2 * dlls/advapi32/security.c
3 * FIXME: for all functions thunking down to Rtl* functions: implement SetLastError()
12 #include "debugtools.h"
14 DEFAULT_DEBUG_CHANNEL(advapi);
16 #define CallWin32ToNt(func) \
19 if (ret !=STATUS_SUCCESS) \
20 { SetLastError (RtlNtStatusToDosError(ret)); return FALSE; } \
24 static void dumpLsaAttributes( PLSA_OBJECT_ATTRIBUTES oa )
28 TRACE("\n\tlength=%lu, rootdir=0x%08x, objectname=%s\n\tattr=0x%08lx, sid=%p qos=%p\n",
29 oa->Length, oa->RootDirectory,
30 oa->ObjectName?debugstr_w(oa->ObjectName->Buffer):"null",
31 oa->Attributes, oa->SecurityDescriptor, oa->SecurityQualityOfService);
35 /* ##############################
36 ###### TOKEN FUNCTIONS ######
37 ##############################
40 /******************************************************************************
41 * OpenProcessToken [ADVAPI32.109]
42 * Opens the access token associated with a process
45 * ProcessHandle [I] Handle to process
46 * DesiredAccess [I] Desired access to process
47 * TokenHandle [O] Pointer to handle of open access token
52 OpenProcessToken( HANDLE ProcessHandle, DWORD DesiredAccess,
55 CallWin32ToNt(NtOpenProcessToken( ProcessHandle, DesiredAccess, TokenHandle ));
58 /******************************************************************************
59 * OpenThreadToken [ADVAPI32.114]
68 OpenThreadToken( HANDLE ThreadHandle, DWORD DesiredAccess,
69 BOOL OpenAsSelf, HANDLE *TokenHandle)
71 CallWin32ToNt (NtOpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle));
74 /******************************************************************************
75 * AdjustTokenPrivileges [ADVAPI32.10]
79 * DisableAllPrivileges []
86 AdjustTokenPrivileges( HANDLE TokenHandle, BOOL DisableAllPrivileges,
87 LPVOID NewState, DWORD BufferLength,
88 LPVOID PreviousState, LPDWORD ReturnLength )
90 CallWin32ToNt(NtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges, NewState, BufferLength, PreviousState, ReturnLength));
93 /******************************************************************************
94 * GetTokenInformation [ADVAPI32.66]
105 GetTokenInformation( HANDLE token, TOKEN_INFORMATION_CLASS tokeninfoclass,
106 LPVOID tokeninfo, DWORD tokeninfolength, LPDWORD retlen )
108 CallWin32ToNt (NtQueryInformationToken( token, tokeninfoclass, tokeninfo, tokeninfolength, retlen));
111 /*************************************************************************
112 * SetThreadToken [ADVAPI32.231]
114 * Assigns an "impersonation token" to a thread so it can assume the
115 * security privledges of another thread or process. Can also remove
116 * a previously assigned token. Only supported on NT - it's a stub
117 * exactly like this one on Win9X.
