test: adtp.h File Reference

Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

# adtp.h File Reference

`#include "tokenp.h"`

Go to the source code of this file.

## Classes

struct | _SEP_AUDIT_BOUNDS
struct | _SEP_AUDIT_OPTIONS

## Defines

#define | FULL_PRIVILEGE_AUDITING L"FullPrivilegeAuditing"
#define | SepAdtAuditThisEvent(AuditType, AccessGranted)
#define | SepAdtAuditThisEventEx(AuditType, AccessGranted, AccessDenied)

## Typedefs

typedef _SEP_AUDIT_BOUNDS | SEP_AUDIT_BOUNDS
typedef _SEP_AUDIT_BOUNDS * | PSEP_AUDIT_BOUNDS
typedef _SEP_AUDIT_OPTIONS | SEP_AUDIT_OPTIONS

## Functions

VOID | SepAdtSetAuditEventInformation (IN OPTIONAL PBOOLEAN AuditingMode, IN OPTIONAL PPOLICY_AUDIT_EVENT_OPTIONS EventAuditingOptions)
VOID | SepAdtGetAuditEventInformation (OUT OPTIONAL PBOOLEAN AuditingMode, OUT OPTIONAL PPOLICY_AUDIT_EVENT_OPTIONS EventAuditingOptions)
VOID | SepAdtSetAuditLogInformation (IN PPOLICY_AUDIT_LOG_INFO AuditLogInformation)
NTSTATUS | SepAdtMarshallAuditRecord (IN PSE_ADT_PARAMETER_ARRAY AuditParameters, OUT PSE_ADT_PARAMETER_ARRAY *MarshalledAuditParameters, OUT PSEP_RM_LSA_MEMORY_TYPE RecordMemoryType)
BOOLEAN | SepAdtPrivilegeObjectAuditAlarm (IN PUNICODE_STRING CapturedSubsystemName OPTIONAL, IN PVOID HandleId, IN PTOKEN ClientToken OPTIONAL, IN PTOKEN PrimaryToken, IN PVOID ProcessId, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET CapturedPrivileges, IN BOOLEAN AccessGranted)
VOID | SepAdtTraverseAuditAlarm (IN PLUID OperationID, IN PVOID DirectoryObject, IN PSID UserSid, IN LUID AuthenticationId, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET Privileges OPTIONAL, IN BOOLEAN AccessGranted, IN BOOLEAN GenerateAudit, IN BOOLEAN GenerateAlarm)
VOID | SepAdtCreateInstanceAuditAlarm (IN PLUID OperationID, IN PVOID Object, IN PSID UserSid, IN LUID AuthenticationId, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET Privileges OPTIONAL, IN BOOLEAN AccessGranted, IN BOOLEAN GenerateAudit, IN BOOLEAN GenerateAlarm)
VOID | SepAdtCreateObjectAuditAlarm (IN PLUID OperationID, IN PUNICODE_STRING DirectoryName, IN PUNICODE_STRING ComponentName, IN PSID UserSid, IN LUID AuthenticationId, IN ACCESS_MASK DesiredAccess, IN BOOLEAN AccessGranted, IN BOOLEAN GenerateAudit, IN BOOLEAN GenerateAlarm)
VOID | SepAdtHandleAuditAlarm (IN PUNICODE_STRING Source, IN LUID OperationId, IN HANDLE Handle, IN PSID UserSid)
| *++
VOID | SepAdtPrivilegedServiceAuditAlarm (IN PUNICODE_STRING CapturedSubsystemName, IN PUNICODE_STRING CapturedServiceName, IN PTOKEN ClientToken OPTIONAL, IN PTOKEN PrimaryToken, IN PPRIVILEGE_SET CapturedPrivileges, IN BOOLEAN AccessGranted)
VOID | SepAdtCloseObjectAuditAlarm (IN PUNICODE_STRING CapturedSubsystemName, IN PVOID HandleId, IN PVOID Object, IN PSID UserSid, IN LUID AuthenticationId)
VOID | SepAdtDeleteObjectAuditAlarm (IN PUNICODE_STRING CapturedSubsystemName, IN PVOID HandleId, IN PVOID Object, IN PSID UserSid, IN LUID AuthenticationId)
BOOLEAN | SepAdtOpenObjectAuditAlarm (IN PUNICODE_STRING CapturedSubsystemName, IN PVOID *HandleId OPTIONAL, IN PUNICODE_STRING CapturedObjectTypeName, IN PVOID Object OPTIONAL, IN PUNICODE_STRING CapturedObjectName OPTIONAL, IN PTOKEN ClientToken OPTIONAL, IN PTOKEN PrimaryToken, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK GrantedAccess, IN PLUID OperationId, IN PPRIVILEGE_SET CapturedPrivileges OPTIONAL, IN BOOLEAN ObjectCreated, IN BOOLEAN AccessGranted, IN BOOLEAN GenerateAudit, IN BOOLEAN GenerateAlarm, IN HANDLE ProcessID, IN POLICY_AUDIT_EVENT_TYPE AuditType, IN PIOBJECT_TYPE_LIST ObjectTypeList OPTIONAL, IN ULONG ObjectTypeListLength, IN PACCESS_MASK GrantedAccessArray OPTIONAL)
BOOLEAN | SepAdtOpenObjectForDeleteAuditAlarm (IN PUNICODE_STRING CapturedSubsystemName, IN PVOID *HandleId, IN PUNICODE_STRING CapturedObjectTypeName, IN PVOID Object, IN PUNICODE_STRING CapturedObjectName, IN PTOKEN ClientToken OPTIONAL, IN PTOKEN PrimaryToken, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK GrantedAccess, IN PLUID OperationId, IN PPRIVILEGE_SET CapturedPrivileges OPTIONAL, IN BOOLEAN ObjectCreated, IN BOOLEAN AccessGranted, IN BOOLEAN GenerateAudit, IN BOOLEAN GenerateAlarm, IN HANDLE ProcessID)
VOID | SepAdtObjectReferenceAuditAlarm (IN PLUID OperationID OPTIONAL, IN PVOID Object, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET Privileges OPTIONAL, IN BOOLEAN AccessGranted, IN BOOLEAN GenerateAudit, IN BOOLEAN GenerateAlarm)
VOID | SepAdtInitializeBounds (VOID)
VOID | SepAuditFailed (VOID)
NTSTATUS | SepAdtInitializeCrashOnFail (VOID)
BOOLEAN | SepInitializePrivilegeFilter (BOOLEAN Verbose)
BOOLEAN | SepAdtInitializePrivilegeAuditing (VOID)
VOID | SepAdtInitializeAuditingOptions (VOID)

