/*++
Copyright (c) 1989 Microsoft Corporation
Module Name:
Privileg.c
Abstract:
This Module implements the privilege check procedures.
Author:
Robert Reichel (robertre) 26-Nov-90
Environment:
Kernel Mode
Revision History:
--*/
#include "tokenp.h"
#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE,NtPrivilegeCheck)
#pragma alloc_text(PAGE,SeCheckPrivilegedObject)
#pragma alloc_text(PAGE,SepPrivilegeCheck)
#pragma alloc_text(PAGE,SePrivilegeCheck)
#pragma alloc_text(PAGE,SeSinglePrivilegeCheck)
#endif
BOOLEAN
SepPrivilegeCheck(
IN PTOKEN Token,
IN OUT PLUID_AND_ATTRIBUTES RequiredPrivileges,
IN ULONG RequiredPrivilegeCount,
IN ULONG PrivilegeSetControl,
IN KPROCESSOR_MODE PreviousMode
)
/*++
Routine Description:
Worker routine for SePrivilegeCheck
Arguments:
Token - The user's effective token.
RequiredPrivileges - A privilege set describing the required
privileges. The UsedForAccess bits will be set in any privilege
that is actually used (usually all of them).
RequiredPrivilegeCount - How many privileges are in the
RequiredPrivileges set.
PrivilegeSetControl - Describes how many privileges are required.
PreviousMode - The previous processor mode.
Return Value:
Returns TRUE if requested privileges are granted, FALSE otherwise.
--*/
{
PLUID_AND_ATTRIBUTES CurrentRequiredPrivilege;
PLUID_AND_ATTRIBUTES CurrentTokenPrivilege;
BOOLEAN RequiredAll;
ULONG TokenPrivilegeCount;
ULONG MatchCount = 0;
ULONG i;
ULONG j;
PAGED_CODE();
//
// Take care of kernel callers first
//
if (PreviousMode == KernelMode) {
return(TRUE);
}
SepAcquireTokenReadLock( Token );
TokenPrivilegeCount = Token->PrivilegeCount;
//
// Save whether we require ALL of them or ANY
//
RequiredAll = (BOOLEAN)(PrivilegeSetControl & PRIVILEGE_SET_ALL_NECESSARY);
for ( i = 0 , CurrentRequiredPrivilege = RequiredPrivileges ;
i < RequiredPrivilegeCount ;
i++, CurrentRequiredPrivilege++ ) {
for ( j = 0, CurrentTokenPrivilege = Token->Privileges;
j < TokenPrivilegeCount ;
j++, CurrentTokenPrivilege++ ) {
if ((CurrentTokenPrivilege->Attributes & SE_PRIVILEGE_ENABLED) &&
(RtlEqualLuid(&CurrentTokenPrivilege->Luid,
&CurrentRequiredPrivilege->Luid))
) {
CurrentRequiredPrivilege->Attributes |=
SE_PRIVILEGE_USED_FOR_ACCESS;
MatchCount++;
break; // start looking for next one
}
}
}
SepReleaseTokenReadLock( Token );
//
// If we wanted ANY and didn't get any, return failure.
//
if (!RequiredAll && (MatchCount == 0)) {
return (FALSE);
}
//
// If we wanted ALL and didn't get all, return failure.
//
if (RequiredAll && (MatchCount != RequiredPrivilegeCount)) {
return(FALSE);
}
return(TRUE);
}
BOOLEAN
SePrivilegeCheck(
IN OUT PPRIVILEGE_SET RequiredPrivileges,
IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
IN KPROCESSOR_MODE AccessMode
)
/*++
Routine Description:
This routine checks to see if the token contains the specified
privileges.
Arguments:
RequiredPrivileges - Points to a set of privileges. The subject's
security context is to be checked to see which of the specified
privileges are present. The results will be indicated in the
attributes associated with each privilege. Note that
flags in this parameter indicate whether all the privileges listed
are needed, or any of the privileges.
SubjectSecurityContext - A pointer to the subject's captured security
context.
AccessMode - Indicates the access mode to use for access check. One of
UserMode or KernelMode. If the mode is kernel, then all privileges
will be marked as being possessed by the subject, and successful
completion status is returned.
