diff options
Diffstat (limited to '')
| -rw-r--r-- | private/ntos/se/tokenqry.c | 1612 |
1 files changed, 1612 insertions, 0 deletions
diff --git a/private/ntos/se/tokenqry.c b/private/ntos/se/tokenqry.c new file mode 100644 index 000000000..04c5e3f11 --- /dev/null +++ b/private/ntos/se/tokenqry.c @@ -0,0 +1,1612 @@ +/*++ + +Copyright (c) 1989 Microsoft Corporation + +Module Name: + + Tokenqry.c + +Abstract: + + This module implements the QUERY function for the executive + token object. + +Author: + + Jim Kelly (JimK) 15-June-1990 + + +Revision History: + +--*/ + +#include "sep.h" +#include "seopaque.h" +#include "tokenp.h" + +#ifdef ALLOC_PRAGMA +#pragma alloc_text(PAGE,NtQueryInformationToken) +#pragma alloc_text(PAGE,SeQueryAuthenticationIdToken) +#pragma alloc_text(PAGE,SeQueryInformationToken) +#endif + + +NTSTATUS +NtQueryInformationToken ( + IN HANDLE TokenHandle, + IN TOKEN_INFORMATION_CLASS TokenInformationClass, + OUT PVOID TokenInformation, + IN ULONG TokenInformationLength, + OUT PULONG ReturnLength + ) + +/*++ + + +Routine Description: + + Retrieve information about a specified token. + +Arguments: + + TokenHandle - Provides a handle to the token to operate on. + + TokenInformationClass - The token information class about which + to retrieve information. + + TokenInformation - The buffer to receive the requested class of + information. The buffer must be aligned on at least a + longword boundary. The actual structures returned are + dependent upon the information class requested, as defined in + the TokenInformationClass parameter description. + + TokenInformation Format By Information Class: + + TokenUser => TOKEN_USER data structure. TOKEN_QUERY + access is needed to retrieve this information about a + token. + + TokenGroups => TOKEN_GROUPS data structure. TOKEN_QUERY + access is needed to retrieve this information about a + token. + + TokenPrivileges => TOKEN_PRIVILEGES data structure. + TOKEN_QUERY access is needed to retrieve this information + about a token. + + TokenOwner => TOKEN_OWNER data structure. TOKEN_QUERY + access is needed to retrieve this information about a + token. + + TokenPrimaryGroup => TOKEN_PRIMARY_GROUP data structure. + TOKEN_QUERY access is needed to retrieve this information + about a token. + + TokenDefaultDacl => TOKEN_DEFAULT_DACL data structure. + TOKEN_QUERY access is needed to retrieve this information + about a token. + + TokenSource => TOKEN_SOURCE data structure. + TOKEN_QUERY_SOURCE access is needed to retrieve this + information about a token. + + TokenType => TOKEN_TYPE data structure. + TOKEN_QUERY access is needed to retrieve this information + about a token. + + TokenStatistics => TOKEN_STATISTICS data structure. + TOKEN_QUERY access is needed to retrieve this + information about a token. + + TokenInformationLength - Indicates the length, in bytes, of the + TokenInformation buffer. + + ReturnLength - This OUT parameter receives the actual length of + the requested information. If this value is larger than that + provided by the TokenInformationLength parameter, then the + buffer provided to receive the requested information is not + large enough to hold that data and no data is returned. + + If the queried class is TokenDefaultDacl and there is no + default Dacl established for the token, then the return + length will be returned as zero, and no data will be returned. + +Return Value: + + STATUS_SUCCESS - Indicates the operation was successful. + + STATUS_BUFFER_TOO_SMALL - if the requested information did not + fit in the provided output buffer. In this case, the + ReturnLength OUT parameter contains the number of bytes + actually needed to store the requested information. + +--*/ +{ + + KPROCESSOR_MODE PreviousMode; + NTSTATUS Status; + + PTOKEN Token; + + ULONG RequiredLength; + ULONG