121 BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token)
123 FIXME("(%p, %x): stub\n", thread, token);
125 SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
130 /* ##############################
131 ###### SID FUNCTIONS ######
132 ##############################
135 /******************************************************************************
136 * AllocateAndInitializeSid [ADVAPI32.11]
139 * pIdentifierAuthority []
140 * nSubAuthorityCount []
152 AllocateAndInitializeSid( PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
153 BYTE nSubAuthorityCount,
154 DWORD nSubAuthority0, DWORD nSubAuthority1,
155 DWORD nSubAuthority2, DWORD nSubAuthority3,
156 DWORD nSubAuthority4, DWORD nSubAuthority5,
157 DWORD nSubAuthority6, DWORD nSubAuthority7,
160 CallWin32ToNt (RtlAllocateAndInitializeSid(
161 pIdentifierAuthority, nSubAuthorityCount,
162 nSubAuthority0, nSubAuthority1, nSubAuthority2, nSubAuthority3,
163 nSubAuthority4, nSubAuthority5, nSubAuthority6, nSubAuthority7,
167 /******************************************************************************
168 * FreeSid [ADVAPI32.42]
177 return NULL; /* is documented like this */
180 /******************************************************************************
181 * CopySid [ADVAPI32.24]
184 * nDestinationSidLength []
189 CopySid( DWORD nDestinationSidLength, PSID pDestinationSid, PSID pSourceSid )
191 return RtlCopySid(nDestinationSidLength, pDestinationSid, pSourceSid);
194 /******************************************************************************
195 * IsValidSid [ADVAPI32.80]
201 IsValidSid( PSID pSid )
203 return RtlValidSid( pSid );
206 /******************************************************************************
207 * EqualSid [ADVAPI32.40]
214 EqualSid( PSID pSid1, PSID pSid2 )
216 return RtlEqualSid( pSid1, pSid2 );
219 /******************************************************************************
220 * EqualPrefixSid [ADVAPI32.39]
222 BOOL WINAPI EqualPrefixSid (PSID pSid1, PSID pSid2)
224 return RtlEqualPrefixSid(pSid1, pSid2);
227 /******************************************************************************
228 * GetSidLengthRequired [ADVAPI32.63]
231 * nSubAuthorityCount []
234 GetSidLengthRequired( BYTE nSubAuthorityCount )
236 return RtlLengthRequiredSid(nSubAuthorityCount);
239 /******************************************************************************
240 * InitializeSid [ADVAPI32.74]
243 * pIdentifierAuthority []
248 PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
249 BYTE nSubAuthorityCount)
251 return RtlInitializeSid(pSid, pIdentifierAuthority, nSubAuthorityCount);
254 /******************************************************************************
255 * GetSidIdentifierAuthority [ADVAPI32.62]
260 PSID_IDENTIFIER_AUTHORITY WINAPI
261 GetSidIdentifierAuthority( PSID pSid )
263 return RtlIdentifierAuthoritySid(pSid);
266 /******************************************************************************
267 * GetSidSubAuthority [ADVAPI32.64]
274 GetSidSubAuthority( PSID pSid, DWORD nSubAuthority )
276 return RtlSubAuthoritySid(pSid, nSubAuthority);
279 /******************************************************************************
280 * GetSidSubAuthorityCount [ADVAPI32.65]
286 GetSidSubAuthorityCount (PSID pSid)
288 return RtlSubAuthorityCountSid(pSid);
291 /******************************************************************************
292 * GetLengthSid [ADVAPI32.48]
298 GetLengthSid (PSID pSid)
300 return RtlLengthSid(pSid);
303 /* ##############################################
304 ###### SECURITY DESCRIPTOR FUNCTIONS ######
305 ##############################################
308 /******************************************************************************
309 * InitializeSecurityDescriptor [ADVAPI32.73]
316 InitializeSecurityDescriptor( SECURITY_DESCRIPTOR *pDescr, DWORD revision )
318 CallWin32ToNt (RtlCreateSecurityDescriptor(pDescr, revision ));
321 /******************************************************************************
322 * GetSecurityDescriptorLength [ADVAPI32.55]
324 DWORD WINAPI GetSecurityDescriptorLength( SECURITY_DESCRIPTOR *pDescr)
326 return (RtlLengthSecurityDescriptor(pDescr));
329 /******************************************************************************
330 * GetSecurityDescriptorOwner [ADVAPI32.56]
334 * lpbOwnerDefaulted []
