git.oblomov.eu Git - wine/blob - dlls/advapi32/tests/security.c

   1 /*
   2  * Unit tests for security functions
   3  *
   4  * Copyright (c) 2004 Mike McCormack
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20
  21 #include <stdio.h>
  22
  23 #include "wine/test.h"
  24 #include "windef.h"
  25 #include "winbase.h"
  26 #include "winerror.h"
  27 #include "aclapi.h"
  28 #include "winnt.h"
  29
  30 typedef VOID (WINAPI *fnBuildTrusteeWithSidA)( PTRUSTEEA pTrustee, PSID pSid );
  31 typedef VOID (WINAPI *fnBuildTrusteeWithNameA)( PTRUSTEEA pTrustee, LPSTR pName );
  32 typedef VOID (WINAPI *fnBuildTrusteeWithObjectsAndNameA)( PTRUSTEEA pTrustee,
  33                                                           POBJECTS_AND_NAME_A pObjName,
  34                                                           SE_OBJECT_TYPE ObjectType,
  35                                                           LPSTR ObjectTypeName,
  36                                                           LPSTR InheritedObjectTypeName,
  37                                                           LPSTR Name );
  38 typedef VOID (WINAPI *fnBuildTrusteeWithObjectsAndSidA)( PTRUSTEEA pTrustee,
  39                                                          POBJECTS_AND_SID pObjSid,
  40                                                          GUID* pObjectGuid,
  41                                                          GUID* pInheritedObjectGuid,
  42                                                          PSID pSid );
  43 typedef LPSTR (WINAPI *fnGetTrusteeNameA)( PTRUSTEEA pTrustee );
  44 typedef BOOL (WINAPI *fnConvertSidToStringSidA)( PSID pSid, LPSTR *str );
  45 typedef BOOL (WINAPI *fnConvertStringSidToSidA)( LPCSTR str, PSID pSid );
  46 typedef BOOL (WINAPI *fnGetFileSecurityA)(LPCSTR, SECURITY_INFORMATION,
  47                                           PSECURITY_DESCRIPTOR, DWORD, LPDWORD);
  48 typedef DWORD (WINAPI *fnRtlAdjustPrivilege)(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
  49
  50 static HMODULE hmod;
  51
  52 fnBuildTrusteeWithSidA   pBuildTrusteeWithSidA;
  53 fnBuildTrusteeWithNameA  pBuildTrusteeWithNameA;
  54 fnBuildTrusteeWithObjectsAndNameA pBuildTrusteeWithObjectsAndNameA;
  55 fnBuildTrusteeWithObjectsAndSidA pBuildTrusteeWithObjectsAndSidA;
  56 fnGetTrusteeNameA pGetTrusteeNameA;
  57 fnConvertSidToStringSidA pConvertSidToStringSidA;
  58 fnConvertStringSidToSidA pConvertStringSidToSidA;
  59 fnGetFileSecurityA pGetFileSecurityA;
  60 fnRtlAdjustPrivilege pRtlAdjustPrivilege;
  61
  62 struct sidRef
  63 {
  64     SID_IDENTIFIER_AUTHORITY auth;
  65     const char *refStr;
  66 };
  67
  68 static void init(void)
  69 {
  70     hmod = GetModuleHandle("advapi32.dll");
  71 }
  72
  73 static void test_sid(void)
  74 {
  75     struct sidRef refs[] = {
  76      { { {0x00,0x00,0x33,0x44,0x55,0x66} }, "S-1-860116326-1" },
  77      { { {0x00,0x00,0x01,0x02,0x03,0x04} }, "S-1-16909060-1"  },
  78      { { {0x00,0x00,0x00,0x01,0x02,0x03} }, "S-1-66051-1"     },
  79      { { {0x00,0x00,0x00,0x00,0x01,0x02} }, "S-1-258-1"       },
  80      { { {0x00,0x00,0x00,0x00,0x00,0x02} }, "S-1-2-1"         },
  81      { { {0x00,0x00,0x00,0x00,0x00,0x0c} }, "S-1-12-1"        },
  82     };
  83     const char noSubAuthStr[] = "S-1-5";
  84     unsigned int i;
  85     PSID psid = NULL;
  86     BOOL r;
  87     LPSTR str = NULL;
  88
  89     pConvertSidToStringSidA = (fnConvertSidToStringSidA)
  90                     GetProcAddress( hmod, "ConvertSidToStringSidA" );
  91     if( !pConvertSidToStringSidA )
  92         return;
  93     pConvertStringSidToSidA = (fnConvertStringSidToSidA)
  94                     GetProcAddress( hmod, "ConvertStringSidToSidA" );
  95     if( !pConvertStringSidToSidA )
  96         return;
  97
  98     r = pConvertStringSidToSidA( NULL, NULL );
  99     ok( !r, "expected failure with NULL parameters\n" );
 100     if( GetLastError() == ERROR_CALL_NOT_IMPLEMENTED )
 101         return;
 102     ok( GetLastError() == ERROR_INVALID_PARAMETER,
