1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
|
/*++
Copyright (c) 1989 Microsoft Corporation
Module Name:
sertlp.h
Abstract:
Include file for NT runtime routines that are callable by both
kernel mode code in the executive and user mode code in various
NT subsystems, but which are private interfaces.
The routines in this file should not be used outside of the security
related rtl files.
Author:
Robert P. Reichel (robertre) 6-12-91
Environment:
These routines are statically linked in the caller's executable and
are callable in either kernel mode or user mode.
Revision History:
--*/
#ifndef _SERTLP_
#define _SERTLP_
#include "nt.h"
#include "zwapi.h"
#include "ntrtl.h"
///////////////////////////////////////////////////////////////////////////////
// //
// Local Macros //
// //
///////////////////////////////////////////////////////////////////////////////
#ifndef LongAlign
#define LongAlign(Ptr) ( \
(PVOID)((((ULONG)(Ptr)) + 3) & 0xfffffffc) \
)
#endif
//
// Macros for calculating the address of the components of a security
// descriptor. This will calculate the address of the field regardless
// of whether the security descriptor is absolute or self-relative form.
// A null value indicates the specified field is not present in the
// security descriptor.
//
//
// NOTE: Similar copies of these macros appear in sep.h.
// Be sure to propagate bug fixes and changes.
//
#define RtlpOwnerAddrSecurityDescriptor( SD ) \
( ((SD)->Owner == NULL) ? (PSID)NULL : \
( ((SD)->Control & SE_SELF_RELATIVE) ? \
(PSID)RtlOffsetToPointer((SD), (SD)->Owner) : \
(PSID)((SD)->Owner) \
) \
)
#define RtlpGroupAddrSecurityDescriptor( SD ) \
( ((SD)->Group == NULL) ? (PSID)NULL : \
( ((SD)->Control & SE_SELF_RELATIVE) ? \
(PSID)RtlOffsetToPointer((SD), (SD)->Group) : \
(PSID)((SD)->Group) \
) \
)
#define RtlpSaclAddrSecurityDescriptor( SD ) \
( (!((SD)->Control & SE_SACL_PRESENT) || ((SD)->Sacl == NULL) ) ? \
(PACL)NULL : \
( ((SD)->Control & SE_SELF_RELATIVE) ? \
(PACL)RtlOffsetToPointer((SD), (SD)->Sacl) : \
(PACL)((SD)->Sacl) \
) \
)
#define RtlpDaclAddrSecurityDescriptor( SD ) \
( (!((SD)->Control & SE_DACL_PRESENT) || ((SD)->Dacl == NULL) ) ? \
(PACL)NULL : \
( ((SD)->Control & SE_SELF_RELATIVE) ? \
(PACL)RtlOffsetToPointer((SD), (SD)->Dacl) : \
(PACL)((SD)->Dacl) \
) \
)
//
// Macro to determine if the given ID has the owner attribute set,
// which means that it may be assignable as an owner
//
#define RtlpIdAssignableAsOwner( G ) \
( ((G).Attributes & SE_GROUP_OWNER) != 0 )
//
// Macro to copy the state of the passed bits from the old security
// descriptor (OldSD) into the Control field of the new one (NewSD)
//
#define RtlpPropagateControlBits( NewSD, OldSD, Bits ) \
( NewSD )->Control |= \
( \
( OldSD )->Control & ( Bits ) \
)
//
// Macro to query whether or not the passed set of bits are ALL on
// or not (ie, returns FALSE if some are on and not others)
//