Return Value:
BOOLEAN - TRUE if all specified privileges are held by the subject,
otherwise FALSE.
--*/
{
BOOLEAN Status;
PAGED_CODE();
//
// If we're impersonating a client, we have to be at impersonation level
// of SecurityImpersonation or above.
//
if ( (SubjectSecurityContext->ClientToken != NULL) &&
(SubjectSecurityContext->ImpersonationLevel < SecurityImpersonation)
) {
return(FALSE);
}
//
// SepPrivilegeCheck locks the passed token for read access
//
Status = SepPrivilegeCheck(
EffectiveToken( SubjectSecurityContext ),
RequiredPrivileges->Privilege,
RequiredPrivileges->PrivilegeCount,
RequiredPrivileges->Control,
AccessMode
);
return(Status);
}
NTSTATUS
NtPrivilegeCheck(
IN HANDLE ClientToken,
IN OUT PPRIVILEGE_SET RequiredPrivileges,
OUT PBOOLEAN Result
)
/*++
Routine Description:
This routine tests the caller's client's security context to see if it
contains the specified privileges.
This API requires the caller have SeTcbPrivilege privilege. The test
for this privilege is always against the primary token of the calling
process, not the impersonation token of the thread.
Arguments:
ClientToken - A handle to a token object representing a client
attempting access. This handle must be obtained from a
communication session layer, such as from an LPC Port or Local
Named Pipe, to prevent possible security policy violations.
RequiredPrivileges - Points to a set of privileges. The client's
security context is to be checked to see which of the specified
privileges are present. The results will be indicated in the
attributes associated with each privilege. Note that
flags in this parameter indicate whether all the privileges listed
are needed, or any of the privileges.
Result - Receives a boolean flag indicating whether the client has all
the specified privileges or not. A value of TRUE indicates the
client has all the specified privileges. Otherwise a value of
FALSE is returned.
Return Value:
STATUS_SUCCESS - Indicates the call completed successfully.
STATUS_PRIVILEGE_NOT_HELD - Indicates the caller does not have
sufficient privilege to use this privileged system service.
--*/
{
BOOLEAN BStatus;
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status;
PLUID_AND_ATTRIBUTES CapturedPrivileges = NULL;
PTOKEN Token;
ULONG CapturedPrivilegeCount;
ULONG CapturedPrivilegesLength;
ULONG ParameterLength;
ULONG PrivilegeSetControl;
PAGED_CODE();
PreviousMode = KeGetPreviousMode();
Status = ObReferenceObjectByHandle(
ClientToken, // Handle
TOKEN_QUERY, // DesiredAccess
SepTokenObjectType, // ObjectType
PreviousMode, // AccessMode
(PVOID *)&Token, // Object
NULL // GrantedAccess
);
if ( !NT_SUCCESS(Status) ) {
return Status;
}
//
// If the passed token is an impersonation token, make sure
// it is at SecurityIdentification or above.
//
if (Token->TokenType == TokenImpersonation) {
if (Token->ImpersonationLevel < SecurityIdentification) {
ObDereferenceObject( (PVOID)Token );
return( STATUS_BAD_IMPERSONATION_LEVEL );
}
}
try {
//
// Capture passed Privilege Set
//
ProbeForWrite(
RequiredPrivileges,
sizeof(PRIVILEGE_SET),
sizeof(ULONG)
);
ParameterLength = (ULONG)sizeof(PRIVILEGE_SET) +
((RequiredPrivileges->PrivilegeCount - ANYSIZE_ARRAY) *
(ULONG)sizeof(LUID_AND_ATTRIBUTES) );
ProbeForWrite(
RequiredPrivileges,
ParameterLength,
sizeof(ULONG)
);
ProbeForWriteBoolean(Result);
PrivilegeSetControl = RequiredPrivileges->Control;
CapturedPrivilegeCount = RequiredPrivileges->PrivilegeCount;
} except(EXCEPTION_EXECUTE_HANDLER) {
ObDereferenceObject( (PVOID)Token );
return GetExceptionCode();
}
Status = SeCaptureLuidAndAttributesArray(