 103      "expected GetLastError() is ERROR_INVALID_PARAMETER, got %ld\n",
 104      GetLastError() );
 105
 106     r = pConvertStringSidToSidA( refs[0].refStr, NULL );
 107     ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
 108      "expected GetLastError() is ERROR_INVALID_PARAMETER, got %ld\n",
 109      GetLastError() );
 110
 111     r = pConvertStringSidToSidA( NULL, &str );
 112     ok( !r && GetLastError() == ERROR_INVALID_PARAMETER,
 113      "expected GetLastError() is ERROR_INVALID_PARAMETER, got %ld\n",
 114      GetLastError() );
 115
 116     r = pConvertStringSidToSidA( noSubAuthStr, &psid );
 117     ok( !r,
 118      "expected failure with no sub authorities\n" );
 119     ok( GetLastError() == ERROR_INVALID_SID,
 120      "expected GetLastError() is ERROR_INVALID_SID, got %ld\n",
 121      GetLastError() );
 122
 123     for( i = 0; i < sizeof(refs) / sizeof(refs[0]); i++ )
 124     {
 125         PISID pisid;
 126
 127         r = AllocateAndInitializeSid( &refs[i].auth, 1,1,0,0,0,0,0,0,0,
 128          &psid );
 129         ok( r, "failed to allocate sid\n" );
 130         r = pConvertSidToStringSidA( psid, &str );
 131         ok( r, "failed to convert sid\n" );
 132         if (r)
 133         {
 134             ok( !strcmp( str, refs[i].refStr ),
 135                 "incorrect sid, expected %s, got %s\n", refs[i].refStr, str );
 136             LocalFree( str );
 137         }
 138         if( psid )
 139             FreeSid( psid );
 140
 141         r = pConvertStringSidToSidA( refs[i].refStr, &psid );
 142         ok( r, "failed to parse sid string\n" );
 143         pisid = (PISID)psid;
 144         ok( pisid &&
 145          !memcmp( pisid->IdentifierAuthority.Value, refs[i].auth.Value,
 146          sizeof(refs[i].auth) ),
 147          "string sid %s didn't parse to expected value\n"
 148          "(got 0x%04x%08lx, expected 0x%04x%08lx)\n",
 149          refs[i].refStr,
 150          MAKEWORD( pisid->IdentifierAuthority.Value[1],
 151          pisid->IdentifierAuthority.Value[0] ),
 152          MAKELONG( MAKEWORD( pisid->IdentifierAuthority.Value[5],
 153          pisid->IdentifierAuthority.Value[4] ),
 154          MAKEWORD( pisid->IdentifierAuthority.Value[3],
 155          pisid->IdentifierAuthority.Value[2] ) ),
 156          MAKEWORD( refs[i].auth.Value[1], refs[i].auth.Value[0] ),
 157          MAKELONG( MAKEWORD( refs[i].auth.Value[5], refs[i].auth.Value[4] ),
 158          MAKEWORD( refs[i].auth.Value[3], refs[i].auth.Value[2] ) ) );
 159         if( psid )
 160             LocalFree( psid );
 161     }
 162 }
 163
 164 static void test_trustee(void)
 165 {
 166     GUID ObjectType = {0x12345678, 0x1234, 0x5678, {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88}};
 167     GUID InheritedObjectType = {0x23456789, 0x2345, 0x6786, {0x2, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99}};
 168     GUID ZeroGuid;
 169     OBJECTS_AND_NAME_ oan;
 170     OBJECTS_AND_SID oas;
 171     TRUSTEE trustee;
 172     PSID psid;
 173     char szObjectTypeName[] = "ObjectTypeName";
 174     char szInheritedObjectTypeName[] = "InheritedObjectTypeName";
 175     char szTrusteeName[] = "szTrusteeName";
 176     SID_IDENTIFIER_AUTHORITY auth = { {0x11,0x22,0,0,0, 0} };
 177
 178     memset( &ZeroGuid, 0x00, sizeof (ZeroGuid) );
 179
 180     pBuildTrusteeWithSidA = (fnBuildTrusteeWithSidA)
 181                     GetProcAddress( hmod, "BuildTrusteeWithSidA" );
 182     pBuildTrusteeWithNameA = (fnBuildTrusteeWithNameA)
 183                     GetProcAddress( hmod, "BuildTrusteeWithNameA" );
 184     pBuildTrusteeWithObjectsAndNameA = (fnBuildTrusteeWithObjectsAndNameA)
 185                     GetProcAddress (hmod, "BuildTrusteeWithObjectsAndNameA" );
 186     pBuildTrusteeWithObjectsAndSidA = (fnBuildTrusteeWithObjectsAndSidA)
 187                     GetProcAddress (hmod, "BuildTrusteeWithObjectsAndSidA" );
 188     pGetTrusteeNameA = (fnGetTrusteeNameA)
 189                     GetProcAddress (hmod, "GetTrusteeNameA" );
 190     if( !pBuildTrusteeWithSidA || !pBuildTrusteeWithNameA ||
