_SUCCESS)
3753                         break;
3754                     if (pEntries[i].grfAccessMode == SET_ACCESS &&
3755                         existing_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE &&
3756                         EqualSid(ppsid[i], &((ACCESS_ALLOWED_ACE *)existing_ace_header)->SidStart))
3757                     {
3758                         add = FALSE;
3759                         break;
3760                     }
3761                 }
3762             }
3763             if (add)
3764                 status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION,
3765                                                   pEntries[i].grfInheritance,
3766                                                   pEntries[i].grfAccessPermissions,
3767                                                   ppsid[i]);
3768             break;
3769         }
3770         case DENY_ACCESS:
3771             status = RtlAddAccessDeniedAceEx(*NewAcl, ACL_REVISION,
3772                                              pEntries[i].grfInheritance,
3773                                              pEntries[i].grfAccessPermissions,
3774                                              ppsid[i]);
3775             break;
3776         case SET_AUDIT_SUCCESS:
3777             status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION,
3778                                             pEntries[i].grfInheritance,
3779                                             pEntries[i].grfAccessPermissions,
3780                                             ppsid[i], TRUE, FALSE);
3781             break;
3782         case SET_AUDIT_FAILURE:
3783             status = RtlAddAuditAccessAceEx(*NewAcl, ACL_REVISION,
3784                                             pEntries[i].grfInheritance,
3785                                             pEntries[i].grfAccessPermissions,
3786                                             ppsid[i], FALSE, TRUE);
3787             break;
3788         default:
3789             FIXME("unhandled access mode %d\n", pEntries[i].grfAccessMode);
3790         }
3791     }
3792
3793     if (OldAcl)
3794     {
3795         for (i = 0; ; i++)
3796         {
3797             BOOL add = TRUE;
3798             ULONG j;
3799             const ACE_HEADER *old_ace_header;
3800             status = RtlGetAce(OldAcl, i, (LPVOID *)&old_ace_header);
3801             if (status != STATUS_SUCCESS) break;
3802             for (j = 0; j < count; j++)
3803             {
3804                 if (pEntries[j].grfAccessMode == SET_ACCESS &&
3805                     old_ace_header->AceType == ACCESS_ALLOWED_ACE_TYPE &&
3806                     EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart))
3807                 {
3808                     status = RtlAddAccessAllowedAceEx(*NewAcl, ACL_REVISION, pEntries[j].grfInheritance, pEntries[j].grfAccessPermissions, ppsid[j]);
3809                     add = FALSE;
3810                     break;
3811                 }
3812                 else if (pEntries[j].grfAccessMode == REVOKE_ACCESS)
3813                 {
3814                     switch (old_ace_header->AceType)
3815                     {
3816                     case ACCESS_ALLOWED_ACE_TYPE:
3817                         if (EqualSid(ppsid[j], &((ACCESS_ALLOWED_ACE *)old_ace_header)->SidStart))
3818                             add = FALSE;
3819                         break;
3820                     case ACCESS_DENIED_ACE_TYPE:
3821                         if (EqualSid(ppsid[j], &((ACCESS_DENIED_ACE *)old_ace_header)->SidStart))
3822                             add = FALSE;
3823                         break;
3824                     case SYSTEM_AUDIT_ACE_TYPE:
3825                         if (EqualSid(ppsid[j], &((SYSTEM_AUDIT_ACE *)old_ace_header)->SidStart))
3826                             add = FALSE;
3827                         break;
3828                     case SYSTEM_ALARM_ACE_TYPE:
3829                         if (EqualSid(ppsid[j], &((SYSTEM_ALARM_ACE *)old_ace_header)->SidStart))
3830                             add = FALSE;
3831                         break;
3832                     default:
3833                         FIXME("unhandled ace type %d\n", old_ace_header->AceType);
3834                     }
3835
3836                     if (!add)
3837                         break;
3838                 }
3839             }
3840             if (add)
3841                 status = RtlAddAce(*NewAcl, ACL_REVISION, 1, (PACE_HEADER)old_ace_header, old_ace_header->AceSize);
3842             if (status != STATUS_SUCCESS)
3843             {
3844                 WARN("RtlAddAce failed with error 0x%08x\n", status);
3845                 ret = RtlNtStatusToDosError(status);
3846                 break;
3847             }
3848         }
3849     }
3850
3851 exit:
3852     HeapFree(GetProcessHeap(), 0, ppsid);
3853     return ret;
3854 }
3855
3856 /******************************************************************************
3857  * SetNamedSecurityInfoA [ADVAPI32.@]
3858  */
3859 DWORD WINAPI SetNamedSecurityInfoA(LPSTR pObjectName,
3860         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
3861         PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
3862 {
3863     LPWSTR wstr;
3864     DWORD r;
3865
3866     TRACE("%s %d %d %p %p %p %p\n", debugstr_a(pObjectName), ObjectType,
3867            SecurityInfo, psidOwner, psidGroup, pDacl, pSacl);
3868
3869     wstr = SERV_dup(pObjectName);
3870     r = SetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, psidOwner,
3871                            psidGroup, pDacl, pSacl );
3872
3873     HeapFree( GetProcessHeap(), 0, wstr );
3874
3875     return r;
3876 }
3877
3878 BOOL WINAPI SetPrivateObjectSecurity( SECURITY_INFORMATION SecurityInformation,
3879     PSECURITY_DESCRIPTOR ModificationDescriptor,
3880     PSECURITY_DESCRIPTOR* ObjectsSecurityDescriptor,
3881     PGENERIC_MAPPING GenericMapping,
3882     HANDLE Token )
3883 {
3884     FIXME("0x%08x %p %p %p %p - stub\n", SecurityInformation, ModificationDescriptor,
3885           ObjectsSecurityDescriptor, GenericMapping, Token);
3886
3887     return TRUE;
3888 }
3889
3890 BOOL WINAPI AreAllAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess )
3891 {
3892     return RtlAreAllAccessesGranted( GrantedAccess, DesiredAccess );
3893 }
3894
3895 /******************************************************************************
3896  * AreAnyAccessesGranted [ADVAPI32.@]
3897  *
3898  * Determines whether or not any of a set of specified access permissions have
3899  * been granted or not.
3900  *
3901  * PARAMS
3902  *   GrantedAccess [I] The permissions that have been granted.
3903  *   DesiredAccess [I] The permissions that you want to have.
3904  *
3905  * RETURNS
3906  *   Nonzero if any of the permissions have been granted, zero if none of the
3907  *   permissions have been granted.
3908  */
3909
3910 BOOL WINAPI AreAnyAccessesGranted( DWORD GrantedAccess, DWORD DesiredAccess )
3911 {
3912     return RtlAreAnyAccessesGranted( GrantedAccess, DesiredAccess );
3913 }
3914
3915 /******************************************************************************
3916  * SetNamedSecurityInfoW [ADVAPI32.@]
3917  */
3918 DWORD WINAPI SetNamedSecurityInfoW(LPWSTR pObjectName,
3919         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
3920         PSID psidOwner, PSID psidGroup, PACL pDacl, PACL pSacl)
3921 {
3922     FIXME("%s %d %d %p %p %p %p\n", debugstr_w(pObjectName), ObjectType,
3923            SecurityInfo, psidOwner, psidGroup, pDacl, pSacl);
3924     return ERROR_SUCCESS;
3925 }
3926
3927 /******************************************************************************
3928  * GetExplicitEntriesFromAclA [ADVAPI32.@]
3929  */
3930 DWORD WINAPI GetExplicitEntriesFromAclA( PACL pacl, PULONG pcCountOfExplicitEntries,
3931         PEXPLICIT_ACCESSA* pListOfExplicitEntries)
3932 {
3933     FIXME("%p %p %p\n",pacl, pcCountOfExplicitEntries, pListOfExplicitEntries);
3934     return ERROR_CALL_NOT_IMPLEMENTED;
3935 }
3936
3937 /******************************************************************************
3938  * GetExplicitEntriesFromAclW [ADVAPI32.@]
3939  */
3940 DWORD WINAPI GetExplicitEntriesFromAclW( PACL pacl, PULONG pcCountOfExplicitEntries,
3941         PEXPLICIT_ACCESSW* pListOfExplicitEntries)
3942 {
3943     FIXME("%p %p %p\n",pacl, pcCountOfExplicitEntries, pListOfExplicitEntries);