## Variables

POLICY_AUDIT_LOG_INFO | SepAdtLogInformation
BOOLEAN | SepAdtAuditingEnabled
ULONG | SepAdtMaxListLength
ULONG | SepAdtMinListLength
ULONG | SepAdtCountEventsDiscarded
ULONG | SepAdtCurrentListLength
BOOLEAN | SepAdtDiscardingAudits
BOOLEAN | SepCrashOnAuditFail
SEP_AUDIT_OPTIONS | SepAuditOptions

## Define Documentation

#define FULL_PRIVILEGE_AUDITING L"FullPrivilegeAuditing"

| Definition at line 83 of file adtp.h. Referenced by SepAdtInitializePrivilegeAuditing().

#define SepAdtAuditThisEvent | ( | AuditType,
|  | AccessGranted |  | ) |

Value:

    (SepAdtAuditingEnabled &&                                           \
        ((SeAuditingState[AuditType].AuditOnSuccess && *AccessGranted) ||   \
        (SeAuditingState[AuditType].AuditOnFailure && !(*AccessGranted))))

Definition at line 264 of file adtp.h.

Referenced by NtOpenObjectAuditAlarm(), SeAuditingFileEvents(), SeAuditingFileOrGlobalEvents(), SeCreateObjectAuditAlarm(), SeObjectReferenceAuditAlarm(), SeOpenObjectAuditAlarm(), SeOpenObjectForDeleteAuditAlarm(), SepAccessCheckAndAuditAlarm(), SepAdtCloseObjectAuditAlarm(), SepAdtDeleteObjectAuditAlarm(), SepAdtHandleAuditAlarm(), SepAdtPrivilegedServiceAuditAlarm(), SepAdtPrivilegeObjectAuditAlarm(), and SePrivilegedServiceAuditAlarm().

#define SepAdtAuditThisEventEx | ( | AuditType,
|  | AccessGranted,
|  | AccessDenied |  | ) |

Value:

    (SepAdtAuditingEnabled &&                                           \
        ((SeAuditingState[AuditType].AuditOnSuccess && AccessGranted) ||    \
         (SeAuditingState[AuditType].AuditOnFailure && AccessDenied)))

Definition at line 269 of file adtp.h.

Referenced by SepAccessCheckAndAuditAlarm().