 191         !pBuildTrusteeWithObjectsAndNameA || !pBuildTrusteeWithObjectsAndSidA ||
 192         !pGetTrusteeNameA )
 193         return;
 194
 195     if ( ! AllocateAndInitializeSid( &auth, 1, 42, 0,0,0,0,0,0,0,&psid ) )
 196     {
 197         trace( "failed to init SID\n" );
 198        return;
 199     }
 200
 201     /* test BuildTrusteeWithSidA */
 202     memset( &trustee, 0xff, sizeof trustee );
 203     pBuildTrusteeWithSidA( &trustee, psid );
 204
 205     ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 206     ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
 207         "MultipleTrusteeOperation wrong\n");
 208     ok( trustee.TrusteeForm == TRUSTEE_IS_SID, "TrusteeForm wrong\n");
 209     ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 210     ok( trustee.ptstrName == (LPSTR) psid, "ptstrName wrong\n" );
 211
 212     /* test BuildTrusteeWithObjectsAndSidA (test 1) */
 213     memset( &trustee, 0xff, sizeof trustee );
 214     memset( &oas, 0xff, sizeof(oas) );
 215     pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, &ObjectType,
 216                                     &InheritedObjectType, psid);
 217
 218     ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 219     ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
 220     ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
 221     ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 222     ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
 223
 224     ok(oas.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
 225     ok(!memcmp(&oas.ObjectTypeGuid, &ObjectType, sizeof(GUID)), "ObjectTypeGuid wrong\n");
 226     ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
 227     ok(oas.pSid == psid, "pSid wrong\n");
 228
 229     /* test GetTrusteeNameA */
 230     ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oas, "GetTrusteeName returned wrong value\n");
 231
 232     /* test BuildTrusteeWithObjectsAndSidA (test 2) */
 233     memset( &trustee, 0xff, sizeof trustee );
 234     memset( &oas, 0xff, sizeof(oas) );
 235     pBuildTrusteeWithObjectsAndSidA(&trustee, &oas, NULL,
 236                                     &InheritedObjectType, psid);
 237
 238     ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 239     ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
 240     ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_SID, "TrusteeForm wrong\n");
 241     ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 242     ok(trustee.ptstrName == (LPSTR)&oas, "ptstrName wrong\n");
 243
 244     ok(oas.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
 245     ok(!memcmp(&oas.ObjectTypeGuid, &ZeroGuid, sizeof(GUID)), "ObjectTypeGuid wrong\n");
 246     ok(!memcmp(&oas.InheritedObjectTypeGuid, &InheritedObjectType, sizeof(GUID)), "InheritedObjectTypeGuid wrong\n");
 247     ok(oas.pSid == psid, "pSid wrong\n");
 248
 249     FreeSid( psid );
 250
 251     /* test BuildTrusteeWithNameA */
 252     memset( &trustee, 0xff, sizeof trustee );
 253     pBuildTrusteeWithNameA( &trustee, szTrusteeName );
 254
 255     ok( trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 256     ok( trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE,
 257         "MultipleTrusteeOperation wrong\n");
 258     ok( trustee.TrusteeForm == TRUSTEE_IS_NAME, "TrusteeForm wrong\n");
 259     ok( trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 260     ok( trustee.ptstrName == szTrusteeName, "ptstrName wrong\n" );
 261
 262     /* test BuildTrusteeWithObjectsAndNameA (test 1) */
 263     memset( &trustee, 0xff, sizeof trustee );
 264     memset( &oan, 0xff, sizeof(oan) );
 265     pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
 266                                      szInheritedObjectTypeName, szTrusteeName);
 267
 268     ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 269     ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
 270     ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