3944     return ERROR_CALL_NOT_IMPLEMENTED;
3945 }
3946
3947 /******************************************************************************
3948  * GetAuditedPermissionsFromAclA [ADVAPI32.@]
3949  */
3950 DWORD WINAPI GetAuditedPermissionsFromAclA( PACL pacl, PTRUSTEEA pTrustee, PACCESS_MASK pSuccessfulAuditedRights,
3951         PACCESS_MASK pFailedAuditRights)
3952 {
3953     FIXME("%p %p %p %p\n",pacl, pTrustee, pSuccessfulAuditedRights, pFailedAuditRights);
3954     return ERROR_CALL_NOT_IMPLEMENTED;
3955
3956 }
3957
3958 /******************************************************************************
3959  * GetAuditedPermissionsFromAclW [ADVAPI32.@]
3960  */
3961 DWORD WINAPI GetAuditedPermissionsFromAclW( PACL pacl, PTRUSTEEW pTrustee, PACCESS_MASK pSuccessfulAuditedRights,
3962         PACCESS_MASK pFailedAuditRights)
3963 {
3964     FIXME("%p %p %p %p\n",pacl, pTrustee, pSuccessfulAuditedRights, pFailedAuditRights);
3965     return ERROR_CALL_NOT_IMPLEMENTED;
3966
3967 }
3968
3969 /******************************************************************************
3970  * ParseAclStringFlags
3971  */
3972 static DWORD ParseAclStringFlags(LPCWSTR* StringAcl)
3973 {
3974     DWORD flags = 0;
3975     LPCWSTR szAcl = *StringAcl;
3976
3977     while (*szAcl != '(')
3978     {
3979         if (*szAcl == 'P')
3980         {
3981             flags |= SE_DACL_PROTECTED;
3982         }
3983         else if (*szAcl == 'A')
3984         {
3985             szAcl++;
3986             if (*szAcl == 'R')
3987                 flags |= SE_DACL_AUTO_INHERIT_REQ;
3988             else if (*szAcl == 'I')
3989                 flags |= SE_DACL_AUTO_INHERITED;
3990         }
3991         szAcl++;
3992     }
3993
3994     *StringAcl = szAcl;
3995     return flags;
3996 }
3997
3998 /******************************************************************************
3999  * ParseAceStringType
4000  */
4001 static const ACEFLAG AceType[] =
4002 {
4003     { SDDL_ALARM,          SYSTEM_ALARM_ACE_TYPE },
4004     { SDDL_AUDIT,          SYSTEM_AUDIT_ACE_TYPE },
4005     { SDDL_ACCESS_ALLOWED, ACCESS_ALLOWED_ACE_TYPE },
4006     { SDDL_ACCESS_DENIED,  ACCESS_DENIED_ACE_TYPE },
4007     /*
4008     { SDDL_OBJECT_ACCESS_ALLOWED, ACCESS_ALLOWED_OBJECT_ACE_TYPE },
4009     { SDDL_OBJECT_ACCESS_DENIED,  ACCESS_DENIED_OBJECT_ACE_TYPE },
4010     { SDDL_OBJECT_ALARM,          SYSTEM_ALARM_OBJECT_ACE_TYPE },
4011     { SDDL_OBJECT_AUDIT,          SYSTEM_AUDIT_OBJECT_ACE_TYPE },
4012     */
4013     { NULL, 0 },
4014 };
4015
4016 static BYTE ParseAceStringType(LPCWSTR* StringAcl)
4017 {
4018     UINT len = 0;
4019     LPCWSTR szAcl = *StringAcl;
4020     const ACEFLAG *lpaf = AceType;
4021
4022     while (*szAcl == ' ')
4023         szAcl++;
4024
4025     while (lpaf->wstr &&
4026         (len = strlenW(lpaf->wstr)) &&
4027         strncmpW(lpaf->wstr, szAcl, len))
4028         lpaf++;
4029
4030     if (!lpaf->wstr)
4031         return 0;
4032
4033     *StringAcl = szAcl + len;
4034     return lpaf->value;
4035 }
4036
4037
4038 /******************************************************************************
4039  * ParseAceStringFlags
4040  */
4041 static const ACEFLAG AceFlags[] =
4042 {
4043     { SDDL_CONTAINER_INHERIT, CONTAINER_INHERIT_ACE },
4044     { SDDL_AUDIT_FAILURE,     FAILED_ACCESS_ACE_FLAG },
4045     { SDDL_INHERITED,         INHERITED_ACE },
4046     { SDDL_INHERIT_ONLY,      INHERIT_ONLY_ACE },
4047     { SDDL_NO_PROPAGATE,      NO_PROPAGATE_INHERIT_ACE },
4048     { SDDL_OBJECT_INHERIT,    OBJECT_INHERIT_ACE },
4049     { SDDL_AUDIT_SUCCESS,     SUCCESSFUL_ACCESS_ACE_FLAG },
4050     { NULL, 0 },
4051 };
4052
4053 static BYTE ParseAceStringFlags(LPCWSTR* StringAcl)
4054 {
4055     UINT len = 0;
4056     BYTE flags = 0;
4057     LPCWSTR szAcl = *StringAcl;
4058
4059     while (*szAcl == ' ')
4060         szAcl++;
4061
4062     while (*szAcl != ';')
4063     {
4064         const ACEFLAG *lpaf = AceFlags;
4065
4066         while (lpaf->wstr &&
4067                (len = strlenW(lpaf->wstr)) &&
4068                strncmpW(lpaf->wstr, szAcl, len))
4069             lpaf++;
4070
4071         if (!lpaf->wstr)
4072             return 0;
4073
4074         flags |= lpaf->value;
4075         szAcl += len;
4076     }
4077
4078     *StringAcl = szAcl;
4079     return flags;
4080 }
4081
4082
4083 /******************************************************************************
4084  * ParseAceStringRights
4085  */
4086 static const ACEFLAG AceRights[] =
4087 {
4088     { SDDL_GENERIC_ALL,     GENERIC_ALL },
4089     { SDDL_GENERIC_READ,    GENERIC_READ },
4090     { SDDL_GENERIC_WRITE,   GENERIC_WRITE },
4091     { SDDL_GENERIC_EXECUTE, GENERIC_EXECUTE },
4092
4093     { SDDL_READ_CONTROL,    READ_CONTROL },
4094     { SDDL_STANDARD_DELETE, DELETE },
4095     { SDDL_WRITE_DAC,       WRITE_DAC },
4096     { SDDL_WRITE_OWNER,     WRITE_OWNER },
4097
4098     { SDDL_READ_PROPERTY,   ADS_RIGHT_DS_READ_PROP},
4099     { SDDL_WRITE_PROPERTY,  ADS_RIGHT_DS_WRITE_PROP},
4100     { SDDL_CREATE_CHILD,    ADS_RIGHT_DS_CREATE_CHILD},
4101     { SDDL_DELETE_CHILD,    ADS_RIGHT_DS_DELETE_CHILD},
4102     { SDDL_LIST_CHILDREN,   ADS_RIGHT_ACTRL_DS_LIST},
4103     { SDDL_SELF_WRITE,      ADS_RIGHT_DS_SELF},
4104     { SDDL_LIST_OBJECT,     ADS_RIGHT_DS_LIST_OBJECT},
4105     { SDDL_DELETE_TREE,     ADS_RIGHT_DS_DELETE_TREE},
4106     { SDDL_CONTROL_ACCESS,  ADS_RIGHT_DS_CONTROL_ACCESS},
4107
4108     { SDDL_FILE_ALL,        FILE_ALL_ACCESS },
4109     { SDDL_FILE_READ,       FILE_GENERIC_READ },
4110     { SDDL_FILE_WRITE,      FILE_GENERIC_WRITE },
4111     { SDDL_FILE_EXECUTE,    FILE_GENERIC_EXECUTE },
4112
4113     { SDDL_KEY_ALL,         KEY_ALL_ACCESS },
4114     { SDDL_KEY_READ,        KEY_READ },
4115     { SDDL_KEY_WRITE,       KEY_WRITE },
4116     { SDDL_KEY_EXECUTE,     KEY_EXECUTE },
4117     { NULL, 0 },
4118 };
4119
4120 static DWORD ParseAceStringRights(LPCWSTR* StringAcl)
4121 {
4122     UINT len = 0;
4123     DWORD rights = 0;
4124     LPCWSTR szAcl = *StringAcl;
4125
4126     while (*szAcl == ' ')
4127         szAcl++;
4128
4129     if ((*szAcl == '0') && (*(szAcl + 1) == 'x'))
4130     {
4131         LPCWSTR p = szAcl;
4132
4133         while (*p && *p != ';')
4134             p++;
4135
4136         if (p - szAcl <= 10 /* 8 hex digits + "0x" */ )
4137         {
4138             rights = strtoulW(szAcl, NULL, 16);
4139             szAcl = p;
4140         }
4141         else
4142             WARN("Invalid rights string format: %s\n", debugstr_wn(szAcl, p - szAcl));
4143     }
4144     else
4145     {
4146         while (*szAcl != ';')
4147         {
4148             const ACEFLAG *lpaf = AceRights;
4149
4150             while (lpaf->wstr &&
4151                (len = strlenW(lpaf->wstr)) &&
4152                strncmpW(lpaf->wstr, szAcl, len))
4153             {
4154                lpaf++;
4155             }
4156
4157             if (!lpaf->wstr)
4158                 return 0;
4159
4160             rights |= lpaf->value;
4161             szAcl += len;
4162         }
4163     }
4164
4165     *StringAcl = szAcl;
4166     return rights;
4167 }
4168
4169
4170 /******************************************************************************
4171  * ParseStringAclToAcl
4172  *
4173  * dacl_flags(string_ace1)(string_ace2)... (string_acen)
4174  */
4175 static BOOL ParseStringAclToAcl(LPCWSTR StringAcl, LPDWORD lpdwFlags,
4176     PACL pAcl, LPDWORD cBytes)
4177 {
4178     DWORD val;
4179     DWORD sidlen;
4180     DWORD length = sizeof(ACL);
4181     DWORD acesize = 0;
4182     DWORD acecount = 0;
4183     PACCESS_ALLOWED_ACE pAce = NULL; /* pointer to current ACE */
4184     DWORD error = ERROR_INVALID_ACL;
4185
4186     TRACE("%s\n", debugstr_w(StringAcl));
4187
4188     if (!StringAcl)
4189         return FALSE;
4190
4191     if (pAcl) /* pAce is only useful if we're setting values */
4192         pAce = (PACCESS_ALLOWED_ACE) (pAcl + 1);
4193
4194     /* Parse ACL flags */
4195     *lpdwFlags = ParseAclStringFlags(&StringAcl);
4196
4197     /* Parse ACE */
4198     while (*StringAcl == '(')
4199     {
4200         StringAcl++;
4201
4202         /* Parse ACE type */
4203         val = ParseAceStringType(&StringAcl);
4204         if (pAce)
4205             pAce->Header.AceType = (BYTE) val;
4206         if (*StringAcl != ';')
4207         {
4208             error = RPC_S_INVALID_STRING_UUID;
4209             goto lerr;
4210         }
4211         StringAcl++;