337 GetSecurityDescriptorOwner( SECURITY_DESCRIPTOR *pDescr, PSID *pOwner,
338 LPBOOL lpbOwnerDefaulted )
340 CallWin32ToNt (RtlGetOwnerSecurityDescriptor( pDescr, pOwner, (PBOOLEAN)lpbOwnerDefaulted ));
343 /******************************************************************************
344 * SetSecurityDescriptorOwner [ADVAPI32]
348 BOOL WINAPI SetSecurityDescriptorOwner( PSECURITY_DESCRIPTOR pSecurityDescriptor,
349 PSID pOwner, BOOL bOwnerDefaulted)
351 CallWin32ToNt (RtlSetOwnerSecurityDescriptor(pSecurityDescriptor, pOwner, bOwnerDefaulted));
353 /******************************************************************************
354 * GetSecurityDescriptorGroup [ADVAPI32.54]
356 BOOL WINAPI GetSecurityDescriptorGroup(
357 PSECURITY_DESCRIPTOR SecurityDescriptor,
359 LPBOOL GroupDefaulted)
361 CallWin32ToNt (RtlGetGroupSecurityDescriptor(SecurityDescriptor, Group, (PBOOLEAN)GroupDefaulted));
363 /******************************************************************************
364 * SetSecurityDescriptorGroup
366 BOOL WINAPI SetSecurityDescriptorGroup ( PSECURITY_DESCRIPTOR SecurityDescriptor,
367 PSID Group, BOOL GroupDefaulted)
369 CallWin32ToNt (RtlSetGroupSecurityDescriptor( SecurityDescriptor, Group, GroupDefaulted));
372 /******************************************************************************
373 * IsValidSecurityDescriptor [ADVAPI32.79]
379 IsValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor )
381 CallWin32ToNt (RtlValidSecurityDescriptor(SecurityDescriptor));
384 /******************************************************************************
385 * GetSecurityDescriptorDacl [ADVAPI.91]
387 BOOL WINAPI GetSecurityDescriptorDacl(
388 IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
389 OUT LPBOOL lpbDaclPresent,
391 OUT LPBOOL lpbDaclDefaulted)
393 CallWin32ToNt (RtlGetDaclSecurityDescriptor(pSecurityDescriptor, (PBOOLEAN)lpbDaclPresent,
394 pDacl, (PBOOLEAN)lpbDaclDefaulted));
397 /******************************************************************************
398 * SetSecurityDescriptorDacl [ADVAPI.224]
401 SetSecurityDescriptorDacl (
402 PSECURITY_DESCRIPTOR lpsd,
407 CallWin32ToNt (RtlSetDaclSecurityDescriptor (lpsd, daclpresent, dacl, dacldefaulted ));
409 /******************************************************************************
410 * GetSecurityDescriptorSacl [ADVAPI.]
412 BOOL WINAPI GetSecurityDescriptorSacl(
413 IN PSECURITY_DESCRIPTOR lpsd,
414 OUT LPBOOL lpbSaclPresent,
416 OUT LPBOOL lpbSaclDefaulted)
418 CallWin32ToNt (RtlGetSaclSecurityDescriptor(lpsd,
419 (PBOOLEAN)lpbSaclPresent, pSacl, (PBOOLEAN)lpbSaclDefaulted));
422 /**************************************************************************
423 * SetSecurityDescriptorSacl [NTDLL.488]
425 BOOL WINAPI SetSecurityDescriptorSacl (
426 PSECURITY_DESCRIPTOR lpsd,
431 CallWin32ToNt (RtlSetSaclSecurityDescriptor(lpsd, saclpresent, lpsacl, sacldefaulted));
433 /******************************************************************************
434 * MakeSelfRelativeSD [ADVAPI32.95]
443 IN PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
444 IN PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
445 IN OUT LPDWORD lpdwBufferLength)
447 CallWin32ToNt (RtlMakeSelfRelativeSD(pAbsoluteSecurityDescriptor,pSelfRelativeSecurityDescriptor, lpdwBufferLength));
450 /******************************************************************************
451 * GetSecurityDescriptorControl [ADVAPI32]
454 BOOL WINAPI GetSecurityDescriptorControl ( PSECURITY_DESCRIPTOR pSecurityDescriptor,
455 PSECURITY_DESCRIPTOR_CONTROL pControl, LPDWORD lpdwRevision)
457 CallWin32ToNt (RtlGetControlSecurityDescriptor(pSecurityDescriptor,pControl,lpdwRevision));
460 /* ##############################
461 ###### ACL FUNCTIONS ######
462 ##############################
465 /*************************************************************************
466 * InitializeAcl [ADVAPI32.111]
468 DWORD WINAPI InitializeAcl(PACL acl, DWORD size, DWORD rev)
470 CallWin32ToNt (RtlCreateAcl(acl, size, rev));
473 /* ##############################
474 ###### MISC FUNCTIONS ######
475 ##############################
478 /******************************************************************************
479 * LookupPrivilegeValueW [ADVAPI32.93]
480 * Retrieves LUID used on a system to represent the privilege name.