## Typedef Documentation

typedef struct _SEP_AUDIT_BOUNDS * PSEP_AUDIT_BOUNDS

| Referenced by SepAdtInitializeBounds().

typedef struct _SEP_AUDIT_BOUNDS SEP_AUDIT_BOUNDS

| Referenced by SepAdtInitializeBounds().

typedef struct _SEP_AUDIT_OPTIONS SEP_AUDIT_OPTIONS

## Function Documentation

VOID SepAdtCloseObjectAuditAlarm | ( | IN PUNICODE_STRING | CapturedSubsystemName,
|  | IN PVOID | HandleId,
|  | IN PVOID | Object,
|  | IN PSID | UserSid,
|  | IN LUID | AuthenticationId
| ) |

Definition at line 1312 of file sepaudit.c.

References ASSERT, _SEP_AUDIT_OPTIONS::DoNotAuditCloseObjectEvents, PAGED_CODE, PsGetCurrentProcess, PsProcessAuditId, SepAdtAuditThisEvent, SepAdtLogAuditRecord(), SepAuditOptions, SepSetParmTypeSid, SepSetParmTypeString, SepSetParmTypeUlong, and TRUE.

Referenced by NtCloseObjectAuditAlarm(), and SeCloseObjectAuditAlarm().

    01322                    :
    01323
    01324     This routine implements NtCloseObjectAuditAlarm after parameters have
    01325     been captured.
    01326
    01327     This routine is used to generate audit and alarm messages when a handle
    01328     to a protected subsystem object is deleted.  This routine may result in
    01329     several messages being generated and sent to Port objects.  This may
    01330     result in a significant latency before returning.  Design of routines
    01331     that must call this routine must take this potential latency into
    01332     account.  This may have an impact on the approach taken for data
    01333     structure mutex locking, for example.
    01334
    01335     This API requires the caller have SeTcbPrivilege privilege.  The test
    01336     for this privilege is always against the primary token of the calling
    01337     process, allowing the caller to be impersonating a client during the
    01338     call with no ill effects.  It is assumed that this privilege has been
    01339     tested at a higher level.
    01340
    01341     This routine will create an SE_ADT_PARAMETERS array organized as follows:
    01342
    01343     Parameter[0] - User Sid
    01344
    01345     Parameter[1] - Subsystem name (if available)
    01346
    01347     Parameter[2] - New handle ID
    01348
    01349     Parameter[3] - Subject's process id
    01350
    01351 Arguments:
    01352
    01353     CapturedSubsystemName - Supplies a name string identifying the
    01354         subsystem calling the routine.
    01355
    01356     HandleId - A unique value representing the client's handle to the
    01357         object.
    01358
    01359     Object - The address of the object being closed
    01360
    01361     UserSid - The Sid identifying the current caller.
    01362
    01363
    01364
    01365 Return value:
    01366
    01367     None.
    01368
    01369
    01370 --*/
    01371
    01372 {
    01373
    01374     SE_ADT_PARAMETER_ARRAY AuditParameters;
    01375     BOOLEAN AccessGranted = TRUE;
    01376     HANDLE ProcessId;
    01377
    01378     PAGED_CODE();
    01379
    01380     if ( SepAuditOptions.DoNotAuditCloseObjectEvents ) {
    01381
    01382         return;
    01383     }
    01384
    01385     if ( SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted ) ) {
    01386
    01387         //
    01388         // A completely zero'd entry will be interpreted
    01389         // as a "null string" or not supplied parameter.
    01390         //
    01391         // Initializing the entire array up front will allow
    01392         // us to avoid filling in each not supplied entry.
    01393         //
    01394
    01395         RtlZeroMemory (
    01396            (PVOID) &AuditParameters,
    01397            sizeof( AuditParameters )
    01398            );
    01399
    01400         ASSERT( SeAdtParmTypeNone == 0 );
    01401
    01402         AuditParameters.CategoryId = SE_CATEGID_OBJECT_ACCESS;
    01403         AuditParameters.AuditId = SE_AUDITID_CLOSE_HANDLE;
    01404         AuditParameters.ParameterCount = 0;
    01405         AuditParameters.Type = EVENTLOG_AUDIT_SUCCESS;
    01406
    01407
    01408         //
    01409         //  Parameter[0] - User Sid
    01410         //
    01411
    01412         SepSetParmTypeSid( AuditParameters, AuditParameters.ParameterCount, UserSid );
    01413
    01414         AuditParameters.ParameterCount++;
    01415
    01416
    01417         //
    01418         //  Parameter[1] - Subsystem name (if available)
    01419         //
    01420
    01421         if ( ARGUMENT_PRESENT( CapturedSubsystemName )) {
    01422
    01423             SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, CapturedSubsystemName );
    01424         }
    01425
    01426         AuditParameters.ParameterCount++;
    01427
    01428         //
    01429         //  Parameter[2] - Subsystem name (if available)
    01430         //
    01431
    01432         if ( ARGUMENT_PRESENT( CapturedSubsystemName )) {
    01433
    01434             SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, CapturedSubsystemName );
    01435         }
    01436
    01437         AuditParameters.ParameterCount++;
    01438
    01439         //
    01440         //    Parameter[3] - New handle ID
    01441         //
    01442
    01443         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)HandleId) );
    01444
    01445         AuditParameters.ParameterCount++;
    01446
    01447         //
    01448         //    Parameter[4] - Subject's process id
    01449         //
    01450
    01451         ProcessId =  PsProcessAuditId( PsGetCurrentProcess() );
    01452
    01453         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)ProcessId) );
    01454
    01455         AuditParameters.ParameterCount++;
    01456
    01457         SepAdtLogAuditRecord( &AuditParameters );
    01458
    01459     }
    01460 }