Index; + + PTOKEN_TYPE LocalType; + PTOKEN_USER LocalUser; + PTOKEN_GROUPS LocalGroups; + PTOKEN_PRIVILEGES LocalPrivileges; + PTOKEN_OWNER LocalOwner; + PTOKEN_PRIMARY_GROUP LocalPrimaryGroup; + PTOKEN_DEFAULT_DACL LocalDefaultDacl; + PTOKEN_SOURCE LocalSource; + PSECURITY_IMPERSONATION_LEVEL LocalImpersonationLevel; + PTOKEN_STATISTICS LocalStatistics; + + PSID PSid; + PACL PAcl; + + PVOID Ignore; + + PAGED_CODE(); + + // + // Get previous processor mode and probe output argument if necessary. + // + + PreviousMode = KeGetPreviousMode(); + if (PreviousMode != KernelMode) { + try { + + ProbeForWrite( + TokenInformation, + TokenInformationLength, + sizeof(ULONG) + ); + + ProbeForWriteUlong(ReturnLength); + + } except(EXCEPTION_EXECUTE_HANDLER) { + return GetExceptionCode(); + } + } + + // + // Case on information class. + // + + switch ( TokenInformationClass ) { + + case TokenUser: + + LocalUser = (PTOKEN_USER)TokenInformation; + + Status = ObReferenceObjectByHandle( + TokenHandle, // Handle + TOKEN_QUERY, // DesiredAccess + SepTokenObjectType, // ObjectType + PreviousMode, // AccessMode + (PVOID *)&Token, // Object + NULL // GrantedAccess + ); + + if ( !NT_SUCCESS(Status) ) { + return Status; + } + + // + // Gain exclusive access to the token. + // + + SepAcquireTokenReadLock( Token ); + + + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = SeLengthSid( Token->UserAndGroups[0].Sid) + + (ULONG)sizeof( TOKEN_USER ); + + try { + + *ReturnLength = RequiredLength; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + if ( TokenInformationLength < RequiredLength ) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_BUFFER_TOO_SMALL; + + } + + // + // Return the user SID + // + + try { + + // + // Put SID immediately following TOKEN_USER data structure + // + PSid = (PSID)( (ULONG)LocalUser + (ULONG)sizeof(TOKEN_USER) ); + + RtlCopySidAndAttributesArray( + 1, + Token->UserAndGroups, + RequiredLength, + &(LocalUser->User), + PSid, + ((PSID *)&Ignore), + ((PULONG)&Ignore) + ); + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_SUCCESS; + + case TokenGroups: + + LocalGroups = (PTOKEN_GROUPS)TokenInformation; + + Status = ObReferenceObjectByHandle( + TokenHandle, // Handle + TOKEN_QUERY, // DesiredAccess + SepTokenObjectType, // ObjectType + PreviousMode, // AccessMode + (PVOID *)&Token, // Object + NULL // GrantedAccess + ); + + if ( !NT_SUCCESS(Status) ) { + return Status; + } + + // + // Gain exclusive access to the token. + // + + SepAcquireTokenReadLock( Token ); + + // + // Figure out how much space is needed to return the group SIDs. + // That's the size of TOKEN_GROUPS (without any array entries) + // plus the size of an SID_AND_ATTRIBUTES times the number of groups. + // The number of groups is Token->UserAndGroups-1 (since the count + // includes the user ID). Then the lengths of each individual group + // must be added. + // + + RequiredLength = (ULONG)sizeof(TOKEN_GROUPS) + + ((Token->UserAndGroupCount - ANYSIZE_ARRAY - 1) * + ((ULONG)sizeof(SID_AND_ATTRIBUTES)) ); + + Index = 1; + while (Index < Token->UserAndGroupCount) { + + RequiredLength += SeLengthSid( Token->UserAndGroups[Index].Sid ); + + Index += 1; + + } // endwhile + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + try { + + *ReturnLength = RequiredLength; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + if ( TokenInformationLength < RequiredLength ) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_BUFFER_TOO_SMALL; + + } + + // + // Now copy the groups. + // + + try { + + LocalGroups->GroupCount = Token->UserAndGroupCount - 1; + + PSid = (PSID)( (ULONG)LocalGroups + + (ULONG)sizeof(TOKEN_GROUPS) + + ( (Token->UserAndGroupCount - ANYSIZE_ARRAY - 1) * + (ULONG)sizeof(SID_AND_ATTRIBUTES) ) + ); + + RtlCopySidAndAttributesArray( + (ULONG)(Token->UserAndGroupCount - 1), + &(Token->UserAndGroups[1]), + RequiredLength, + LocalGroups->Groups, + PSid, + ((PSID *)&Ignore), + ((PULONG)&Ignore) + ); + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_SUCCESS; + + case TokenPrivileges: + + LocalPrivileges = (PTOKEN_PRIVILEGES)TokenInformation; + + Status = ObReferenceObjectByHandle( + TokenHandle, // Handle + TOKEN_QUERY, // DesiredAccess + SepTokenObjectType, // ObjectType + PreviousMode, // AccessMode + (PVOID *)&Token, // Object + NULL // GrantedAccess + ); + + if ( !NT_SUCCESS(Status) ) { + return Status; + } + + // + // Gain exclusive access to the token to prevent changes + // from occuring to the privileges. + // + + SepAcquireTokenReadLock( Token ); + + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG)sizeof(TOKEN_PRIVILEGES) + + ((Token->PrivilegeCount - ANYSIZE_ARRAY) * + ((ULONG)sizeof(LUID_AND_ATTRIBUTES)) ); + + + try { + + *ReturnLength = RequiredLength; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + if ( TokenInformationLength < RequiredLength ) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_BUFFER_TOO_SMALL; + + } + + // + // Return the token privileges. + // + + try { + + LocalPrivileges->PrivilegeCount = Token->PrivilegeCount; + + RtlCopyLuidAndAttributesArray( + Token->PrivilegeCount, + Token->Privileges, + LocalPrivileges->Privileges + ); + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_SUCCESS; + + case TokenOwner: + + LocalOwner = (PTOKEN_OWNER)TokenInformation; + + Status = ObReferenceObjectByHandle( + TokenHandle, // Handle + TOKEN_QUERY, // DesiredAccess + SepTokenObjectType, // ObjectType + PreviousMode, // AccessMode + (PVOID *)&Token, // Object + NULL // GrantedAccess + ); + + if ( !NT_SUCCESS(Status) ) { + return Status; + } + + // + // Gain exclusive access to the token to prevent changes + // from occuring to the owner. + // + + SepAcquireTokenReadLock( Token ); + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + PSid = Token->UserAndGroups[Token->DefaultOwnerIndex].Sid; + RequiredLength = (ULONG)sizeof(TOKEN_OWNER) + + SeLengthSid( PSid ); + + try { + + *ReturnLength = RequiredLength; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + if ( TokenInformationLength < RequiredLength ) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_BUFFER_TOO_SMALL; + + } + + // + // Return the owner SID + // + + PSid = (PSID)((ULONG)LocalOwner + + (ULONG)sizeof(TOKEN_OWNER)); + + try { + + LocalOwner->Owner = PSid; + + Status = RtlCopySid( + (RequiredLength - (ULONG)sizeof(TOKEN_OWNER)), + PSid, + Token->UserAndGroups[Token->DefaultOwnerIndex].Sid + ); + + ASSERT( NT_SUCCESS(Status) ); + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_SUCCESS; + + case TokenPrimaryGroup: + + LocalPrimaryGroup = (PTOKEN_PRIMARY_GROUP)TokenInformation; + + Status = ObReferenceObjectByHandle( + TokenHandle, // Handle + TOKEN_QUERY, // DesiredAccess + SepTokenObjectType, // ObjectType + PreviousMode, // AccessMode + (PVOID *)&Token, // Object + NULL // GrantedAccess + ); + + if ( !NT_SUCCESS(Status) ) { + return Status; + } + + // + // Gain exclusive access to the token to prevent changes + // from occuring to the owner. + // + + SepAcquireTokenReadLock( Token ); + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG)sizeof(TOKEN_PRIMARY_GROUP) + + SeLengthSid( Token->PrimaryGroup ); + + try { + + *ReturnLength = RequiredLength; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + if ( TokenInformationLength < RequiredLength ) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_BUFFER_TOO_SMALL; + + } + + // + // Return the primary group SID + // + + PSid = (PSID)((ULONG)LocalPrimaryGroup + + (ULONG)sizeof(TOKEN_PRIMARY_GROUP)); + + try { + + LocalPrimaryGroup->PrimaryGroup = PSid; + + Status = RtlCopySid( (RequiredLength - (ULONG)sizeof(TOKEN_PRIMARY_GROUP)), + PSid, + Token->PrimaryGroup + ); + + ASSERT( NT_SUCCESS(Status) ); + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_SUCCESS; + + case TokenDefaultDacl: + + LocalDefaultDacl = (PTOKEN_DEFAULT_DACL)TokenInformation; + + Status = ObReferenceObjectByHandle( + TokenHandle, // Handle + TOKEN_QUERY, // DesiredAccess + SepTokenObjectType, // ObjectType + PreviousMode, // AccessMode + (PVOID *)&Token, // Object + NULL // GrantedAccess + ); + + if ( !NT_SUCCESS(Status) ) { + return Status; + } + + // + // Gain exclusive access to the token to prevent changes + // from occuring to the owner. + // + + SepAcquireTokenReadLock( Token ); + + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG)sizeof(TOKEN_DEFAULT_DACL); + + if (ARGUMENT_PRESENT(Token->DefaultDacl)) { + + RequiredLength += Token->DefaultDacl->AclSize; + + } + + try { + + *ReturnLength = RequiredLength; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + if ( TokenInformationLength < RequiredLength ) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_BUFFER_TOO_SMALL; + + } + + // + // Return the default Dacl + // + + PAcl = (PACL)((ULONG)LocalDefaultDacl + + (ULONG)sizeof(TOKEN_DEFAULT_DACL)); + + try { + + if (ARGUMENT_PRESENT(Token->DefaultDacl)) { + + LocalDefaultDacl->DefaultDacl = PAcl; + + RtlMoveMemory( (PVOID)PAcl, + (PVOID)Token->DefaultDacl, + Token->DefaultDacl->AclSize + ); + } else { + + LocalDefaultDacl->DefaultDacl = NULL; + + } + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_SUCCESS; + + + + case TokenSource: + + LocalSource = (PTOKEN_SOURCE)TokenInformation; + + Status = ObReferenceObjectByHandle( + TokenHandle, // Handle + TOKEN_QUERY_SOURCE, // DesiredAccess + SepTokenObjectType, // ObjectType + PreviousMode, // AccessMode + (PVOID *)&Token, // Object + NULL // GrantedAccess + ); + + if ( !NT_SUCCESS(Status) ) { + return Status; + } + + // + // The type of a token can not be changed, so + // exclusive access to the token is not necessary. + // + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG) sizeof(TOKEN_SOURCE); + + try { + + *ReturnLength = RequiredLength; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + if ( TokenInformationLength < RequiredLength ) { + + ObDereferenceObject( Token ); + return STATUS_BUFFER_TOO_SMALL; + + } + + + // + // Return the token source + // + + try { + + (*LocalSource) = Token->TokenSource; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + + ObDereferenceObject( Token ); + return STATUS_SUCCESS; + + case TokenType: + + LocalType = (PTOKEN_TYPE)TokenInformation; + + Status = ObReferenceObjectByHandle( + TokenHandle, // Handle + TOKEN_QUERY, // DesiredAccess + SepTokenObjectType, // ObjectType + PreviousMode, // AccessMode + (PVOID *)&Token, // Object + NULL // GrantedAccess + ); + + if ( !NT_SUCCESS(Status) ) { + return Status; + } + + // + // The type of a token can not be changed, so + // exclusive access to the token is not necessary. + // + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG) sizeof(TOKEN_TYPE); + + try { + + *ReturnLength = RequiredLength; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + if ( TokenInformationLength < RequiredLength ) { + + ObDereferenceObject( Token ); + return STATUS_BUFFER_TOO_SMALL; + + } + + + // + // Return the token type + // + + try { + + (*LocalType) = Token->TokenType; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + + ObDereferenceObject( Token ); + return STATUS_SUCCESS; + + + case TokenImpersonationLevel: + + LocalImpersonationLevel = (PSECURITY_IMPERSONATION_LEVEL)TokenInformation; + + Status = ObReferenceObjectByHandle( + TokenHandle, // Handle + TOKEN_QUERY, // DesiredAccess + SepTokenObjectType, // ObjectType + PreviousMode, // AccessMode + (PVOID *)&Token, // Object + NULL // GrantedAccess + ); + + if ( !NT_SUCCESS(Status) ) { + return