483 * lpLuid should be PLUID
486 * lpSystemName [I] Address of string specifying the system
487 * lpName [I] Address of string specifying the privilege
488 * lpLuid [I] Address of locally unique identifier
493 LookupPrivilegeValueW( LPCWSTR lpSystemName, LPCWSTR lpName, LPVOID lpLuid )
495 FIXME("(%s,%s,%p): stub\n",debugstr_w(lpSystemName),
496 debugstr_w(lpName), lpLuid);
500 /******************************************************************************
501 * LookupPrivilegeValueA [ADVAPI32.92]
504 LookupPrivilegeValueA( LPCSTR lpSystemName, LPCSTR lpName, LPVOID lpLuid )
506 LPWSTR lpSystemNameW = HEAP_strdupAtoW(GetProcessHeap(), 0, lpSystemName);
507 LPWSTR lpNameW = HEAP_strdupAtoW(GetProcessHeap(), 0, lpName);
510 ret = LookupPrivilegeValueW( lpSystemNameW, lpNameW, lpLuid);
511 HeapFree(GetProcessHeap(), 0, lpNameW);
512 HeapFree(GetProcessHeap(), 0, lpSystemNameW);
516 /******************************************************************************
517 * GetFileSecurityA [ADVAPI32.45]
519 * Obtains Specified information about the security of a file or directory
520 * The information obtained is constrained by the callers access rights and
524 GetFileSecurityA( LPCSTR lpFileName,
525 SECURITY_INFORMATION RequestedInformation,
526 PSECURITY_DESCRIPTOR pSecurityDescriptor,
527 DWORD nLength, LPDWORD lpnLengthNeeded )
529 FIXME("(%s) : stub\n", debugstr_a(lpFileName));
533 /******************************************************************************
534 * GetFileSecurityW [ADVAPI32.46]
536 * Obtains Specified information about the security of a file or directory
537 * The information obtained is constrained by the callers access rights and
542 * RequestedInformation []
543 * pSecurityDescriptor []
548 GetFileSecurityW( LPCWSTR lpFileName,
549 SECURITY_INFORMATION RequestedInformation,
550 PSECURITY_DESCRIPTOR pSecurityDescriptor,
551 DWORD nLength, LPDWORD lpnLengthNeeded )
553 FIXME("(%s) : stub\n", debugstr_w(lpFileName) );
558 /******************************************************************************
559 * LookupAccountSidA [ADVAPI32.86]
566 IN OUT LPDWORD accountSize,
568 IN OUT LPDWORD domainSize,
569 OUT PSID_NAME_USE name_use )
571 char * ac = "Administrator";
572 char * dm = "DOMAIN";
573 FIXME("(%s,sid=%p,%p,%p(%lu),%p,%p(%lu),%p): semi-stub\n",
574 debugstr_a(system),sid,
575 account,accountSize,accountSize?*accountSize:0,
576 domain,domainSize,domainSize?*domainSize:0,
579 if (accountSize) *accountSize = strlen(ac)+1;
580 if (account && (*accountSize > strlen(ac)))
583 if (domainSize) *domainSize = strlen(dm)+1;
584 if (domain && (*domainSize > strlen(dm)))
587 if (name_use) *name_use = SidTypeUser;
591 /******************************************************************************
592 * LookupAccountSidW [ADVAPI32.87]
608 IN OUT LPDWORD accountSize,
610 IN OUT LPDWORD domainSize,
611 OUT PSID_NAME_USE name_use )
613 char * ac = "Administrator";
614 char * dm = "DOMAIN";
615 FIXME("(%s,sid=%p,%p,%p(%lu),%p,%p(%lu),%p): semi-stub\n",
616 debugstr_w(system),sid,
617 account,accountSize,accountSize?*accountSize:0,
618 domain,domainSize,domainSize?*domainSize:0,
621 if (accountSize) *accountSize = strlen(ac)+1;