4212
4213         /* Parse ACE flags */
4214         val = ParseAceStringFlags(&StringAcl);
4215         if (pAce)
4216             pAce->Header.AceFlags = (BYTE) val;
4217         if (*StringAcl != ';')
4218             goto lerr;
4219         StringAcl++;
4220
4221         /* Parse ACE rights */
4222         val = ParseAceStringRights(&StringAcl);
4223         if (pAce)
4224             pAce->Mask = val;
4225         if (*StringAcl != ';')
4226             goto lerr;
4227         StringAcl++;
4228
4229         /* Parse ACE object guid */
4230         while (*StringAcl == ' ')
4231             StringAcl++;
4232         if (*StringAcl != ';')
4233         {
4234             FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
4235             goto lerr;
4236         }
4237         StringAcl++;
4238
4239         /* Parse ACE inherit object guid */
4240         while (*StringAcl == ' ')
4241             StringAcl++;
4242         if (*StringAcl != ';')
4243         {
4244             FIXME("Support for *_OBJECT_ACE_TYPE not implemented\n");
4245             goto lerr;
4246         }
4247         StringAcl++;
4248
4249         /* Parse ACE account sid */
4250         if (ParseStringSidToSid(StringAcl, pAce ? &pAce->SidStart : NULL, &sidlen))
4251         {
4252             while (*StringAcl && *StringAcl != ')')
4253                 StringAcl++;
4254         }
4255
4256         if (*StringAcl != ')')
4257             goto lerr;
4258         StringAcl++;
4259
4260         acesize = sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) + sidlen;
4261         length += acesize;
4262         if (pAce)
4263         {
4264             pAce->Header.AceSize = acesize;
4265             pAce = (PACCESS_ALLOWED_ACE)((LPBYTE)pAce + acesize);
4266         }
4267         acecount++;
4268     }
4269
4270     *cBytes = length;
4271
4272     if (length > 0xffff)
4273     {
4274         ERR("ACL too large\n");
4275         goto lerr;
4276     }
4277
4278     if (pAcl)
4279     {
4280         pAcl->AclRevision = ACL_REVISION;
4281         pAcl->Sbz1 = 0;
4282         pAcl->AclSize = length;
4283         pAcl->AceCount = acecount++;
4284         pAcl->Sbz2 = 0;
4285     }
4286     return TRUE;
4287
4288 lerr:
4289     SetLastError(error);
4290     WARN("Invalid ACE string format\n");
4291     return FALSE;
4292 }
4293
4294
4295 /******************************************************************************
4296  * ParseStringSecurityDescriptorToSecurityDescriptor
4297  */
4298 static BOOL ParseStringSecurityDescriptorToSecurityDescriptor(
4299     LPCWSTR StringSecurityDescriptor,
4300     SECURITY_DESCRIPTOR_RELATIVE* SecurityDescriptor,
4301     LPDWORD cBytes)
4302 {
4303     BOOL bret = FALSE;
4304     WCHAR toktype;
4305     WCHAR tok[MAX_PATH];
4306     LPCWSTR lptoken;
4307     LPBYTE lpNext = NULL;
4308     DWORD len;
4309
4310     *cBytes = sizeof(SECURITY_DESCRIPTOR);
4311
4312     if (SecurityDescriptor)
4313         lpNext = (LPBYTE)(SecurityDescriptor + 1);
4314
4315     while (*StringSecurityDescriptor == ' ')
4316         StringSecurityDescriptor++;
4317
4318     while (*StringSecurityDescriptor)
4319     {
4320         toktype = *StringSecurityDescriptor;
4321
4322         /* Expect char identifier followed by ':' */
4323         StringSecurityDescriptor++;
4324         if (*StringSecurityDescriptor != ':')
4325         {
4326             SetLastError(ERROR_INVALID_PARAMETER);
4327             goto lend;
4328         }
4329         StringSecurityDescriptor++;
4330
4331         /* Extract token */
4332         lptoken = StringSecurityDescriptor;
4333         while (*lptoken && *lptoken != ':')
4334             lptoken++;
4335
4336         if (*lptoken)
4337             lptoken--;
4338
4339         len = lptoken - StringSecurityDescriptor;
4340         memcpy( tok, StringSecurityDescriptor, len * sizeof(WCHAR) );
4341         tok[len] = 0;
4342
4343         switch (toktype)
4344         {
4345             case 'O':
4346             {
4347                 DWORD bytes;
4348
4349                 if (!ParseStringSidToSid(tok, lpNext, &bytes))
4350                     goto lend;
4351
4352                 if (SecurityDescriptor)
4353                 {
4354                     SecurityDescriptor->Owner = lpNext - (LPBYTE)SecurityDescriptor;
4355                     lpNext += bytes; /* Advance to next token */
4356                 }
4357
4358                 *cBytes += bytes;
4359
4360                 break;
4361             }
4362
4363             case 'G':
4364             {
4365                 DWORD bytes;
4366
4367                 if (!ParseStringSidToSid(tok, lpNext, &bytes))
4368                     goto lend;
4369
4370                 if (SecurityDescriptor)
4371                 {
4372                     SecurityDescriptor->Group = lpNext - (LPBYTE)SecurityDescriptor;
4373                     lpNext += bytes; /* Advance to next token */
4374                 }
4375
4376                 *cBytes += bytes;
4377
4378                 break;
4379             }
4380
4381             case 'D':
4382             {
4383                 DWORD flags;
4384                 DWORD bytes;
4385
4386                 if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
4387                     goto lend;
4388
4389                 if (SecurityDescriptor)
4390                 {
4391                     SecurityDescriptor->Control |= SE_DACL_PRESENT | flags;
4392                     SecurityDescriptor->Dacl = lpNext - (LPBYTE)SecurityDescriptor;
4393                     lpNext += bytes; /* Advance to next token */
4394                 }
4395
4396                 *cBytes += bytes;
4397
4398                 break;
4399             }
4400
4401             case 'S':
4402             {
4403                 DWORD flags;
4404                 DWORD bytes;
4405
4406                 if (!ParseStringAclToAcl(tok, &flags, (PACL)lpNext, &bytes))
4407                     goto lend;
4408
4409                 if (SecurityDescriptor)
4410                 {
4411                     SecurityDescriptor->Control |= SE_SACL_PRESENT | flags;
4412                     SecurityDescriptor->Sacl = lpNext - (LPBYTE)SecurityDescriptor;
4413                     lpNext += bytes; /* Advance to next token */
4414                 }
4415
4416                 *cBytes += bytes;
4417
4418                 break;
4419             }
4420
4421             default:
4422                 FIXME("Unknown token\n");
4423                 SetLastError(ERROR_INVALID_PARAMETER);
4424                 goto lend;
4425         }
4426
4427         StringSecurityDescriptor = lptoken;
4428     }
4429
4430     bret = TRUE;
4431
4432 lend:
4433     return bret;
4434 }
4435
4436 /******************************************************************************
4437  * ConvertStringSecurityDescriptorToSecurityDescriptorA [ADVAPI32.@]
4438  */
4439 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorA(
4440         LPCSTR StringSecurityDescriptor,
4441         DWORD StringSDRevision,
4442         PSECURITY_DESCRIPTOR* SecurityDescriptor,
4443         PULONG SecurityDescriptorSize)
4444 {
4445     BOOL ret;
4446     LPWSTR StringSecurityDescriptorW;
4447
4448     if(!StringSecurityDescriptor)
4449         return FALSE;
4450
4451     StringSecurityDescriptorW = SERV_dup(StringSecurityDescriptor);
4452     ret = ConvertStringSecurityDescriptorToSecurityDescriptorW(StringSecurityDescriptorW,
4453                                                                StringSDRevision, SecurityDescriptor,
4454                                                                SecurityDescriptorSize);
4455     HeapFree(GetProcessHeap(), 0, StringSecurityDescriptorW);
4456
4457     return ret;
4458 }
4459
4460 /******************************************************************************
4461  * ConvertStringSecurityDescriptorToSecurityDescriptorW [ADVAPI32.@]
4462  */
4463 BOOL WINAPI ConvertStringSecurityDescriptorToSecurityDescriptorW(
4464         LPCWSTR StringSecurityDescriptor,
4465         DWORD StringSDRevision,
4466         PSECURITY_DESCRIPTOR* SecurityDescriptor,
4467         PULONG SecurityDescriptorSize)
4468 {
4469     DWORD cBytes;
4470     SECURITY_DESCRIPTOR* psd;
4471     BOOL bret = FALSE;
4472
4473     TRACE("%s\n", debugstr_w(StringSecurityDescriptor));
4474
4475     if (GetVersion() & 0x80000000)
4476     {
4477         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4478         goto lend;