Status; + } + + // + // The impersonation level of a token can not be changed, so + // exclusive access to the token is not necessary. + // + + // + // Make sure the token is an appropriate type to be retrieving + // the impersonation level from. + // + + if (Token->TokenType != TokenImpersonation) { + + ObDereferenceObject( Token ); + return STATUS_INVALID_INFO_CLASS; + + } + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG) sizeof(SECURITY_IMPERSONATION_LEVEL); + + try { + + *ReturnLength = RequiredLength; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + if ( TokenInformationLength < RequiredLength ) { + + ObDereferenceObject( Token ); + return STATUS_BUFFER_TOO_SMALL; + + } + + + // + // Return the impersonation level + // + + try { + + (*LocalImpersonationLevel) = Token->ImpersonationLevel; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + + ObDereferenceObject( Token ); + return STATUS_SUCCESS; + + + case TokenStatistics: + + LocalStatistics = (PTOKEN_STATISTICS)TokenInformation; + + Status = ObReferenceObjectByHandle( + TokenHandle, // Handle + TOKEN_QUERY, // DesiredAccess + SepTokenObjectType, // ObjectType + PreviousMode, // AccessMode + (PVOID *)&Token, // Object + NULL // GrantedAccess + ); + + if ( !NT_SUCCESS(Status) ) { + return Status; + } + + // + // Gain exclusive access to the token. + // + + SepAcquireTokenReadLock( Token ); + + + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG)sizeof( TOKEN_STATISTICS ); + + try { + + *ReturnLength = RequiredLength; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + if ( TokenInformationLength < RequiredLength ) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_BUFFER_TOO_SMALL; + + } + + // + // Return the statistics + // + + try { + + LocalStatistics->TokenId = Token->TokenId; + LocalStatistics->AuthenticationId = Token->AuthenticationId; + LocalStatistics->ExpirationTime = Token->ExpirationTime; + LocalStatistics->TokenType = Token->TokenType; + LocalStatistics->ImpersonationLevel = Token->ImpersonationLevel; + LocalStatistics->DynamicCharged = Token->DynamicCharged; + LocalStatistics->DynamicAvailable = Token->DynamicAvailable; + LocalStatistics->GroupCount = Token->UserAndGroupCount-1; + LocalStatistics->PrivilegeCount = Token->PrivilegeCount; + LocalStatistics->ModifiedId = Token->ModifiedId; + + } except(EXCEPTION_EXECUTE_HANDLER) { + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return GetExceptionCode(); + } + + + SepReleaseTokenReadLock( Token ); + ObDereferenceObject( Token ); + return STATUS_SUCCESS; + + default: + + return STATUS_INVALID_INFO_CLASS; + } +} + + +NTSTATUS +SeQueryAuthenticationIdToken( + IN PACCESS_TOKEN Token, + OUT PLUID AuthenticationId + ) + +/*++ + + +Routine Description: + + Retrieve authentication ID out of the token. + +Arguments: + + Token - Referenced pointer to a token. + + AutenticationId - Receives the token's authentication ID. + +Return Value: + + STATUS_SUCCESS - Indicates the operation was successful. + + This is the only expected status. + +--*/ +{ + PAGED_CODE(); + + SepAcquireTokenReadLock( ((PTOKEN)Token) ); + (*AuthenticationId) = ((PTOKEN)Token)->AuthenticationId; + SepReleaseTokenReadLock( ((PTOKEN)Token) ); + return(STATUS_SUCCESS); +} + + + +NTSTATUS +SeQueryInformationToken ( + IN PACCESS_TOKEN AccessToken, + IN TOKEN_INFORMATION_CLASS TokenInformationClass, + OUT PVOID *TokenInformation + ) + +/*++ + + +Routine Description: + + Retrieve information about a specified token. + +Arguments: + + TokenHandle - Provides a handle to the token to operate on. + + TokenInformationClass - The token information class about which + to retrieve information. + + TokenInformation - Receives a pointer to the requested information. + The actual structures returned are dependent upon the information + class requested, as