 271     ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 272     ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
 273
 274     ok(oan.ObjectsPresent == (ACE_OBJECT_TYPE_PRESENT | ACE_INHERITED_OBJECT_TYPE_PRESENT), "ObjectsPresent wrong\n");
 275     ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
 276     ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
 277     ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
 278
 279     /* test GetTrusteeNameA */
 280     ok(pGetTrusteeNameA(&trustee) == (LPSTR)&oan, "GetTrusteeName returned wrong value\n");
 281
 282     /* test BuildTrusteeWithObjectsAndNameA (test 2) */
 283     memset( &trustee, 0xff, sizeof trustee );
 284     memset( &oan, 0xff, sizeof(oan) );
 285     pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, NULL,
 286                                      szInheritedObjectTypeName, szTrusteeName);
 287
 288     ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 289     ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
 290     ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
 291     ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 292     ok(trustee.ptstrName == (LPSTR)&oan, "ptstrName wrong\n");
 293
 294     ok(oan.ObjectsPresent == ACE_INHERITED_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
 295     ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
 296     ok(oan.InheritedObjectTypeName == szInheritedObjectTypeName, "InheritedObjectTypeName wrong\n");
 297     ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
 298
 299     /* test BuildTrusteeWithObjectsAndNameA (test 3) */
 300     memset( &trustee, 0xff, sizeof trustee );
 301     memset( &oan, 0xff, sizeof(oan) );
 302     pBuildTrusteeWithObjectsAndNameA(&trustee, &oan, SE_KERNEL_OBJECT, szObjectTypeName,
 303                                      NULL, szTrusteeName);
 304
 305     ok(trustee.pMultipleTrustee == NULL, "pMultipleTrustee wrong\n");
 306     ok(trustee.MultipleTrusteeOperation == NO_MULTIPLE_TRUSTEE, "MultipleTrusteeOperation wrong\n");
 307     ok(trustee.TrusteeForm == TRUSTEE_IS_OBJECTS_AND_NAME, "TrusteeForm wrong\n");
 308     ok(trustee.TrusteeType == TRUSTEE_IS_UNKNOWN, "TrusteeType wrong\n");
 309     ok(trustee.ptstrName == (LPTSTR)&oan, "ptstrName wrong\n");
 310
 311     ok(oan.ObjectsPresent == ACE_OBJECT_TYPE_PRESENT, "ObjectsPresent wrong\n");
 312     ok(oan.ObjectType == SE_KERNEL_OBJECT, "ObjectType wrong\n");
 313     ok(oan.InheritedObjectTypeName == NULL, "InheritedObjectTypeName wrong\n");
 314     ok(oan.ptstrName == szTrusteeName, "szTrusteeName wrong\n");
 315 }
 316
 317 /* If the first isn't defined, assume none is */
 318 #ifndef SE_MIN_WELL_KNOWN_PRIVILEGE
 319 #define SE_MIN_WELL_KNOWN_PRIVILEGE       2L
 320 #define SE_CREATE_TOKEN_PRIVILEGE         2L
 321 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE   3L
 322 #define SE_LOCK_MEMORY_PRIVILEGE          4L
 323 #define SE_INCREASE_QUOTA_PRIVILEGE       5L
 324 #define SE_MACHINE_ACCOUNT_PRIVILEGE      6L
 325 #define SE_TCB_PRIVILEGE                  7L
 326 #define SE_SECURITY_PRIVILEGE             8L
 327 #define SE_TAKE_OWNERSHIP_PRIVILEGE       9L
 328 #define SE_LOAD_DRIVER_PRIVILEGE         10L
 329 #define SE_SYSTEM_PROFILE_PRIVILEGE      11L
 330 #define SE_SYSTEMTIME_PRIVILEGE          12L
 331 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13L
 332 #define SE_INC_BASE_PRIORITY_PRIVILEGE   14L
 333 #define SE_CREATE_PAGEFILE_PRIVILEGE     15L
 334 #define SE_CREATE_PERMANENT_PRIVILEGE    16L
 335 #define SE_BACKUP_PRIVILEGE              17L
 336 #define SE_RESTORE_PRIVILEGE             18L
 337 #define SE_SHUTDOWN_PRIVILEGE            19L
 338 #define SE_DEBUG_PRIVILEGE               20L
 339 #define SE_AUDIT_PRIVILEGE               21L
 340 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE  22L
 341 #define SE_CHANGE_NOTIFY_PRIVILLEGE      23L
 342 #define SE_REMOTE_SHUTDOWN_PRIVILEGE     24L
 343 #define SE_UNDOCK_PRIVILEGE              25L
 344 #define SE_SYNC_AGENT_PRIVILEGE          26L
 345 #define SE_ENABLE_DELEGATION_PRIVILEGE   27L