(RequiredPrivileges->Privilege),
CapturedPrivilegeCount,
UserMode,
NULL, 0,
PagedPool,
TRUE,
&CapturedPrivileges,
&CapturedPrivilegesLength
);
if (!NT_SUCCESS(Status)) {
ObDereferenceObject( (PVOID)Token );
return Status;
}
ASSERT(CapturedPrivileges != NULL);
BStatus = SepPrivilegeCheck(
Token, // Token,
CapturedPrivileges, // RequiredPrivileges,
CapturedPrivilegeCount, // RequiredPrivilegeCount,
PrivilegeSetControl, // PrivilegeSetControl
PreviousMode // PreviousMode
);
ObDereferenceObject( Token );
try {
//
// copy the modified privileges buffer back to user
//
RtlMoveMemory(
RequiredPrivileges->Privilege,
CapturedPrivileges,
CapturedPrivilegesLength
);
*Result = BStatus;
} except (EXCEPTION_EXECUTE_HANDLER) {
SeReleaseLuidAndAttributesArray(
CapturedPrivileges,
PreviousMode,
TRUE
);
return(GetExceptionCode());
}
SeReleaseLuidAndAttributesArray(
CapturedPrivileges,
PreviousMode,
TRUE
);
return( STATUS_SUCCESS );
}
BOOLEAN
SeSinglePrivilegeCheck(
LUID PrivilegeValue,
KPROCESSOR_MODE PreviousMode
)
/*++
Routine Description:
This function will check for the passed privilege value in the
current context.
Arguments:
PrivilegeValue - The value of the privilege being checked.
Return Value:
TRUE - The current subject has the desired privilege.
FALSE - The current subject does not have the desired privilege.
--*/
{
BOOLEAN AccessGranted;
PRIVILEGE_SET RequiredPrivileges;
SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
PAGED_CODE();
//
// Make sure the caller has the privilege to make this
// call.
//
RequiredPrivileges.PrivilegeCount = 1;
RequiredPrivileges.Control = PRIVILEGE_SET_ALL_NECESSARY;
RequiredPrivileges.Privilege[0].Luid = PrivilegeValue;
RequiredPrivileges.Privilege[0].Attributes = 0;
SeCaptureSubjectContext( &SubjectSecurityContext );
AccessGranted = SePrivilegeCheck(
&RequiredPrivileges,
&SubjectSecurityContext,
PreviousMode
);
if ( PreviousMode != KernelMode ) {
SePrivilegedServiceAuditAlarm (
NULL, // BUGWARNING need service name
&SubjectSecurityContext,
&RequiredPrivileges,
AccessGranted
);
}
SeReleaseSubjectContext( &SubjectSecurityContext );
return( AccessGranted );
}
BOOLEAN
SeCheckPrivilegedObject(
LUID PrivilegeValue,
HANDLE ObjectHandle,
ACCESS_MASK DesiredAccess,
KPROCESSOR_MODE PreviousMode
)
/*++
Routine Description:
This function will check for the passed privilege value in the
current context, and generate audits as appropriate.
Arguments:
PrivilegeValue - The value of the privilege being checked.
Object - Specifies a pointer to the object being accessed.
ObjectHandle - Specifies the object handle being used.
DesiredAccess - The desired access mask, if any
PreviousMode - The previous processor mode
Return Value:
TRUE - The current subject has the desired privilege.
FALSE - The current subject does not have the desired privilege.
--*/
{
BOOLEAN AccessGranted;
PRIVILEGE_SET RequiredPrivileges;
SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
PAGED_CODE();
//
// Make sure the caller has the privilege to make this
// call.
//
RequiredPrivileges.PrivilegeCount = 1;
RequiredPrivileges.Control = PRIVILEGE_SET_ALL_NECESSARY;
RequiredPrivileges.Privilege[0].Luid = PrivilegeValue;
RequiredPrivileges.Privilege[0].Attributes = 0;
SeCaptureSubjectContext( &SubjectSecurityContext );
AccessGranted = SePrivilegeCheck(
&RequiredPrivileges,
&SubjectSecurityContext,
PreviousMode
);
if ( PreviousMode != KernelMode ) {
SePrivilegeObjectAuditAlarm(
ObjectHandle,
&SubjectSecurityContext,
DesiredAccess,
&RequiredPrivileges,
AccessGranted,
PreviousMode
);
}
SeReleaseSubjectContext( &SubjectSecurityContext );
return( AccessGranted );
}