622 if (account && (*accountSize > strlen(ac)))
623 lstrcpyAtoW(account, ac);
625 if (domainSize) *domainSize = strlen(dm)+1;
626 if (domain && (*domainSize > strlen(dm)))
627 lstrcpyAtoW(domain,dm);
629 if (name_use) *name_use = SidTypeUser;
633 /******************************************************************************
634 * SetFileSecurityA [ADVAPI32.182]
635 * Sets the security of a file or directory
637 BOOL WINAPI SetFileSecurityA( LPCSTR lpFileName,
638 SECURITY_INFORMATION RequestedInformation,
639 PSECURITY_DESCRIPTOR pSecurityDescriptor)
641 FIXME("(%s) : stub\n", debugstr_a(lpFileName));
645 /******************************************************************************
646 * SetFileSecurityW [ADVAPI32.183]
647 * Sets the security of a file or directory
651 * RequestedInformation []
652 * pSecurityDescriptor []
655 SetFileSecurityW( LPCWSTR lpFileName,
656 SECURITY_INFORMATION RequestedInformation,
657 PSECURITY_DESCRIPTOR pSecurityDescriptor )
659 FIXME("(%s) : stub\n", debugstr_w(lpFileName) );
663 /******************************************************************************
664 * QueryWindows31FilesMigration [ADVAPI32.266]
670 QueryWindows31FilesMigration( DWORD x1 )
672 FIXME("(%ld):stub\n",x1);
676 /******************************************************************************
677 * SynchronizeWindows31FilesAndWindowsNTRegistry [ADVAPI32.265]
686 SynchronizeWindows31FilesAndWindowsNTRegistry( DWORD x1, DWORD x2, DWORD x3,
689 FIXME("(0x%08lx,0x%08lx,0x%08lx,0x%08lx):stub\n",x1,x2,x3,x4);
693 /******************************************************************************
694 * LsaOpenPolicy [ADVAPI32.200]
704 IN PLSA_UNICODE_STRING SystemName,
705 IN PLSA_OBJECT_ATTRIBUTES ObjectAttributes,
706 IN ACCESS_MASK DesiredAccess,
707 IN OUT PLSA_HANDLE PolicyHandle)
709 FIXME("(%s,%p,0x%08lx,%p):stub\n",
710 SystemName?debugstr_w(SystemName->Buffer):"null",
711 ObjectAttributes, DesiredAccess, PolicyHandle);
712 dumpLsaAttributes(ObjectAttributes);
713 if(PolicyHandle) *PolicyHandle = (LSA_HANDLE)0xcafe;
717 /******************************************************************************
718 * LsaQueryInformationPolicy [ADVAPI32.242]
721 LsaQueryInformationPolicy(
722 IN LSA_HANDLE PolicyHandle,
723 IN POLICY_INFORMATION_CLASS InformationClass,
726 FIXME("(%p,0x%08x,%p):stub\n",
727 PolicyHandle, InformationClass, Buffer);
729 if(!Buffer) return FALSE;
730 switch (InformationClass)
732 case PolicyAuditEventsInformation: /* 2 */
734 PPOLICY_AUDIT_EVENTS_INFO p = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(POLICY_AUDIT_EVENTS_INFO));
735 p->AuditingMode = FALSE; /* no auditing */
739 case PolicyPrimaryDomainInformation: /* 3 */
740 case PolicyAccountDomainInformation: /* 5 */
743 { POLICY_PRIMARY_DOMAIN_INFO ppdi;
746 SID_IDENTIFIER_AUTHORITY localSidAuthority = {SECURITY_NT_AUTHORITY};
748 struct di * xdi = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(xdi));
749 RtlInitUnicodeString(&(xdi->ppdi.Name), HEAP_strdupAtoW(GetProcessHeap(),0,"DOMAIN"));
750 xdi->ppdi.Sid = &(xdi->sid);
751 xdi->sid.Revision = SID_REVISION;
752 xdi->sid.SubAuthorityCount = 1;
753 xdi->sid.IdentifierAuthority = localSidAuthority;