 346 #define SE_MANAGE_VOLUME_PRIVILEGE       28L
 347 #define SE_IMPERSONATE_PRIVILEGE         29L
 348 #define SE_CREATE_GLOBAL_PRIVILEGE       30L
 349 #define SE_MAX_WELL_KNOWN_PRIVILEGE      SE_CREATE_GLOBAL_PRIVILEGE
 350 #endif /* ndef SE_MIN_WELL_KNOWN_PRIVILEGE */
 351
 352 static void test_allocateLuid(void)
 353 {
 354     BOOL (WINAPI *pAllocateLocallyUniqueId)(PLUID);
 355     LUID luid1, luid2;
 356     BOOL ret;
 357
 358     pAllocateLocallyUniqueId = (void*)GetProcAddress(hmod, "AllocateLocallyUniqueId");
 359     if (!pAllocateLocallyUniqueId) return;
 360
 361     ret = pAllocateLocallyUniqueId(&luid1);
 362     if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
 363         return;
 364
 365     ok(ret,
 366      "AllocateLocallyUniqueId failed: %ld\n", GetLastError());
 367     ret = pAllocateLocallyUniqueId(&luid2);
 368     ok( ret,
 369      "AllocateLocallyUniqueId failed: %ld\n", GetLastError());
 370     ok(luid1.LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE || luid1.HighPart != 0,
 371      "AllocateLocallyUniqueId returned a well-known LUID\n");
 372     ok(luid1.LowPart != luid2.LowPart || luid1.HighPart != luid2.HighPart,
 373      "AllocateLocallyUniqueId returned non-unique LUIDs\n");
 374     ret = pAllocateLocallyUniqueId(NULL);
 375     ok( !ret && GetLastError() == ERROR_NOACCESS,
 376      "AllocateLocallyUniqueId(NULL) didn't return ERROR_NOACCESS: %ld\n",
 377      GetLastError());
 378 }
 379
 380 static void test_lookupPrivilegeName(void)
 381 {
 382     BOOL (WINAPI *pLookupPrivilegeNameA)(LPCSTR, PLUID, LPSTR, LPDWORD);
 383     char buf[MAX_PATH]; /* arbitrary, seems long enough */
 384     DWORD cchName = sizeof(buf);
 385     LUID luid = { 0, 0 };
 386     LONG i;
 387     BOOL ret;
 388
 389     /* check whether it's available first */
 390     pLookupPrivilegeNameA = (void*)GetProcAddress(hmod, "LookupPrivilegeNameA");
 391     if (!pLookupPrivilegeNameA) return;
 392     luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
 393     ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
 394     if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
 395         return;
 396
 397     /* check with a short buffer */
 398     cchName = 0;
 399     luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
 400     ret = pLookupPrivilegeNameA(NULL, &luid, NULL, &cchName);
 401     ok( !ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
 402      "LookupPrivilegeNameA didn't fail with ERROR_INSUFFICIENT_BUFFER: %ld\n",
 403      GetLastError());
 404     ok(cchName == strlen("SeCreateTokenPrivilege") + 1,
 405      "LookupPrivilegeNameA returned an incorrect required length for\n"
 406      "SeCreateTokenPrivilege (got %ld, expected %d)\n", cchName,
 407      strlen("SeCreateTokenPrivilege") + 1);
 408     /* check a known value and its returned length on success */
 409     cchName = sizeof(buf);
 410     ok(pLookupPrivilegeNameA(NULL, &luid, buf, &cchName) &&
 411      cchName == strlen("SeCreateTokenPrivilege"),
 412      "LookupPrivilegeNameA returned an incorrect output length for\n"
 413      "SeCreateTokenPrivilege (got %ld, expected %d)\n", cchName,
 414      (int)strlen("SeCreateTokenPrivilege"));
 415     /* check known values */
 416     for (i = SE_MIN_WELL_KNOWN_PRIVILEGE; i < SE_MAX_WELL_KNOWN_PRIVILEGE; i++)
 417     {
 418         luid.LowPart = i;
 419         cchName = sizeof(buf);
 420         ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
 421         ok( ret || GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
 422          "LookupPrivilegeNameA(0.%ld) failed: %ld\n", i, GetLastError());
 423     }
 424     /* check a bogus LUID */
 425     luid.LowPart = 0xdeadbeef;
 426     cchName = sizeof(buf);
 427     ret = pLookupPrivilegeNameA(NULL, &luid, buf, &cchName);
 428     ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
 429      "LookupPrivilegeNameA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %ld\n",
 430      GetLastError());
 431     /* check on a bogus system */