4479     }
4480     else if (!StringSecurityDescriptor || !SecurityDescriptor)
4481     {
4482         SetLastError(ERROR_INVALID_PARAMETER);
4483         goto lend;
4484     }
4485     else if (StringSDRevision != SID_REVISION)
4486     {
4487         SetLastError(ERROR_UNKNOWN_REVISION);
4488         goto lend;
4489     }
4490
4491     /* Compute security descriptor length */
4492     if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
4493         NULL, &cBytes))
4494         goto lend;
4495
4496     psd = *SecurityDescriptor = LocalAlloc(GMEM_ZEROINIT, cBytes);
4497     if (!psd) goto lend;
4498
4499     psd->Revision = SID_REVISION;
4500     psd->Control |= SE_SELF_RELATIVE;
4501
4502     if (!ParseStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor,
4503              (SECURITY_DESCRIPTOR_RELATIVE *)psd, &cBytes))
4504     {
4505         LocalFree(psd);
4506         goto lend;
4507     }
4508
4509     if (SecurityDescriptorSize)
4510         *SecurityDescriptorSize = cBytes;
4511
4512     bret = TRUE;
4513
4514 lend:
4515     TRACE(" ret=%d\n", bret);
4516     return bret;
4517 }
4518
4519 static void DumpString(LPCWSTR string, int cch, WCHAR **pwptr, ULONG *plen)
4520 {
4521     if (cch == -1)
4522         cch = strlenW(string);
4523
4524     if (plen)
4525         *plen += cch;
4526
4527     if (pwptr)
4528     {
4529         memcpy(*pwptr, string, sizeof(WCHAR)*cch);
4530         *pwptr += cch;
4531     }
4532 }
4533
4534 static BOOL DumpSidNumeric(PSID psid, WCHAR **pwptr, ULONG *plen)
4535 {
4536     DWORD i;
4537     WCHAR fmt[] = { 'S','-','%','u','-','%','d',0 };
4538     WCHAR subauthfmt[] = { '-','%','u',0 };
4539     WCHAR buf[26];
4540     SID *pisid = psid;
4541
4542     if( !IsValidSid( psid ) || pisid->Revision != SDDL_REVISION)
4543     {
4544         SetLastError(ERROR_INVALID_SID);
4545         return FALSE;
4546     }
4547
4548     if (pisid->IdentifierAuthority.Value[0] ||
4549      pisid->IdentifierAuthority.Value[1])
4550     {
4551         FIXME("not matching MS' bugs\n");
4552         SetLastError(ERROR_INVALID_SID);
4553         return FALSE;
4554     }
4555
4556     sprintfW( buf, fmt, pisid->Revision,
4557         MAKELONG(
4558             MAKEWORD( pisid->IdentifierAuthority.Value[5],
4559                     pisid->IdentifierAuthority.Value[4] ),
4560             MAKEWORD( pisid->IdentifierAuthority.Value[3],
4561                     pisid->IdentifierAuthority.Value[2] )
4562         ) );
4563     DumpString(buf, -1, pwptr, plen);
4564
4565     for( i=0; i<pisid->SubAuthorityCount; i++ )
4566     {
4567         sprintfW( buf, subauthfmt, pisid->SubAuthority[i] );
4568         DumpString(buf, -1, pwptr, plen);
4569     }
4570     return TRUE;
4571 }
4572
4573 static BOOL DumpSid(PSID psid, WCHAR **pwptr, ULONG *plen)
4574 {
4575     size_t i;
4576     for (i = 0; i < sizeof(WellKnownSids) / sizeof(WellKnownSids[0]); i++)
4577     {
4578         if (WellKnownSids[i].wstr[0] && EqualSid(psid, (PSID)&(WellKnownSids[i].Sid.Revision)))
4579         {
4580             DumpString(WellKnownSids[i].wstr, 2, pwptr, plen);
4581             return TRUE;
4582         }
4583     }
4584
4585     return DumpSidNumeric(psid, pwptr, plen);
4586 }
4587
4588 static const LPCWSTR AceRightBitNames[32] = {
4589         SDDL_CREATE_CHILD,        /*  0 */
4590         SDDL_DELETE_CHILD,
4591         SDDL_LIST_CHILDREN,
4592         SDDL_SELF_WRITE,
4593         SDDL_READ_PROPERTY,       /*  4 */
4594         SDDL_WRITE_PROPERTY,
4595         SDDL_DELETE_TREE,
4596         SDDL_LIST_OBJECT,
4597         SDDL_CONTROL_ACCESS,      /*  8 */
4598         NULL,
4599         NULL,
4600         NULL,
4601         NULL,                     /* 12 */
4602         NULL,
4603         NULL,
4604         NULL,
4605         SDDL_STANDARD_DELETE,     /* 16 */
4606         SDDL_READ_CONTROL,
4607         SDDL_WRITE_DAC,
4608         SDDL_WRITE_OWNER,
4609         NULL,                     /* 20 */
4610         NULL,
4611         NULL,
4612         NULL,
4613         NULL,                     /* 24 */
4614         NULL,
4615         NULL,
4616         NULL,
4617         SDDL_GENERIC_ALL,         /* 28 */
4618         SDDL_GENERIC_EXECUTE,
4619         SDDL_GENERIC_WRITE,
4620         SDDL_GENERIC_READ
4621 };
4622
4623 static void DumpRights(DWORD mask, WCHAR **pwptr, ULONG *plen)
4624 {
4625     static const WCHAR fmtW[] = {'0','x','%','x',0};
4626     WCHAR buf[15];
4627     size_t i;
4628
4629     if (mask == 0)
4630         return;
4631
4632     /* first check if the right have name */
4633     for (i = 0; i < sizeof(AceRights)/sizeof(AceRights[0]); i++)
4634     {
4635         if (AceRights[i].wstr == NULL)
4636             break;
4637         if (mask == AceRights[i].value)
4638         {
4639             DumpString(AceRights[i].wstr, -1, pwptr, plen);
4640             return;
4641         }
4642     }
4643
4644     /* then check if it can be built from bit names */
4645     for (i = 0; i < 32; i++)
4646     {
4647         if ((mask & (1 << i)) && (AceRightBitNames[i] == NULL))
4648         {
4649             /* can't be built from bit names */
4650             sprintfW(buf, fmtW, mask);
4651             DumpString(buf, -1, pwptr, plen);
4652             return;
4653         }
4654     }
4655
4656     /* build from bit names */
4657     for (i = 0; i < 32; i++)
4658         if (mask & (1 << i))
4659             DumpString(AceRightBitNames[i], -1, pwptr, plen);
4660 }
4661
4662 static BOOL DumpAce(LPVOID pace, WCHAR **pwptr, ULONG *plen)
4663 {
4664     ACCESS_ALLOWED_ACE *piace; /* all the supported ACEs have the same memory layout */
4665     static const WCHAR openbr = '(';
4666     static const WCHAR closebr = ')';
4667     static const WCHAR semicolon = ';';
4668
4669     if (((PACE_HEADER)pace)->AceType > SYSTEM_ALARM_ACE_TYPE || ((PACE_HEADER)pace)->AceSize < sizeof(ACCESS_ALLOWED_ACE))
4670     {
4671         SetLastError(ERROR_INVALID_ACL);
4672         return FALSE;
4673     }
4674
4675     piace = pace;
4676     DumpString(&openbr, 1, pwptr, plen);
4677     switch (piace->Header.AceType)
4678     {
4679         case ACCESS_ALLOWED_ACE_TYPE:
4680             DumpString(SDDL_ACCESS_ALLOWED, -1, pwptr, plen);
4681             break;
4682         case ACCESS_DENIED_ACE_TYPE:
4683             DumpString(SDDL_ACCESS_DENIED, -1, pwptr, plen);
4684             break;
4685         case SYSTEM_AUDIT_ACE_TYPE:
4686             DumpString(SDDL_AUDIT, -1, pwptr, plen);
4687             break;
4688         case SYSTEM_ALARM_ACE_TYPE:
4689             DumpString(SDDL_ALARM, -1, pwptr, plen);
4690             break;
4691     }
4692     DumpString(&semicolon, 1, pwptr, plen);
4693
4694     if (piace->Header.AceFlags & OBJECT_INHERIT_ACE)
4695         DumpString(SDDL_OBJECT_INHERIT, -1, pwptr, plen);
4696     if (piace->Header.AceFlags & CONTAINER_INHERIT_ACE)
4697         DumpString(SDDL_CONTAINER_INHERIT, -1, pwptr, plen);
4698     if (piace->Header.AceFlags & NO_PROPAGATE_INHERIT_ACE)
4699         DumpString(SDDL_NO_PROPAGATE, -1, pwptr, plen);
4700     if (piace->Header.AceFlags & INHERIT_ONLY_ACE)
4701         DumpString(SDDL_INHERIT_ONLY, -1, pwptr, plen);
4702     if (piace->Header.AceFlags & INHERITED_ACE)
4703         DumpString(SDDL_INHERITED, -1, pwptr, plen);
4704     if (piace->Header.AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG)
4705         DumpString(SDDL_AUDIT_SUCCESS, -1, pwptr, plen);
4706     if (piace->Header.AceFlags & FAILED_ACCESS_ACE_FLAG)
4707         DumpString(SDDL_AUDIT_FAILURE, -1, pwptr, plen);
4708     DumpString(&semicolon, 1, pwptr, plen);
4709     DumpRights(piace->Mask, pwptr, plen);
4710     DumpString(&semicolon, 1, pwptr, plen);
4711     /* objects not supported */
4712     DumpString(&semicolon, 1, pwptr, plen);
4713     /* objects not supported */
4714     DumpString(&semicolon, 1, pwptr, plen);
4715     if (!DumpSid(&piace->SidStart, pwptr, plen))
4716         return FALSE;
4717     DumpString(&closebr, 1, pwptr, plen);
4718     return TRUE;
4719 }
4720
4721 static BOOL DumpAcl(PACL pacl, WCHAR **pwptr, ULONG *plen, BOOL protected, BOOL autoInheritReq, BOOL autoInherited)
4722 {
4723     WORD count;
4724     int i;
4725
4726     if (protected)
4727         DumpString(SDDL_PROTECTED, -1, pwptr, plen);
4728     if (autoInheritReq)
4729         DumpString(SDDL_AUTO_INHERIT_REQ, -1, pwptr, plen);
4730     if (autoInherited)