defined in the TokenInformationClass parameter + description. + + TokenInformation Format By Information Class: + + TokenUser => TOKEN_USER data structure. TOKEN_QUERY + access is needed to retrieve this information about a + token. + + TokenGroups => TOKEN_GROUPS data structure. TOKEN_QUERY + access is needed to retrieve this information about a + token. + + TokenPrivileges => TOKEN_PRIVILEGES data structure. + TOKEN_QUERY access is needed to retrieve this information + about a token. + + TokenOwner => TOKEN_OWNER data structure. TOKEN_QUERY + access is needed to retrieve this information about a + token. + + TokenPrimaryGroup => TOKEN_PRIMARY_GROUP data structure. + TOKEN_QUERY access is needed to retrieve this information + about a token. + + TokenDefaultDacl => TOKEN_DEFAULT_DACL data structure. + TOKEN_QUERY access is needed to retrieve this information + about a token. + + TokenSource => TOKEN_SOURCE data structure. + TOKEN_QUERY_SOURCE access is needed to retrieve this + information about a token. + + TokenType => TOKEN_TYPE data structure. + TOKEN_QUERY access is needed to retrieve this information + about a token. + + TokenStatistics => TOKEN_STATISTICS data structure. + TOKEN_QUERY access is needed to retrieve this + information about a token. + +Return Value: + + STATUS_SUCCESS - Indicates the operation was successful. + +--*/ +{ + + NTSTATUS Status; + + ULONG RequiredLength; + ULONG Index; + + PSID PSid; + PACL PAcl; + + PVOID Ignore; + PTOKEN Token = (PTOKEN)AccessToken; + + PAGED_CODE(); + + // + // Case on information class. + // + + switch ( TokenInformationClass ) { + + case TokenUser: + { + PTOKEN_USER LocalUser; + + LocalUser = (PTOKEN_USER)(*TokenInformation); + + // + // Gain exclusive access to the token. + // + + SepAcquireTokenReadLock( Token ); + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = SeLengthSid( Token->UserAndGroups[0].Sid) + + (ULONG)sizeof( TOKEN_USER ); + + LocalUser = ExAllocatePool( PagedPool, RequiredLength ); + + if (LocalUser == NULL) { + SepReleaseTokenReadLock( Token ); + return( STATUS_INSUFFICIENT_RESOURCES ); + } + + // + // Return the user SID + // + // Put SID immediately following TOKEN_USER data structure + // + + PSid = (PSID)( (ULONG)LocalUser + (ULONG)sizeof(TOKEN_USER) ); + + RtlCopySidAndAttributesArray( + 1, + Token->UserAndGroups, + RequiredLength, + &(LocalUser->User), + PSid, + ((PSID *)&Ignore), + ((PULONG)&Ignore) + ); + + SepReleaseTokenReadLock( Token ); + return STATUS_SUCCESS; + } + + + case TokenGroups: + { + PTOKEN_GROUPS LocalGroups; + + LocalGroups = (PTOKEN_GROUPS)(*TokenInformation); + + // + // Gain exclusive access to the token. + // + + SepAcquireTokenReadLock( Token ); + + // + // Figure out how much space is needed to return the group SIDs. + // That's the size of TOKEN_GROUPS (without any array entries) + // plus the size of an SID_AND_ATTRIBUTES times the number of groups. + // The number of groups is Token->UserAndGroups-1 (since the count + // includes the user ID). Then the lengths of each individual group + // must be added. + // + + RequiredLength = (ULONG)sizeof(TOKEN_GROUPS) + + ((Token->UserAndGroupCount - ANYSIZE_ARRAY - 1) * + ((ULONG)sizeof(SID_AND_ATTRIBUTES)) ); + + Index = 1; + while (Index < Token->UserAndGroupCount) { + + RequiredLength += SeLengthSid( Token->UserAndGroups[Index].Sid ); + + Index += 1; + + } // endwhile + + LocalGroups = ExAllocatePool( PagedPool, RequiredLength ); + + if (LocalGroups == NULL) { + SepReleaseTokenReadLock( Token ); + return( STATUS_INSUFFICIENT_RESOURCES ); + } + + // + // Now copy the groups. + // + + LocalGroups->GroupCount = Token->UserAndGroupCount - 1; + + PSid = (PSID)( (ULONG)LocalGroups + + (ULONG)sizeof(TOKEN_GROUPS) + + ( (Token->UserAndGroupCount - ANYSIZE_ARRAY - 