754 xdi->sid.SubAuthority[0] = SECURITY_LOCAL_SYSTEM_RID;
758 case PolicyAuditLogInformation:
759 case PolicyPdAccountInformation:
760 case PolicyLsaServerRoleInformation:
761 case PolicyReplicaSourceInformation:
762 case PolicyDefaultQuotaInformation:
763 case PolicyModificationInformation:
764 case PolicyAuditFullSetInformation:
765 case PolicyAuditFullQueryInformation:
766 case PolicyDnsDomainInformation:
768 FIXME("category not implemented\n");
775 /******************************************************************************
776 * LsaLookupSids [ADVAPI32.240]
781 LSA_UNICODE_STRING Name;
783 } LSA_TRANSLATED_NAME, *PLSA_TRANSLATED_NAME;
787 LSA_UNICODE_STRING Name;
789 } LSA_TRUST_INFORMATION, *PLSA_TRUST_INFORMATION;
794 PLSA_TRUST_INFORMATION Domains;
795 } LSA_REFERENCED_DOMAIN_LIST, *PLSA_REFERENCED_DOMAIN_LIST;
799 IN LSA_HANDLE PolicyHandle,
802 OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains,
803 OUT PLSA_TRANSLATED_NAME *Names )
805 FIXME("%p %lu %p %p %p\n",
806 PolicyHandle, Count, Sids, ReferencedDomains, Names);
810 /******************************************************************************
811 * LsaFreeMemory [ADVAPI32.241]
814 LsaFreeMemory(IN PVOID Buffer)
816 TRACE("(%p)\n",Buffer);
817 return HeapFree(GetProcessHeap(), 0, Buffer);
819 /******************************************************************************
820 * LsaClose [ADVAPI32.243]
823 LsaClose(IN LSA_HANDLE ObjectHandle)
825 FIXME("(%p):stub\n",ObjectHandle);
828 /******************************************************************************
829 * NotifyBootConfigStatus [ADVAPI32.97]
835 NotifyBootConfigStatus( DWORD x1 )
837 FIXME("(0x%08lx):stub\n",x1);
841 /******************************************************************************
842 * RevertToSelf [ADVAPI32.180]
854 /******************************************************************************
855 * ImpersonateSelf [ADVAPI32.71]
858 ImpersonateSelf(SECURITY_IMPERSONATION_LEVEL ImpersonationLevel)
860 return RtlImpersonateSelf(ImpersonationLevel);
863 /******************************************************************************
864 * AccessCheck [ADVAPI32.71]
866 * FIXME check cast LPBOOL to PBOOLEAN
870 PSECURITY_DESCRIPTOR SecurityDescriptor,
873 PGENERIC_MAPPING GenericMapping,
874 PPRIVILEGE_SET PrivilegeSet,
875 LPDWORD PrivilegeSetLength,
876 LPDWORD GrantedAccess,
879 CallWin32ToNt (NtAccessCheck(SecurityDescriptor, ClientToken, DesiredAccess,
880 GenericMapping, PrivilegeSet, PrivilegeSetLength, GrantedAccess, (PBOOLEAN)AccessStatus));
883 /*************************************************************************
884 * SetKernelObjectSecurity [ADVAPI32.223]
886 BOOL WINAPI SetKernelObjectSecurity (
888 IN SECURITY_INFORMATION SecurityInformation,
889 IN PSECURITY_DESCRIPTOR SecurityDescriptor )
891 CallWin32ToNt (NtSetSecurityObject (Handle, SecurityInformation, SecurityDescriptor));
894 /******************************************************************************
895 * AddAccessAllowedAce
897 BOOL WINAPI AddAccessAllowedAce(
899 IN DWORD dwAceRevision,
903 return RtlAddAccessAllowedAce(pAcl, dwAceRevision, AccessMask, pSid);