4731         DumpString(SDDL_AUTO_INHERITED, -1, pwptr, plen);
4732
4733     if (pacl == NULL)
4734         return TRUE;
4735
4736     if (!IsValidAcl(pacl))
4737         return FALSE;
4738
4739     count = pacl->AceCount;
4740     for (i = 0; i < count; i++)
4741     {
4742         LPVOID ace;
4743         if (!GetAce(pacl, i, &ace))
4744             return FALSE;
4745         if (!DumpAce(ace, pwptr, plen))
4746             return FALSE;
4747     }
4748
4749     return TRUE;
4750 }
4751
4752 static BOOL DumpOwner(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4753 {
4754     static const WCHAR prefix[] = {'O',':',0};
4755     BOOL bDefaulted;
4756     PSID psid;
4757
4758     if (!GetSecurityDescriptorOwner(SecurityDescriptor, &psid, &bDefaulted))
4759         return FALSE;
4760
4761     if (psid == NULL)
4762         return TRUE;
4763
4764     DumpString(prefix, -1, pwptr, plen);
4765     if (!DumpSid(psid, pwptr, plen))
4766         return FALSE;
4767     return TRUE;
4768 }
4769
4770 static BOOL DumpGroup(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4771 {
4772     static const WCHAR prefix[] = {'G',':',0};
4773     BOOL bDefaulted;
4774     PSID psid;
4775
4776     if (!GetSecurityDescriptorGroup(SecurityDescriptor, &psid, &bDefaulted))
4777         return FALSE;
4778
4779     if (psid == NULL)
4780         return TRUE;
4781
4782     DumpString(prefix, -1, pwptr, plen);
4783     if (!DumpSid(psid, pwptr, plen))
4784         return FALSE;
4785     return TRUE;
4786 }
4787
4788 static BOOL DumpDacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4789 {
4790     static const WCHAR dacl[] = {'D',':',0};
4791     SECURITY_DESCRIPTOR_CONTROL control;
4792     BOOL present, defaulted;
4793     DWORD revision;
4794     PACL pacl;
4795
4796     if (!GetSecurityDescriptorDacl(SecurityDescriptor, &present, &pacl, &defaulted))
4797         return FALSE;
4798
4799     if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
4800         return FALSE;
4801
4802     if (!present)
4803         return TRUE;
4804
4805     DumpString(dacl, 2, pwptr, plen);
4806     if (!DumpAcl(pacl, pwptr, plen, control & SE_DACL_PROTECTED, control & SE_DACL_AUTO_INHERIT_REQ, control & SE_DACL_AUTO_INHERITED))
4807         return FALSE;
4808     return TRUE;
4809 }
4810
4811 static BOOL DumpSacl(PSECURITY_DESCRIPTOR SecurityDescriptor, WCHAR **pwptr, ULONG *plen)
4812 {
4813     static const WCHAR sacl[] = {'S',':',0};
4814     SECURITY_DESCRIPTOR_CONTROL control;
4815     BOOL present, defaulted;
4816     DWORD revision;
4817     PACL pacl;
4818
4819     if (!GetSecurityDescriptorSacl(SecurityDescriptor, &present, &pacl, &defaulted))
4820         return FALSE;
4821
4822     if (!GetSecurityDescriptorControl(SecurityDescriptor, &control, &revision))
4823         return FALSE;
4824
4825     if (!present)
4826         return TRUE;
4827
4828     DumpString(sacl, 2, pwptr, plen);
4829     if (!DumpAcl(pacl, pwptr, plen, control & SE_SACL_PROTECTED, control & SE_SACL_AUTO_INHERIT_REQ, control & SE_SACL_AUTO_INHERITED))
4830         return FALSE;
4831     return TRUE;
4832 }
4833
4834 /******************************************************************************
4835  * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
4836  */
4837 BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorW(PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION RequestedInformation, LPWSTR *OutputString, PULONG OutputLen)
4838 {
4839     ULONG len;
4840     WCHAR *wptr, *wstr;
4841
4842     if (SDRevision != SDDL_REVISION_1)
4843     {
4844         ERR("Pogram requested unknown SDDL revision %d\n", SDRevision);
4845         SetLastError(ERROR_UNKNOWN_REVISION);
4846         return FALSE;
4847     }
4848
4849     len = 0;
4850     if (RequestedInformation & OWNER_SECURITY_INFORMATION)
4851         if (!DumpOwner(SecurityDescriptor, NULL, &len))
4852             return FALSE;
4853     if (RequestedInformation & GROUP_SECURITY_INFORMATION)
4854         if (!DumpGroup(SecurityDescriptor, NULL, &len))
4855             return FALSE;
4856     if (RequestedInformation & DACL_SECURITY_INFORMATION)
4857         if (!DumpDacl(SecurityDescriptor, NULL, &len))
4858             return FALSE;
4859     if (RequestedInformation & SACL_SECURITY_INFORMATION)
4860         if (!DumpSacl(SecurityDescriptor, NULL, &len))
4861             return FALSE;
4862
4863     wstr = wptr = LocalAlloc(0, (len + 1)*sizeof(WCHAR));
4864     if (RequestedInformation & OWNER_SECURITY_INFORMATION)
4865         if (!DumpOwner(SecurityDescriptor, &wptr, NULL)) {
4866             LocalFree (wstr);
4867             return FALSE;
4868         }
4869     if (RequestedInformation & GROUP_SECURITY_INFORMATION)
4870         if (!DumpGroup(SecurityDescriptor, &wptr, NULL)) {
4871             LocalFree (wstr);
4872             return FALSE;
4873         }
4874     if (RequestedInformation & DACL_SECURITY_INFORMATION)
4875         if (!DumpDacl(SecurityDescriptor, &wptr, NULL)) {
4876             LocalFree (wstr);
4877             return FALSE;
4878         }
4879     if (RequestedInformation & SACL_SECURITY_INFORMATION)
4880         if (!DumpSacl(SecurityDescriptor, &wptr, NULL)) {
4881             LocalFree (wstr);
4882             return FALSE;
4883         }
4884     *wptr = 0;
4885
4886     TRACE("ret: %s, %d\n", wine_dbgstr_w(wstr), len);
4887     *OutputString = wstr;
4888     if (OutputLen)
4889         *OutputLen = strlenW(*OutputString)+1;
4890     return TRUE;
4891 }
4892
4893 /******************************************************************************
4894  * ConvertSecurityDescriptorToStringSecurityDescriptorA [ADVAPI32.@]
4895  */
4896 BOOL WINAPI ConvertSecurityDescriptorToStringSecurityDescriptorA(PSECURITY_DESCRIPTOR SecurityDescriptor, DWORD SDRevision, SECURITY_INFORMATION Information, LPSTR *OutputString, PULONG OutputLen)
4897 {
4898     LPWSTR wstr;
4899     ULONG len;
4900     if (ConvertSecurityDescriptorToStringSecurityDescriptorW(SecurityDescriptor, SDRevision, Information, &wstr, &len))
4901     {
4902         int lenA;
4903
4904         lenA = WideCharToMultiByte(CP_ACP, 0, wstr, len, NULL, 0, NULL, NULL);
4905         *OutputString = HeapAlloc(GetProcessHeap(), 0, lenA);
4906         WideCharToMultiByte(CP_ACP, 0, wstr, len, *OutputString, lenA, NULL, NULL);
4907         LocalFree(wstr);
4908
4909         if (OutputLen != NULL)
4910             *OutputLen = lenA;
4911         return TRUE;
4912     }
4913     else
4914     {
4915         *OutputString = NULL;
4916         if (OutputLen)
4917             *OutputLen = 0;
4918         return FALSE;
4919     }
4920 }
4921
4922 /******************************************************************************
4923  * ConvertStringSidToSidW [ADVAPI32.@]
4924  */
4925 BOOL WINAPI ConvertStringSidToSidW(LPCWSTR StringSid, PSID* Sid)
4926 {
4927     BOOL bret = FALSE;
4928     DWORD cBytes;
4929
4930     TRACE("%s, %p\n", debugstr_w(StringSid), Sid);
4931     if (GetVersion() & 0x80000000)
4932         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4933     else if (!StringSid || !Sid)
4934         SetLastError(ERROR_INVALID_PARAMETER);
4935     else if (ParseStringSidToSid(StringSid, NULL, &cBytes))
4936     {
4937         PSID pSid = *Sid = LocalAlloc(0, cBytes);
4938
4939         bret = ParseStringSidToSid(StringSid, pSid, &cBytes);
4940         if (!bret)
4941             LocalFree(*Sid);
4942     }
4943     return bret;
4944 }
4945
4946 /******************************************************************************
4947  * ConvertStringSidToSidA [ADVAPI32.@]
4948  */
4949 BOOL WINAPI ConvertStringSidToSidA(LPCSTR StringSid, PSID* Sid)
4950 {
4951     BOOL bret = FALSE;
4952
4953     TRACE("%s, %p\n", debugstr_a(StringSid), Sid);
4954     if (GetVersion() & 0x80000000)
4955         SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
4956     else if (!StringSid || !Sid)
4957         SetLastError(ERROR_INVALID_PARAMETER);
4958     else
4959     {
4960         WCHAR *wStringSid = SERV_dup(StringSid);
4961         bret = ConvertStringSidToSidW(wStringSid, Sid);
4962         HeapFree(GetProcessHeap(), 0, wStringSid);
4963     }
4964     return bret;
4965 }
4966
4967 /******************************************************************************
4968  * ConvertSidToStringSidW [ADVAPI32.@]
4969  *
4970  *  format of SID string is:
4971  *    S-<count>-<auth>-<subauth1>-<subauth2>-<subauth3>...