 432     luid.LowPart = SE_CREATE_TOKEN_PRIVILEGE;
 433     cchName = sizeof(buf);
 434     ret = pLookupPrivilegeNameA("b0gu5.Nam3", &luid, buf, &cchName);
 435     ok( !ret && GetLastError() == RPC_S_SERVER_UNAVAILABLE,
 436      "LookupPrivilegeNameA didn't fail with RPC_S_SERVER_UNAVAILABLE: %ld\n",
 437      GetLastError());
 438 }
 439
 440 struct NameToLUID
 441 {
 442     const char *name;
 443     DWORD lowPart;
 444 };
 445
 446 static void test_lookupPrivilegeValue(void)
 447 {
 448     static const struct NameToLUID privs[] = {
 449      { "SeCreateTokenPrivilege", SE_CREATE_TOKEN_PRIVILEGE },
 450      { "SeAssignPrimaryTokenPrivilege", SE_ASSIGNPRIMARYTOKEN_PRIVILEGE },
 451      { "SeLockMemoryPrivilege", SE_LOCK_MEMORY_PRIVILEGE },
 452      { "SeIncreaseQuotaPrivilege", SE_INCREASE_QUOTA_PRIVILEGE },
 453      { "SeMachineAccountPrivilege", SE_MACHINE_ACCOUNT_PRIVILEGE },
 454      { "SeTcbPrivilege", SE_TCB_PRIVILEGE },
 455      { "SeSecurityPrivilege", SE_SECURITY_PRIVILEGE },
 456      { "SeTakeOwnershipPrivilege", SE_TAKE_OWNERSHIP_PRIVILEGE },
 457      { "SeLoadDriverPrivilege", SE_LOAD_DRIVER_PRIVILEGE },
 458      { "SeSystemProfilePrivilege", SE_SYSTEM_PROFILE_PRIVILEGE },
 459      { "SeSystemtimePrivilege", SE_SYSTEMTIME_PRIVILEGE },
 460      { "SeProfileSingleProcessPrivilege", SE_PROF_SINGLE_PROCESS_PRIVILEGE },
 461      { "SeIncreaseBasePriorityPrivilege", SE_INC_BASE_PRIORITY_PRIVILEGE },
 462      { "SeCreatePagefilePrivilege", SE_CREATE_PAGEFILE_PRIVILEGE },
 463      { "SeCreatePermanentPrivilege", SE_CREATE_PERMANENT_PRIVILEGE },
 464      { "SeBackupPrivilege", SE_BACKUP_PRIVILEGE },
 465      { "SeRestorePrivilege", SE_RESTORE_PRIVILEGE },
 466      { "SeShutdownPrivilege", SE_SHUTDOWN_PRIVILEGE },
 467      { "SeDebugPrivilege", SE_DEBUG_PRIVILEGE },
 468      { "SeAuditPrivilege", SE_AUDIT_PRIVILEGE },
 469      { "SeSystemEnvironmentPrivilege", SE_SYSTEM_ENVIRONMENT_PRIVILEGE },
 470      { "SeChangeNotifyPrivilege", SE_CHANGE_NOTIFY_PRIVILLEGE },
 471      { "SeRemoteShutdownPrivilege", SE_REMOTE_SHUTDOWN_PRIVILEGE },
 472      { "SeUndockPrivilege", SE_UNDOCK_PRIVILEGE },
 473      { "SeSyncAgentPrivilege", SE_SYNC_AGENT_PRIVILEGE },
 474      { "SeEnableDelegationPrivilege", SE_ENABLE_DELEGATION_PRIVILEGE },
 475      { "SeManageVolumePrivilege", SE_MANAGE_VOLUME_PRIVILEGE },
 476      { "SeImpersonatePrivilege", SE_IMPERSONATE_PRIVILEGE },
 477      { "SeCreateGlobalPrivilege", SE_CREATE_GLOBAL_PRIVILEGE },
 478     };
 479     BOOL (WINAPI *pLookupPrivilegeValueA)(LPCSTR, LPCSTR, PLUID);
 480     int i;
 481     LUID luid;
 482     BOOL ret;
 483
 484     /* check whether it's available first */
 485     pLookupPrivilegeValueA = (void*)GetProcAddress(hmod, "LookupPrivilegeValueA");
 486     if (!pLookupPrivilegeValueA) return;
 487     ret = pLookupPrivilegeValueA(NULL, "SeCreateTokenPrivilege", &luid);
 488     if (!ret && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
 489         return;
 490
 491     /* check a bogus system name */
 492     ret = pLookupPrivilegeValueA("b0gu5.Nam3", "SeCreateTokenPrivilege", &luid);
 493     ok( !ret && GetLastError() == RPC_S_SERVER_UNAVAILABLE,
 494      "LookupPrivilegeValueA didn't fail with RPC_S_SERVER_UNAVAILABLE: %ld\n",
 495      GetLastError());
 496     /* check a NULL string */
 497     ret = pLookupPrivilegeValueA(NULL, 0, &luid);
 498     ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
 499      "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %ld\n",
 500      GetLastError());
 501     /* check a bogus privilege name */
 502     ret = pLookupPrivilegeValueA(NULL, "SeBogusPrivilege", &luid);
 503     ok( !ret && GetLastError() == ERROR_NO_SUCH_PRIVILEGE,
 504      "LookupPrivilegeValueA didn't fail with ERROR_NO_SUCH_PRIVILEGE: %ld\n",
 505      GetLastError());
 506     /* check case insensitive */
 507     ret = pLookupPrivilegeValueA(NULL, "sEcREATEtOKENpRIVILEGE", &luid);
 508     ok( ret,
 509      "LookupPrivilegeValueA(NULL, sEcREATEtOKENpRIVILEGE, &luid) failed: %ld\n",