#define RtlpAreControlBitsSet( SD, Bits ) \
(BOOLEAN) \
( \
(( SD )->Control & ( Bits )) == ( Bits ) \
)
//
// Macro to set the passed control bits in the given Security Descriptor
//
#define RtlpSetControlBits( SD, Bits ) \
( \
( SD )->Control |= ( Bits ) \
)
//
// Macro to clear the passed control bits in the given Security Descriptor
//
#define RtlpClearControlBits( SD, Bits ) \
( \
( SD )->Control &= ~( Bits ) \
)
////////////////////////////////////////////////////////////////////////////////
// //
// Prototypes for local procedures //
// //
////////////////////////////////////////////////////////////////////////////////
BOOLEAN
RtlpContainsCreatorOwnerSid(
PKNOWN_ACE Ace
);
BOOLEAN
RtlpContainsCreatorGroupSid(
PKNOWN_ACE Ace
);
VOID
RtlpApplyAclToObject (
IN PACL Acl,
IN PGENERIC_MAPPING GenericMapping
);
NTSTATUS
RtlpInheritAcl (
IN PACL Acl,
IN BOOLEAN IsDirectoryObject,
IN PSID OwnerSid,
IN PSID GroupSid,
IN PSID ServerOwnerSid OPTIONAL,
IN PSID ServerGroupSid OPTIONAL,
IN PGENERIC_MAPPING GenericMapping,
OUT PACL *NewAcl
);
NTSTATUS
RtlpLengthInheritAcl(
IN PACL Acl,
IN BOOLEAN IsDirectoryObject,
IN PSID OwnerSid,
IN PSID GroupSid,
IN PSID ServerSid OPTIONAL,
IN PSID ClientSid OPTIONAL,
IN PGENERIC_MAPPING GenericMapping,
OUT PULONG NewAclLength
);
NTSTATUS
RtlpGenerateInheritAcl(
IN PACL Acl,
IN BOOLEAN IsDirectoryObject,
IN PSID OwnerSid,
IN PSID GroupSid,
IN PSID ServerSid OPTIONAL,
IN PSID ClientSid OPTIONAL,
IN PGENERIC_MAPPING GenericMapping,
OUT PACL NewAcl
);
NTSTATUS
RtlpLengthInheritedAce (
IN PACE_HEADER Ace,
IN BOOLEAN IsDirectoryObject,
IN PSID OwnerSid,
IN PSID GroupSid,
IN PSID ServerSid,
IN PSID ClientSid,
IN PGENERIC_MAPPING GenericMapping,
IN PULONG NewAceLength
);
NTSTATUS
RtlpGenerateInheritedAce (
IN PACE_HEADER OldAce,
IN BOOLEAN IsDirectoryObject,
IN PSID OwnerSid,
IN PSID GroupSid,
IN PSID ServerSid OPTIONAL,
IN PSID ClientSid OPTIONAL,
IN PGENERIC_MAPPING GenericMapping,
OUT PACL NewAcl
);
NTSTATUS
RtlpInitializeAllowedAce(
IN PACCESS_ALLOWED_ACE AllowedAce,
IN USHORT AceSize,
IN UCHAR InheritFlags,
IN UCHAR AceFlags,
IN ACCESS_MASK Mask,
IN PSID AllowedSid
);
NTSTATUS
RtlpInitializeDeniedAce(
IN PACCESS_DENIED_ACE DeniedAce,
IN USHORT AceSize,
IN UCHAR InheritFlags,
IN UCHAR AceFlags,
IN ACCESS_MASK Mask,
IN PSID DeniedSid
);
NTSTATUS
RtlpInitializeAuditAce(
IN PACCESS_ALLOWED_ACE AuditAce,
IN USHORT AceSize,
IN UCHAR InheritFlags,
IN UCHAR AceFlags,
IN ACCESS_MASK Mask,
IN PSID AuditSid
);
BOOLEAN
RtlpValidOwnerSubjectContext(
IN HANDLE Token,
IN PSID Owner,
IN BOOLEAN ServerObject,
OUT PNTSTATUS ReturnStatus
);
VOID
RtlpQuerySecurityDescriptor(
IN PISECURITY_DESCRIPTOR SecurityDescriptor,
OUT PSID *Owner,
OUT PULONG OwnerSize,
OUT PSID *PrimaryGroup,
OUT PULONG PrimaryGroupSize,
OUT PACL *Dacl,
OUT PULONG DaclSize,
OUT PACL *Sacl,
OUT PULONG SaclSize
);
NTSTATUS
RtlpFreeVM(
IN PVOID *Base
);
#endif // _SERTLP_
|