1) * + (ULONG)sizeof(SID_AND_ATTRIBUTES) ) + ); + + RtlCopySidAndAttributesArray( + (ULONG)(Token->UserAndGroupCount - 1), + &(Token->UserAndGroups[1]), + RequiredLength, + LocalGroups->Groups, + PSid, + ((PSID *)&Ignore), + ((PULONG)&Ignore) + ); + + SepReleaseTokenReadLock( Token ); + return STATUS_SUCCESS; + } + + + case TokenPrivileges: + { + PTOKEN_PRIVILEGES LocalPrivileges; + + LocalPrivileges = (PTOKEN_PRIVILEGES)(*TokenInformation); + + // + // Gain exclusive access to the token to prevent changes + // from occuring to the privileges. + // + + SepAcquireTokenReadLock( Token ); + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG)sizeof(TOKEN_PRIVILEGES) + + ((Token->PrivilegeCount - ANYSIZE_ARRAY) * + ((ULONG)sizeof(LUID_AND_ATTRIBUTES)) ); + + LocalPrivileges = ExAllocatePool( PagedPool, RequiredLength ); + + if (LocalPrivileges == NULL) { + SepReleaseTokenReadLock( Token ); + return( STATUS_INSUFFICIENT_RESOURCES ); + } + + // + // Return the token privileges. + // + + LocalPrivileges->PrivilegeCount = Token->PrivilegeCount; + + RtlCopyLuidAndAttributesArray( + Token->PrivilegeCount, + Token->Privileges, + LocalPrivileges->Privileges + ); + + SepReleaseTokenReadLock( Token ); + return STATUS_SUCCESS; + } + + + case TokenOwner: + { + PTOKEN_OWNER LocalOwner; + + LocalOwner = (PTOKEN_OWNER)(*TokenInformation); + + // + // Gain exclusive access to the token to prevent changes + // from occuring to the owner. + // + + SepAcquireTokenReadLock( Token ); + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + PSid = Token->UserAndGroups[Token->DefaultOwnerIndex].Sid; + RequiredLength = (ULONG)sizeof(TOKEN_OWNER) + + SeLengthSid( PSid ); + + LocalOwner = ExAllocatePool( PagedPool, RequiredLength ); + + if (LocalOwner == NULL) { + SepReleaseTokenReadLock( Token ); + return( STATUS_INSUFFICIENT_RESOURCES ); + } + + // + // Return the owner SID + // + + PSid = (PSID)((ULONG)LocalOwner + + (ULONG)sizeof(TOKEN_OWNER)); + + LocalOwner->Owner = PSid; + + Status = RtlCopySid( + (RequiredLength - (ULONG)sizeof(TOKEN_OWNER)), + PSid, + Token->UserAndGroups[Token->DefaultOwnerIndex].Sid + ); + + ASSERT( NT_SUCCESS(Status) ); + + SepReleaseTokenReadLock( Token ); + return STATUS_SUCCESS; + } + + + case TokenPrimaryGroup: + { + PTOKEN_PRIMARY_GROUP LocalPrimaryGroup; + + LocalPrimaryGroup = (PTOKEN_PRIMARY_GROUP)(*TokenInformation); + + // + // Gain exclusive access to the token to prevent changes + // from occuring to the owner. + // + + SepAcquireTokenReadLock( Token ); + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG)sizeof(TOKEN_PRIMARY_GROUP) + + SeLengthSid( Token->PrimaryGroup ); + + LocalPrimaryGroup = ExAllocatePool( PagedPool, RequiredLength ); + + if (LocalPrimaryGroup == NULL) { + SepReleaseTokenReadLock( Token ); + return( STATUS_INSUFFICIENT_RESOURCES ); + } + + // + // Return the primary group SID + // + + PSid = (PSID)((ULONG)LocalPrimaryGroup + + (ULONG)sizeof(TOKEN_PRIMARY_GROUP)); + + LocalPrimaryGroup->PrimaryGroup = PSid; + + Status = RtlCopySid( (RequiredLength - (ULONG)sizeof(TOKEN_PRIMARY_GROUP)), + PSid, + Token->PrimaryGroup + ); + + ASSERT( NT_SUCCESS(Status) ); + + SepReleaseTokenReadLock( Token ); + return STATUS_SUCCESS; + } + + + case TokenDefaultDacl: + { + PTOKEN_DEFAULT_DACL LocalDefaultDacl; + + LocalDefaultDacl = (PTOKEN_DEFAULT_DACL)(*TokenInformation); + + // + // Gain exclusive access to the token to prevent changes + // from occuring to the owner. + // + + SepAcquireTokenReadLock( Token ); + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG)sizeof(TOKEN_DEFAULT_DACL); + + if (ARGUMENT_PRESENT(Token->DefaultDacl)) { + + RequiredLength += Token->DefaultDacl->AclSize; + } + + LocalDefaultDacl = ExAllocatePool( PagedPool, RequiredLength ); + + if (LocalDefaultDacl == NULL) { + SepReleaseTokenReadLock( Token ); + return( STATUS_INSUFFICIENT_RESOURCES ); + } + + // + // Return the default Dacl + // + + PAcl = (PACL)((ULONG)LocalDefaultDacl + + (ULONG)sizeof(TOKEN_DEFAULT_DACL)); + + if (ARGUMENT_PRESENT(Token->DefaultDacl)) { + + LocalDefaultDacl->DefaultDacl = PAcl; + + RtlMoveMemory( (PVOID)PAcl, + (PVOID)Token->DefaultDacl, + Token->DefaultDacl->AclSize + ); + } else { + + LocalDefaultDacl->DefaultDacl = NULL; + } + + SepReleaseTokenReadLock( Token ); + return STATUS_SUCCESS; + } + + + case TokenSource: + { + PTOKEN_SOURCE LocalSource; + + LocalSource = (PTOKEN_SOURCE)(*TokenInformation); + + // + // The type of a token can not be changed, so + // exclusive access to the token is not necessary. + // + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG) sizeof(TOKEN_SOURCE); + + LocalSource = ExAllocatePool( PagedPool, RequiredLength ); + + if (LocalSource == NULL) { + return( STATUS_INSUFFICIENT_RESOURCES ); + } + + // + // Return the token source + // + + (*LocalSource) = Token->TokenSource; + + return STATUS_SUCCESS; + } + + + case TokenType: + { + PTOKEN_TYPE LocalType; + + LocalType = (PTOKEN_TYPE)(*TokenInformation); + + // + // The type of a token can not be changed, so + // exclusive access to the token is not necessary. + // + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG) sizeof(TOKEN_TYPE); + + LocalType = ExAllocatePool( PagedPool, RequiredLength ); + + if (LocalType == NULL) { + return( STATUS_INSUFFICIENT_RESOURCES ); + } + + // + // Return the token type + // + + (*LocalType) = Token->TokenType; + + return STATUS_SUCCESS; + } + + + case TokenImpersonationLevel: + { + PSECURITY_IMPERSONATION_LEVEL LocalImpersonationLevel; + + LocalImpersonationLevel = (PSECURITY_IMPERSONATION_LEVEL)(*TokenInformation); + + // + // The impersonation level of a token can not be changed, so + // exclusive access to the token is not necessary. + // + + // + // Make sure the token is an appropriate type to be retrieving + // the impersonation level from. + // + + if (Token->TokenType != TokenImpersonation) { + + return STATUS_INVALID_INFO_CLASS; + } + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG) sizeof(SECURITY_IMPERSONATION_LEVEL); + + LocalImpersonationLevel = ExAllocatePool( PagedPool, RequiredLength ); + + if (LocalImpersonationLevel == NULL) { + return( STATUS_INSUFFICIENT_RESOURCES ); + } + + // + // Return the impersonation level + // + + (*LocalImpersonationLevel) = Token->ImpersonationLevel; + + return STATUS_SUCCESS; + } + + + case TokenStatistics: + { + PTOKEN_STATISTICS LocalStatistics; + + LocalStatistics = (PTOKEN_STATISTICS)(*TokenInformation); + + // + // Gain exclusive access to the token. + // + + SepAcquireTokenReadLock( Token ); + + // + // Return the length required now in case not enough buffer + // was provided by the caller and we have to return an error. + // + + RequiredLength = (ULONG)sizeof( TOKEN_STATISTICS ); + + LocalStatistics = ExAllocatePool( PagedPool, RequiredLength ); + + if (LocalStatistics == NULL) { + SepReleaseTokenReadLock( Token ); + return( STATUS_INSUFFICIENT_RESOURCES ); + } + + // + // Return the statistics + // + + LocalStatistics->TokenId = Token->TokenId; + LocalStatistics->AuthenticationId = Token->AuthenticationId; + LocalStatistics->ExpirationTime = Token->ExpirationTime; + LocalStatistics->TokenType = Token->TokenType; + LocalStatistics->ImpersonationLevel = Token->ImpersonationLevel; + LocalStatistics->DynamicCharged = Token->DynamicCharged; + LocalStatistics->DynamicAvailable = Token->DynamicAvailable; + LocalStatistics->GroupCount = Token->UserAndGroupCount-1; + LocalStatistics->PrivilegeCount = Token->PrivilegeCount; + LocalStatistics->ModifiedId = Token->ModifiedId; + + SepReleaseTokenReadLock( Token ); + return STATUS_SUCCESS; + } + + default: + + return STATUS_INVALID_INFO_CLASS; + } +} |