 510      GetLastError());
 511     for (i = 0; i < sizeof(privs) / sizeof(privs[0]); i++)
 512     {
 513         /* Not all privileges are implemented on all Windows versions, so
 514          * don't worry if the call fails
 515          */
 516         if (pLookupPrivilegeValueA(NULL, privs[i].name, &luid))
 517         {
 518             ok(luid.LowPart == privs[i].lowPart,
 519              "LookupPrivilegeValueA returned an invalid LUID for %s\n",
 520              privs[i].name);
 521         }
 522     }
 523 }
 524
 525 static void test_luid(void)
 526 {
 527     test_allocateLuid();
 528     test_lookupPrivilegeName();
 529     test_lookupPrivilegeValue();
 530 }
 531
 532 static void test_FileSecurity(void)
 533 {
 534     char directory[MAX_PATH];
 535     DWORD retval, outSize;
 536     BOOL result;
 537     BYTE buffer[0x40];
 538
 539     pGetFileSecurityA = (fnGetFileSecurityA)
 540                     GetProcAddress( hmod, "GetFileSecurityA" );
 541     if( !pGetFileSecurityA )
 542         return;
 543
 544     retval = GetTempPathA(sizeof(directory), directory);
 545     if (!retval) {
 546         trace("GetTempPathA failed\n");
 547         return;
 548     }
 549
 550     strcpy(directory, "\\Should not exist");
 551
 552     SetLastError(NO_ERROR);
 553     result = pGetFileSecurityA( directory,OWNER_SECURITY_INFORMATION,buffer,0x40,&outSize);
 554     ok(!result, "GetFileSecurityA should fail for not existing directories/files\n");
 555     ok( (GetLastError() == ERROR_FILE_NOT_FOUND ) ||
 556         (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED) ,
 557         "last error ERROR_FILE_NOT_FOUND / ERROR_CALL_NOT_IMPLEMENTED (98) "
 558         "expected, got %ld\n", GetLastError());
 559 }
 560
 561 static void test_AccessCheck(void)
 562 {
 563     PSID EveryoneSid = NULL, AdminSid = NULL, UsersSid = NULL;
 564     PACL Acl = NULL;
 565     SECURITY_DESCRIPTOR *SecurityDescriptor = NULL;
 566     SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY };
 567     SID_IDENTIFIER_AUTHORITY SIDAuthNT = { SECURITY_NT_AUTHORITY };
 568     GENERIC_MAPPING Mapping = { KEY_READ, KEY_WRITE, KEY_EXECUTE, KEY_ALL_ACCESS };
 569     ACCESS_MASK Access;
 570     BOOL AccessStatus;
 571     HANDLE Token;
 572     BOOL ret;
 573     DWORD PrivSetLen;
 574     PRIVILEGE_SET *PrivSet;
 575     BOOL res;
 576     HMODULE NtDllModule;
 577     BOOLEAN Enabled;
 578
 579     NtDllModule = GetModuleHandle("ntdll.dll");
 580
 581     if (!NtDllModule)
 582     {
 583         trace("not running on NT, skipping test\n");
 584         return;
 585     }
 586     pRtlAdjustPrivilege = (fnRtlAdjustPrivilege)
 587                           GetProcAddress(NtDllModule, "RtlAdjustPrivilege");
 588     if (!pRtlAdjustPrivilege) return;
 589
 590     Acl = HeapAlloc(GetProcessHeap(), 0, 256);
 591     res = InitializeAcl(Acl, 256, ACL_REVISION);
 592     if(!res && GetLastError() == ERROR_CALL_NOT_IMPLEMENTED)
 593     {
 594         trace("ACLs not implemented - skipping tests\n");
 595         return;
 596     }
 597     ok(res, "InitializeAcl failed with error %ld\n", GetLastError());
 598
 599     res = AllocateAndInitializeSid( &SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &EveryoneSid);
 600     ok(res, "AllocateAndInitializeSid failed with error %ld\n", GetLastError());
 601
 602     res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
 603         DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdminSid);
 604     ok(res, "AllocateAndInitializeSid failed with error %ld\n", GetLastError());
 605
 606     res = AllocateAndInitializeSid( &SIDAuthNT, 2, SECURITY_BUILTIN_DOMAIN_RID,
 607         DOMAIN_ALIAS_RID_USERS, 0, 0, 0, 0, 0, 0, &UsersSid);
 608     ok(res, "AllocateAndInitializeSid failed with error %ld\n", GetLastError());
 609
 610     res = AddAccessAllowedAce(Acl, ACL_REVISION, KEY_READ, EveryoneSid);
 611     ok(res, "AddAccessAllowedAceEx failed with error %ld\n", GetLastError());
 612
 613     res = AddAccessAllowedAce(Acl, ACL_REVISION, KEY_ALL_ACCESS, AdminSid);