4972  *  where
4973  *    <rev> is the revision of the SID encoded as decimal
4974  *    <auth> is the identifier authority encoded as hex
4975  *    <subauthN> is the subauthority id encoded as decimal
4976  */
4977 BOOL WINAPI ConvertSidToStringSidW( PSID pSid, LPWSTR *pstr )
4978 {
4979     DWORD len = 0;
4980     LPWSTR wstr, wptr;
4981
4982     TRACE("%p %p\n", pSid, pstr );
4983
4984     len = 0;
4985     if (!DumpSidNumeric(pSid, NULL, &len))
4986         return FALSE;
4987     wstr = wptr = LocalAlloc(0, (len+1) * sizeof(WCHAR));
4988     DumpSidNumeric(pSid, &wptr, NULL);
4989     *wptr = 0;
4990
4991     *pstr = wstr;
4992     return TRUE;
4993 }
4994
4995 /******************************************************************************
4996  * ConvertSidToStringSidA [ADVAPI32.@]
4997  */
4998 BOOL WINAPI ConvertSidToStringSidA(PSID pSid, LPSTR *pstr)
4999 {
5000     LPWSTR wstr = NULL;
5001     LPSTR str;
5002     UINT len;
5003
5004     TRACE("%p %p\n", pSid, pstr );
5005
5006     if( !ConvertSidToStringSidW( pSid, &wstr ) )
5007         return FALSE;
5008
5009     len = WideCharToMultiByte( CP_ACP, 0, wstr, -1, NULL, 0, NULL, NULL );
5010     str = LocalAlloc( 0, len );
5011     WideCharToMultiByte( CP_ACP, 0, wstr, -1, str, len, NULL, NULL );
5012     LocalFree( wstr );
5013
5014     *pstr = str;
5015
5016     return TRUE;
5017 }
5018
5019 BOOL WINAPI ConvertToAutoInheritPrivateObjectSecurity(
5020         PSECURITY_DESCRIPTOR pdesc,
5021         PSECURITY_DESCRIPTOR cdesc,
5022         PSECURITY_DESCRIPTOR* ndesc,
5023         GUID* objtype,
5024         BOOL isdir,
5025         PGENERIC_MAPPING genmap )
5026 {
5027     FIXME("%p %p %p %p %d %p - stub\n", pdesc, cdesc, ndesc, objtype, isdir, genmap);
5028
5029     return FALSE;
5030 }
5031
5032 BOOL WINAPI CreatePrivateObjectSecurity(
5033         PSECURITY_DESCRIPTOR ParentDescriptor,
5034         PSECURITY_DESCRIPTOR CreatorDescriptor,
5035         PSECURITY_DESCRIPTOR* NewDescriptor,
5036         BOOL IsDirectoryObject,
5037         HANDLE Token,
5038         PGENERIC_MAPPING GenericMapping )
5039 {
5040     SECURITY_DESCRIPTOR_RELATIVE *relative;
5041     DWORD needed, offset;
5042     BYTE *buffer;
5043
5044     FIXME("%p %p %p %d %p %p - returns fake SECURITY_DESCRIPTOR\n", ParentDescriptor,
5045           CreatorDescriptor, NewDescriptor, IsDirectoryObject, Token, GenericMapping);
5046
5047     needed = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5048     needed += sizeof(sidWorld);
5049     needed += sizeof(sidWorld);
5050     needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5051     needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5052
5053     if (!(buffer = HeapAlloc( GetProcessHeap(), 0, needed ))) return FALSE;
5054     relative = (SECURITY_DESCRIPTOR_RELATIVE *)buffer;
5055     if (!InitializeSecurityDescriptor( relative, SECURITY_DESCRIPTOR_REVISION ))
5056     {
5057         HeapFree( GetProcessHeap(), 0, buffer );
5058         return FALSE;
5059     }
5060     relative->Control |= SE_SELF_RELATIVE;
5061     offset = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5062
5063     memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5064     relative->Owner = offset;
5065     offset += sizeof(sidWorld);
5066
5067     memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5068     relative->Group = offset;
5069     offset += sizeof(sidWorld);
5070
5071     GetWorldAccessACL( (ACL *)(buffer + offset) );
5072     relative->Dacl = offset;
5073     offset += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5074
5075     GetWorldAccessACL( (ACL *)(buffer + offset) );
5076     relative->Sacl = offset;
5077
5078     *NewDescriptor = relative;
5079     return TRUE;
5080 }
5081
5082 BOOL WINAPI DestroyPrivateObjectSecurity( PSECURITY_DESCRIPTOR* ObjectDescriptor )
5083 {
5084     FIXME("%p - stub\n", ObjectDescriptor);
5085
5086     HeapFree( GetProcessHeap(), 0, *ObjectDescriptor );
5087     return TRUE;
5088 }
5089
5090 BOOL WINAPI CreateProcessAsUserA(
5091         HANDLE hToken,
5092         LPCSTR lpApplicationName,
5093         LPSTR lpCommandLine,
5094         LPSECURITY_ATTRIBUTES lpProcessAttributes,
5095         LPSECURITY_ATTRIBUTES lpThreadAttributes,
5096         BOOL bInheritHandles,
5097         DWORD dwCreationFlags,
5098         LPVOID lpEnvironment,
5099         LPCSTR lpCurrentDirectory,
5100         LPSTARTUPINFOA lpStartupInfo,
5101         LPPROCESS_INFORMATION lpProcessInformation )
5102 {
5103     BOOL ret;
5104     WCHAR *appW, *cmdlnW, *cwdW;
5105     STARTUPINFOW sinfo;
5106
5107     TRACE("%p %s %s %p %p %d 0x%08x %p %s %p %p\n", hToken, debugstr_a(lpApplicationName),
5108           debugstr_a(lpCommandLine), lpProcessAttributes, lpThreadAttributes, bInheritHandles,
5109           dwCreationFlags, lpEnvironment, debugstr_a(lpCurrentDirectory), lpStartupInfo, lpProcessInformation);
5110
5111     appW = SERV_dup(lpApplicationName);
5112     cmdlnW = SERV_dup(lpCommandLine);
5113     cwdW = SERV_dup(lpCurrentDirectory);
5114     sinfo.cb = sizeof(sinfo);
5115     sinfo.lpReserved = SERV_dup(lpStartupInfo->lpReserved);
5116     sinfo.lpDesktop = SERV_dup(lpStartupInfo->lpDesktop);
5117     sinfo.lpTitle = SERV_dup(lpStartupInfo->lpTitle);
5118     sinfo.dwX = lpStartupInfo->dwX;
5119     sinfo.dwY = lpStartupInfo->dwY;
5120     sinfo.dwXSize = lpStartupInfo->dwXSize;
5121     sinfo.dwYSize = lpStartupInfo->dwYSize;
5122     sinfo.dwXCountChars = lpStartupInfo->dwXCountChars;
5123     sinfo.dwYCountChars = lpStartupInfo->dwYCountChars;
5124     sinfo.dwFillAttribute = lpStartupInfo->dwFillAttribute;
5125     sinfo.dwFlags = lpStartupInfo->dwFlags;
5126     sinfo.wShowWindow = lpStartupInfo->wShowWindow;
5127     sinfo.cbReserved2 = lpStartupInfo->cbReserved2;
5128     sinfo.lpReserved2 = lpStartupInfo->lpReserved2;
5129     sinfo.hStdInput = lpStartupInfo->hStdInput;
5130     sinfo.hStdOutput = lpStartupInfo->hStdOutput;
5131     sinfo.hStdError = lpStartupInfo->hStdError;
5132     ret = CreateProcessAsUserW(hToken, appW, cmdlnW, lpProcessAttributes,
5133             lpThreadAttributes, bInheritHandles, dwCreationFlags,
5134             lpEnvironment, cwdW, &sinfo, lpProcessInformation);
5135     HeapFree(GetProcessHeap(), 0, appW);
5136     HeapFree(GetProcessHeap(), 0, cmdlnW);
5137     HeapFree(GetProcessHeap(), 0, cwdW);
5138     HeapFree(GetProcessHeap(), 0, sinfo.lpReserved);
5139     HeapFree(GetProcessHeap(), 0, sinfo.lpDesktop);
5140     HeapFree(GetProcessHeap(), 0, sinfo.lpTitle);
5141
5142     return ret;
5143 }
5144
5145 BOOL WINAPI CreateProcessAsUserW(
5146         HANDLE hToken,
5147         LPCWSTR lpApplicationName,
5148         LPWSTR lpCommandLine,
5149         LPSECURITY_ATTRIBUTES lpProcessAttributes,
5150         LPSECURITY_ATTRIBUTES lpThreadAttributes,
5151         BOOL bInheritHandles,
5152         DWORD dwCreationFlags,
5153         LPVOID lpEnvironment,
5154         LPCWSTR lpCurrentDirectory,
5155         LPSTARTUPINFOW lpStartupInfo,
5156         LPPROCESS_INFORMATION lpProcessInformation )
5157 {
5158     FIXME("%p %s %s %p %p %d 0x%08x %p %s %p %p - semi- stub\n", hToken,
5159           debugstr_w(lpApplicationName), debugstr_w(lpCommandLine), lpProcessAttributes,
5160           lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment,
5161           debugstr_w(lpCurrentDirectory), lpStartupInfo, lpProcessInformation);
5162
5163     /* We should create the process with a suspended main thread */
5164     if (!CreateProcessW (lpApplicationName,
5165                          lpCommandLine,
5166                          lpProcessAttributes,
5167                          lpThreadAttributes,
5168                          bInheritHandles,
5169                          dwCreationFlags, /* CREATE_SUSPENDED */
5170                          lpEnvironment,
5171                          lpCurrentDirectory,
5172                          lpStartupInfo,
5173                          lpProcessInformation))
5174     {
5175       return FALSE;
5176     }
5177
5178     return TRUE;
5179 }
5180
5181 /******************************************************************************
5182  * CreateProcessWithLogonW
5183  */
5184 BOOL WINAPI CreateProcessWithLogonW( LPCWSTR lpUsername, LPCWSTR lpDomain, LPCWSTR lpPassword, DWORD dwLogonFlags,
5185     LPCWSTR lpApplicationName, LPWSTR lpCommandLine, DWORD dwCreationFlags, LPVOID lpEnvironment,
5186     LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation )
5187 {
5188     FIXME("%s %s %s 0x%08x %s %s 0x%08x %p %s %p %p stub\n", debugstr_w(lpUsername), debugstr_w(lpDomain),
5189     debugstr_w(lpPassword), dwLogonFlags, debugstr_w(lpApplicationName),
5190     debugstr_w(lpCommandLine), dwCreationFlags, lpEnvironment, debugstr_w(lpCurrentDirectory),
5191     lpStartupInfo, lpProcessInformation);
5192
5193     return FALSE;
5194 }
5195
5196 /******************************************************************************
5197  * DuplicateTokenEx [ADVAPI32.@]
5198  */
5199 BOOL WINAPI DuplicateTokenEx(
5200         HANDLE ExistingTokenHandle, DWORD dwDesiredAccess,
5201         LPSECURITY_ATTRIBUTES lpTokenAttributes,
5202         SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5203         TOKEN_TYPE TokenType,
5204         PHANDLE DuplicateTokenHandle )
5205 {
5206     OBJECT_ATTRIBUTES ObjectAttributes;
5207
5208     TRACE("%p 0x%08x 0x%08x 0x%08x %p\n", ExistingTokenHandle, dwDesiredAccess,
5209           ImpersonationLevel, TokenType, DuplicateTokenHandle);
5210
5211     InitializeObjectAttributes(
5212         &ObjectAttributes,
5213         NULL,
5214         (lpTokenAttributes && lpTokenAttributes->bInheritHandle) ? OBJ_INHERIT : 0,
5215         NULL,
5216         lpTokenAttributes ? lpTokenAttributes->lpSecurityDescriptor : NULL );
5217
5218     return set_ntstatus( NtDuplicateToken( ExistingTokenHandle,
5219                                            dwDesiredAccess,
5220                                            &ObjectAttributes,
5221                                            ImpersonationLevel,
5222                                            TokenType,
5223                                            DuplicateTokenHandle ) );
5224 }
5225
5226 BOOL WINAPI DuplicateToken(
5227         HANDLE ExistingTokenHandle,
5228         SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
5229         PHANDLE DuplicateTokenHandle )
5230 {
5231     return DuplicateTokenEx( ExistingTokenHandle, TOKEN_IMPERSONATE | TOKEN_QUERY,
5232                              NULL, ImpersonationLevel, TokenImpersonation,
5233                              DuplicateTokenHandle );
5234 }
5235
5236 /******************************************************************************
5237  * ComputeStringSidSize
5238  */
5239 static DWORD ComputeStringSidSize(LPCWSTR StringSid)
5240 {
5241     if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I(-S)+ */
5242     {
5243         int ctok = 0;
5244         while (*StringSid)
5245         {
5246             if (*StringSid == '-')
5247                 ctok++;
5248             StringSid++;
5249         }
5250
5251         if (ctok >= 3)
5252             return GetSidLengthRequired(ctok - 2);
5253     }
5254     else /* String constant format  - Only available in winxp and above */
5255     {
5256         unsigned int i;
5257
5258         for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
5259             if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
5260                 return GetSidLengthRequired(WellKnownSids[i].Sid.SubAuthorityCount);
5261
5262         for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
5263             if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
5264             {
5265                 MAX_SID local;
5266                 ADVAPI_GetComputerSid(&local);
5267                 return GetSidLengthRequired(*GetSidSubAuthorityCount(&local) + 1);
5268             }
5269
5270     }
5271
5272     return GetSidLengthRequired(0);
5273 }
5274
5275 /******************************************************************************
5276  * ParseStringSidToSid
5277  */
5278 static BOOL ParseStringSidToSid(LPCWSTR StringSid, PSID pSid, LPDWORD cBytes)
5279 {
5280     BOOL bret = FALSE;
5281     SID* pisid=pSid;
5282
5283     TRACE("%s, %p, %p\n", debugstr_w(StringSid), pSid, cBytes);
5284     if (!StringSid)
5285     {
5286         SetLastError(ERROR_INVALID_PARAMETER);
5287         TRACE("StringSid is NULL, returning FALSE\n");
5288         return FALSE;
5289     }
5290
5291     while (*StringSid == ' ')
5292         StringSid++;
5293
5294     *cBytes = ComputeStringSidSize(StringSid);
5295     if (!pisid) /* Simply compute the size */
5296     {
5297         TRACE("only size requested, returning TRUE with %d\n", *cBytes);
5298         return TRUE;
5299     }
5300
5301     if (StringSid[0] == 'S' && StringSid[1] == '-') /* S-R-I-S-S */
5302     {
5303         DWORD i = 0, identAuth;
5304         DWORD csubauth = ((*cBytes - GetSidLengthRequired(0)) / sizeof(DWORD));
5305
5306         StringSid += 2; /* Advance to Revision */
5307         pisid->Revision = atoiW(StringSid);
5308
5309         if (pisid->Revision != SDDL_REVISION)
5310         {
5311             TRACE("Revision %d is unknown\n", pisid->Revision);
5312             goto lend; /* ERROR_INVALID_SID */
5313         }
5314         if (csubauth == 0)
5315         {
5316             TRACE("SubAuthorityCount is 0\n");
5317             goto lend; /* ERROR_INVALID_SID */
5318         }
5319
5320         pisid->SubAuthorityCount = csubauth;
5321
5322         /* Advance to identifier authority */
5323         while (*StringSid && *StringSid != '-')
5324             StringSid++;
5325         if (*StringSid == '-')
5326             StringSid++;
5327
5328         /* MS' implementation can't handle values greater than 2^32 - 1, so
5329          * we don't either; assume most significant bytes are always 0
5330          */
5331         pisid->IdentifierAuthority.Value[0] = 0;
5332         pisid->IdentifierAuthority.Value[1] = 0;
5333         identAuth = atoiW(StringSid);
5334         pisid->IdentifierAuthority.Value[5] = identAuth & 0xff;
5335         pisid->IdentifierAuthority.Value[4] = (identAuth & 0xff00) >> 8;
5336         pisid->IdentifierAuthority.Value[3] = (identAuth & 0xff0000) >> 16;
5337         pisid->IdentifierAuthority.Value[2] = (identAuth & 0xff000000) >> 24;
5338
5339         /* Advance to first sub authority */
5340         while (*StringSid && *StringSid != '-')
5341             StringSid++;
5342         if (*StringSid == '-')
5343             StringSid++;
5344
5345         while (*StringSid)
5346         {
5347             pisid->SubAuthority[i++] = atoiW(StringSid);
5348
5349             while (*StringSid && *StringSid != '-')
5350                 StringSid++;
5351             if (*StringSid == '-')
5352                 StringSid++;
5353         }
5354
5355         if (i != pisid->SubAuthorityCount)
5356             goto lend; /* ERROR_INVALID_SID */
5357
5358         bret = TRUE;
5359     }
5360     else /* String constant format  - Only available in winxp and above */
5361     {
5362         unsigned int i;
5363         pisid->Revision = SDDL_REVISION;
5364
5365         for (i = 0; i < sizeof(WellKnownSids)/sizeof(WellKnownSids[0]); i++)
5366             if (!strncmpW(WellKnownSids[i].wstr, StringSid, 2))
5367             {
5368                 DWORD j;
5369                 pisid->SubAuthorityCount = WellKnownSids[i].Sid.SubAuthorityCount;
5370                 pisid->IdentifierAuthority = WellKnownSids[i].Sid.IdentifierAuthority;
5371                 for (j = 0; j < WellKnownSids[i].Sid.SubAuthorityCount; j++)
5372                     pisid->SubAuthority[j] = WellKnownSids[i].Sid.SubAuthority[j];
5373                 bret = TRUE;
5374             }
5375
5376         for (i = 0; i < sizeof(WellKnownRids)/sizeof(WellKnownRids[0]); i++)
5377             if (!strncmpW(WellKnownRids[i].wstr, StringSid, 2))
5378             {
5379                 ADVAPI_GetComputerSid(pisid);
5380                 pisid->SubAuthority[pisid->SubAuthorityCount] = WellKnownRids[i].Rid;
5381                 pisid->SubAuthorityCount++;
5382                 bret = TRUE;
5383             }
5384
5385         if (!bret)
5386             FIXME("String constant not supported: %s\n", debugstr_wn(StringSid, 2));
5387     }
5388
5389 lend:
5390     if (!bret)
5391         SetLastError(ERROR_INVALID_SID);
5392
5393     TRACE("returning %s\n", bret ? "TRUE" : "FALSE");
5394     return bret;
5395 }
5396
5397 /******************************************************************************
5398  * GetNamedSecurityInfoA [ADVAPI32.@]
5399  */
5400 DWORD WINAPI GetNamedSecurityInfoA(LPSTR pObjectName,
5401         SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
5402         PSID* ppsidOwner, PSID* ppsidGroup, PACL* ppDacl, PACL* ppSacl,
5403         PSECURITY_DESCRIPTOR* ppSecurityDescriptor)
5404 {
5405     LPWSTR wstr;
5406     DWORD r;
5407
5408     TRACE("%s %d %d %p %p %p %p %p\n", pObjectName, ObjectType, SecurityInfo,
5409         ppsidOwner, ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor);
5410
5411     wstr = SERV_dup(pObjectName);
5412     r = GetNamedSecurityInfoW( wstr, ObjectType, SecurityInfo, ppsidOwner,
5413                            ppsidGroup, ppDacl, ppSacl, ppSecurityDescriptor );
5414
5415     HeapFree( GetProcessHeap(), 0, wstr );
5416
5417     return r;
5418 }
5419
5420 /******************************************************************************
5421  * GetNamedSecurityInfoW [ADVAPI32.@]
5422  */
5423 DWORD WINAPI GetNamedSecurityInfoW( LPWSTR name, SE_OBJECT_TYPE type,
5424     SECURITY_INFORMATION info, PSID* owner, PSID* group, PACL* dacl,
5425     PACL* sacl, PSECURITY_DESCRIPTOR* descriptor )
5426 {
5427     DWORD needed, offset;
5428     SECURITY_DESCRIPTOR_RELATIVE *relative = NULL;
5429     BYTE *buffer;
5430
5431     TRACE( "%s %d %d %p %p %p %p %p\n", debugstr_w(name), type, info, owner,
5432            group, dacl, sacl, descriptor );
5433
5434     /* A NULL descriptor is allowed if any one of the other pointers is not NULL */
5435     if (!name || !(owner||group||dacl||sacl||descriptor) ) return ERROR_INVALID_PARAMETER;
5436
5437     /* If no descriptor, we have to check that there's a pointer for the requested information */
5438     if( !descriptor && (
5439         ((info & OWNER_SECURITY_INFORMATION) && !owner)
5440     ||  ((info & GROUP_SECURITY_INFORMATION) && !group)
5441     ||  ((info & DACL_SECURITY_INFORMATION)  && !dacl)
5442     ||  ((info & SACL_SECURITY_INFORMATION)  && !sacl)  ))
5443         return ERROR_INVALID_PARAMETER;
5444
5445     needed = !descriptor ? 0 : sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5446     if (info & OWNER_SECURITY_INFORMATION)
5447         needed += sizeof(sidWorld);
5448     if (info & GROUP_SECURITY_INFORMATION)
5449         needed += sizeof(sidWorld);
5450     if (info & DACL_SECURITY_INFORMATION)
5451         needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5452     if (info & SACL_SECURITY_INFORMATION)