 614     ok(res, "AddAccessAllowedAceEx failed with error %ld\n", GetLastError());
 615
 616     SecurityDescriptor = HeapAlloc(GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
 617
 618     res = InitializeSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
 619     ok(res, "InitializeSecurityDescriptor failed with error %ld\n", GetLastError());
 620
 621     res = SetSecurityDescriptorDacl(SecurityDescriptor, TRUE, Acl, FALSE);
 622     ok(res, "SetSecurityDescriptorDacl failed with error %ld\n", GetLastError());
 623
 624     res = SetSecurityDescriptorOwner(SecurityDescriptor, AdminSid, FALSE);
 625     ok(res, "SetSecurityDescriptorOwner failed with error %ld\n", GetLastError());
 626
 627     res = SetSecurityDescriptorGroup(SecurityDescriptor, UsersSid, TRUE);
 628     ok(res, "SetSecurityDescriptorGroup failed with error %ld\n", GetLastError());
 629
 630     PrivSetLen = FIELD_OFFSET(PRIVILEGE_SET, Privilege[16]);
 631     PrivSet = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PrivSetLen);
 632     PrivSet->PrivilegeCount = 16;
 633
 634     ImpersonateSelf(SecurityImpersonation);
 635
 636     pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, FALSE, TRUE, &Enabled);
 637
 638     ret = OpenThreadToken(GetCurrentThread(),
 639                           TOKEN_QUERY, TRUE, &Token);
 640     ok(ret, "OpenThreadToken failed with error %ld\n", GetLastError());
 641
 642     ret = AccessCheck(SecurityDescriptor, Token, KEY_READ, &Mapping,
 643                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
 644     ok(ret, "AccessCheck failed with error %ld\n", GetLastError());
 645     ok(AccessStatus && (Access == KEY_READ),
 646         "AccessCheck failed to grant access with error %ld\n",
 647         GetLastError());
 648
 649     ret = AccessCheck(SecurityDescriptor, Token, MAXIMUM_ALLOWED, &Mapping,
 650                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
 651     ok(ret, "AccessCheck failed with error %ld\n", GetLastError());
 652     ok(AccessStatus,
 653         "AccessCheck failed to grant any access with error %ld\n",
 654         GetLastError());
 655     trace("AccessCheck with MAXIMUM_ALLOWED got Access 0x%08lx\n", Access);
 656
 657     SetLastError(0);
 658     PrivSet->PrivilegeCount = 16;
 659     ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
 660                       PrivSet, &PrivSetLen, &Access, &AccessStatus);
 661     ok(ret && !AccessStatus && GetLastError() == ERROR_PRIVILEGE_NOT_HELD,
 662         "AccessCheck should have failed with ERROR_PRIVILEGE_NOT_HELD, instead of %ld\n",
 663         GetLastError());
 664
 665     ret = pRtlAdjustPrivilege(SE_SECURITY_PRIVILEGE, TRUE, TRUE, &Enabled);
 666     if (!ret)
 667     {
 668         SetLastError(0);
 669         PrivSet->PrivilegeCount = 16;
 670         ret = AccessCheck(SecurityDescriptor, Token, ACCESS_SYSTEM_SECURITY, &Mapping,
 671                           PrivSet, &PrivSetLen, &Access, &AccessStatus);
 672         ok(ret && AccessStatus && GetLastError() == 0,
 673             "AccessCheck should have succeeded, error %ld\n",
 674             GetLastError());
 675         ok(Access == ACCESS_SYSTEM_SECURITY,
 676             "Access should be equal to ACCESS_SYSTEM_SECURITY instead of 0x%08lx\n",
 677             Access);
 678     }
 679     else
 680         trace("Couldn't get SE_SECURITY_PRIVILEGE (0x%08x), skipping ACCESS_SYSTEM_SECURITY test\n",
 681             ret);
 682
 683     RevertToSelf();
 684
 685     if (EveryoneSid)
 686         FreeSid(EveryoneSid);
 687     if (AdminSid)
 688         FreeSid(AdminSid);
 689     if (UsersSid)
 690         FreeSid(UsersSid);
 691     HeapFree(GetProcessHeap(), 0, Acl);
 692     HeapFree(GetProcessHeap(), 0, SecurityDescriptor);
 693     HeapFree(GetProcessHeap(), 0, PrivSet);
 694 }
 695
 696 START_TEST(security)
 697 {
 698     init();
 699     if (!hmod) return;
 700     test_sid();
 701     test_trustee();
 702     test_luid();
 703     test_FileSecurity();
 704     test_AccessCheck();
 705 }