5453         needed += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5454
5455     if(descriptor)
5456     {
5457         /* must be freed by caller */
5458         *descriptor = HeapAlloc( GetProcessHeap(), 0, needed );
5459         if (!*descriptor) return ERROR_NOT_ENOUGH_MEMORY;
5460
5461         if (!InitializeSecurityDescriptor( *descriptor, SECURITY_DESCRIPTOR_REVISION ))
5462         {
5463             HeapFree( GetProcessHeap(), 0, *descriptor );
5464             return ERROR_INVALID_SECURITY_DESCR;
5465         }
5466
5467         relative = *descriptor;
5468         relative->Control |= SE_SELF_RELATIVE;
5469
5470         buffer = (BYTE *)relative;
5471         offset = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
5472     }
5473     else
5474     {
5475         buffer = HeapAlloc( GetProcessHeap(), 0, needed );
5476         if (!buffer) return ERROR_NOT_ENOUGH_MEMORY;
5477         offset = 0;
5478     }
5479
5480     if (info & OWNER_SECURITY_INFORMATION)
5481     {
5482         memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5483         if(relative)
5484             relative->Owner = offset;
5485         if (owner)
5486             *owner = buffer + offset;
5487         offset += sizeof(sidWorld);
5488     }
5489     if (info & GROUP_SECURITY_INFORMATION)
5490     {
5491         memcpy( buffer + offset, &sidWorld, sizeof(sidWorld) );
5492         if(relative)
5493             relative->Group = offset;
5494         if (group)
5495             *group = buffer + offset;
5496         offset += sizeof(sidWorld);
5497     }
5498     if (info & DACL_SECURITY_INFORMATION)
5499     {
5500         GetWorldAccessACL( (PACL)(buffer + offset) );
5501         if(relative)
5502         {
5503             relative->Control |= SE_DACL_PRESENT;
5504             relative->Dacl = offset;
5505         }
5506         if (dacl)
5507             *dacl = (PACL)(buffer + offset);
5508         offset += WINE_SIZE_OF_WORLD_ACCESS_ACL;
5509     }
5510     if (info & SACL_SECURITY_INFORMATION)
5511     {
5512         GetWorldAccessACL( (PACL)(buffer + offset) );
5513         if(relative)
5514         {
5515             relative->Control |= SE_SACL_PRESENT;
5516             relative->Sacl = offset;
5517         }
5518         if (sacl)
5519             *sacl = (PACL)(buffer + offset);
5520     }
5521
5522     return ERROR_SUCCESS;
5523 }
5524
5525 /******************************************************************************
5526  * GetNamedSecurityInfoExW [ADVAPI32.@]
5527  */
5528 DWORD WINAPI GetNamedSecurityInfoExW( LPCWSTR object, SE_OBJECT_TYPE type,
5529     SECURITY_INFORMATION info, LPCWSTR provider, LPCWSTR property,
5530     PACTRL_ACCESSW* access_list, PACTRL_AUDITW* audit_list, LPWSTR* owner, LPWSTR* group )
5531 {
5532     FIXME("(%s, %d, %d, %s, %s, %p, %p, %p, %p) stub\n", debugstr_w(object), type, info,
5533         debugstr_w(provider), debugstr_w(property), access_list, audit_list, owner, group);
5534     return ERROR_CALL_NOT_IMPLEMENTED;
5535 }
5536
5537 /******************************************************************************
5538  * GetNamedSecurityInfoExA [ADVAPI32.@]
5539  */
5540 DWORD WINAPI GetNamedSecurityInfoExA( LPCSTR object, SE_OBJECT_TYPE type,
5541     SECURITY_INFORMATION info, LPCSTR provider, LPCSTR property,
5542     PACTRL_ACCESSA* access_list, PACTRL_AUDITA* audit_list, LPSTR* owner, LPSTR* group )
5543 {
5544     FIXME("(%s, %d, %d, %s, %s, %p, %p, %p, %p) stub\n", debugstr_a(object), type, info,
5545         debugstr_a(provider), debugstr_a(property), access_list, audit_list, owner, group);
5546     return ERROR_CALL_NOT_IMPLEMENTED;
5547 }
5548
5549 /******************************************************************************
5550  * DecryptFileW [ADVAPI32.@]
5551  */
5552 BOOL WINAPI DecryptFileW(LPCWSTR lpFileName, DWORD dwReserved)
5553 {
5554     FIXME("%s %08x\n", debugstr_w(lpFileName), dwReserved);
5555     return TRUE;
5556 }
5557
5558 /******************************************************************************
5559  * DecryptFileA [ADVAPI32.@]
5560  */
5561 BOOL WINAPI DecryptFileA(LPCSTR lpFileName, DWORD dwReserved)
5562 {
5563     FIXME("%s %08x\n", debugstr_a(lpFileName), dwReserved);
5564     return TRUE;
5565 }
5566
5567 /******************************************************************************
5568  * EncryptFileW [ADVAPI32.@]
5569  */
5570 BOOL WINAPI EncryptFileW(LPCWSTR lpFileName)
5571 {
5572     FIXME("%s\n", debugstr_w(lpFileName));
5573     return TRUE;
5574 }
5575
5576 /******************************************************************************
5577  * EncryptFileA [ADVAPI32.@]
5578  */
5579 BOOL WINAPI EncryptFileA(LPCSTR lpFileName)
5580 {
5581     FIXME("%s\n", debugstr_a(lpFileName));
5582     return TRUE;
5583 }
5584
5585 /******************************************************************************
5586  * FileEncryptionStatusW [ADVAPI32.@]
5587  */
5588 BOOL WINAPI FileEncryptionStatusW(LPCWSTR lpFileName, LPDWORD lpStatus)
5589 {
5590     FIXME("(%s %p): stub\n", debugstr_w(lpFileName), lpStatus);
5591     if (!lpStatus)
5592         return FALSE;
5593     *lpStatus = FILE_SYSTEM_NOT_SUPPORT;
5594     return TRUE;
5595 }
5596
5597 /******************************************************************************
5598  * FileEncryptionStatusA [ADVAPI32.@]
5599  */
5600 BOOL WINAPI FileEncryptionStatusA(LPCSTR lpFileName, LPDWORD lpStatus)
5601 {
5602     FIXME("(%s %p): stub\n", debugstr_a(lpFileName), lpStatus);
5603     if (!lpStatus)
5604         return FALSE;
5605     *lpStatus = FILE_SYSTEM_NOT_SUPPORT;
5606     return TRUE;
5607 }
5608
5609 /******************************************************************************
5610  * SetSecurityInfo [ADVAPI32.@]
5611  */
5612 DWORD WINAPI SetSecurityInfo(HANDLE handle, SE_OBJECT_TYPE ObjectType,
5613                       SECURITY_INFORMATION SecurityInfo, PSID psidOwner,
5614                       PSID psidGroup, PACL pDacl, PACL pSacl)
5615 {
5616     SECURITY_DESCRIPTOR sd;
5617     NTSTATUS status;
5618
5619     if (!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION))
5620         return ERROR_INVALID_SECURITY_DESCR;
5621
5622     if (SecurityInfo & OWNER_SECURITY_INFORMATION)
5623         SetSecurityDescriptorOwner(&sd, psidOwner, FALSE);
5624     if (SecurityInfo & GROUP_SECURITY_INFORMATION)
5625         SetSecurityDescriptorGroup(&sd, psidGroup, FALSE);
5626     if (SecurityInfo & DACL_SECURITY_INFORMATION)
5627         SetSecurityDescriptorDacl(&sd, TRUE, pDacl, FALSE);
5628     if (SecurityInfo & SACL_SECURITY_INFORMATION)
5629         SetSecurityDescriptorSacl(&sd, TRUE, pSacl, FALSE);
5630
5631     status = NtSetSecurityObject(handle, SecurityInfo, &sd);
5632     return RtlNtStatusToDosError(status);
5633 }
5634
5635 /******************************************************************************
5636  * SaferCreateLevel   [ADVAPI32.@]
5637  */
5638 BOOL WINAPI SaferCreateLevel(DWORD ScopeId, DWORD LevelId, DWORD OpenFlags,
5639                              SAFER_LEVEL_HANDLE* LevelHandle, LPVOID lpReserved)
5640 {
5641     FIXME("(%u, %x, %u, %p, %p) stub\n", ScopeId, LevelId, OpenFlags, LevelHandle, lpReserved);
5642
5643     *LevelHandle = (SAFER_LEVEL_HANDLE)0xdeadbeef;
5644     return TRUE;
5645 }
5646
5647 /******************************************************************************
5648  * SaferComputeTokenFromLevel   [ADVAPI32.@]
5649  */
5650 BOOL WINAPI SaferComputeTokenFromLevel(SAFER_LEVEL_HANDLE handle, HANDLE token, PHANDLE access_token,
5651                                        DWORD flags, LPVOID reserved)
5652 {
5653     FIXME("(%p, %p, %p, %x, %p) stub\n", handle, token, access_token, flags, reserved);
5654
5655     *access_token = (HANDLE)0xdeadbeef;
5656     return TRUE;
5657 }
5658
5659 /******************************************************************************
5660  * SaferCloseLevel   [ADVAPI32.@]
5661  */
5662 BOOL WINAPI SaferCloseLevel(SAFER_LEVEL_HANDLE handle)
5663 {
5664     FIXME("(%p) stub\n", handle);
5665     return TRUE;
5666 }
5667
5668 DWORD WINAPI TreeResetNamedSecurityInfoW( LPWSTR pObjectName,
5669                 SE_OBJECT_TYPE ObjectType, SECURITY_INFORMATION SecurityInfo,
5670                 PSID pOwner, PSID pGroup, PACL pDacl, PACL pSacl,
5671                 BOOL KeepExplicit, FN_PROGRESS fnProgress,
5672                 PROG_INVOKE_SETTING ProgressInvokeSetting, PVOID Args)
5673 {
5674     FIXME("(%s, %i, %i, %p, %p, %p, %p, %i, %p, %i, %p  Stub\n",
5675         debugstr_w(pObjectName), ObjectType, SecurityInfo, pOwner, pGroup,
5676         pDacl, pSacl, KeepExplicit, fnProgress, ProgressInvokeSetting, Args);
5677
5678     return ERROR_SUCCESS;
5679 }
5680
5681 /******************************************************************************
5682  * SaferGetPolicyInformation   [ADVAPI32.@]
5683  */
5684 BOOL WINAPI SaferGetPolicyInformation(DWORD scope, SAFER_POLICY_INFO_CLASS class, DWORD size,
5685                                       PVOID buffer, PDWORD required, LPVOID lpReserved)
5686 {
5687     FIXME("(%u %u %u %p %p %p) stub\n", scope, class, size, buffer, required, lpReserved);
5688     return FALSE;
5689 }
5690
5691 /******************************************************************************
5692  * SaferSetLevelInformation   [ADVAPI32.@]
5693  */
5694 BOOL WINAPI SaferSetLevelInformation(SAFER_LEVEL_HANDLE handle, SAFER_OBJECT_INFO_CLASS infotype,
5695                                      LPVOID buffer, DWORD size)
5696 {
5697     FIXME("(%p %u %p %u) stub\n", handle, infotype, buffer, size);
5698     return FALSE;
5699 }