VOID SepAdtCreateInstanceAuditAlarm | ( | IN PLUID | OperationID,
|  | IN PVOID | Object,
|  | IN PSID | UserSid,
|  | IN LUID | AuthenticationId,
|  | IN ACCESS_MASK | DesiredAccess,
|  | IN PPRIVILEGE_SET Privileges | OPTIONAL,
|  | IN BOOLEAN | AccessGranted,
|  | IN BOOLEAN | GenerateAudit,
|  | IN BOOLEAN | GenerateAlarm
| ) |

VOID SepAdtCreateObjectAuditAlarm | ( | IN PLUID | OperationID,
|  | IN PUNICODE_STRING | DirectoryName,
|  | IN PUNICODE_STRING | ComponentName,
|  | IN PSID | UserSid,
|  | IN LUID | AuthenticationId,
|  | IN ACCESS_MASK | DesiredAccess,
|  | IN BOOLEAN | AccessGranted,
|  | IN BOOLEAN | GenerateAudit,
|  | IN BOOLEAN | GenerateAlarm
| ) |

| Referenced by SeCreateObjectAuditAlarm().

VOID SepAdtDeleteObjectAuditAlarm | ( | IN PUNICODE_STRING | CapturedSubsystemName,
|  | IN PVOID | HandleId,
|  | IN PVOID | Object,
|  | IN PSID | UserSid,
|  | IN LUID | AuthenticationId
| ) |

Definition at line 1465 of file sepaudit.c.

References ASSERT, PAGED_CODE, PsGetCurrentProcess, PsProcessAuditId, SepAdtAuditThisEvent, SepAdtLogAuditRecord(), SepSetParmTypeSid, SepSetParmTypeString, SepSetParmTypeUlong, and TRUE.

Referenced by NtDeleteObjectAuditAlarm(), and SeDeleteObjectAuditAlarm().

    01475                    :
    01476
    01477     This routine implements NtDeleteObjectAuditAlarm after parameters have
    01478     been captured.
    01479
    01480     This routine is used to generate audit and alarm messages when an object
    01481     in a protected subsystem object is deleted.  This routine may result in
    01482     several messages being generated and sent to Port objects.  This may
    01483     result in a significant latency before returning.  Design of routines
    01484     that must call this routine must take this potential latency into
    01485     account.  This may have an impact on the approach taken for data
    01486     structure mutex locking, for example.
    01487
    01488     This API requires the caller have SeTcbPrivilege privilege.  The test
    01489     for this privilege is always against the primary token of the calling
    01490     process, allowing the caller to be impersonating a client during the
    01491     call with no ill effects.  It is assumed that this privilege has been
    01492     tested at a higher level.
    01493
    01494     This routine will create an SE_ADT_PARAMETERS array organized as follows:
    01495
    01496     Parameter[0] - User Sid
    01497
    01498     Parameter[1] - Subsystem name (if available)
    01499
    01500     Parameter[2] - Handle ID
    01501
    01502     Parameter[3] - Subject's process id
    01503
    01504 Arguments:
    01505
    01506     CapturedSubsystemName - Supplies a name string identifying the
    01507         subsystem calling the routine.
    01508
    01509     HandleId - A unique value representing the client's handle to the
    01510         object.
    01511
    01512     Object - The address of the object being closed
    01513
    01514     UserSid - The Sid identifying the current caller.
    01515
    01516
    01517
    01518 Return value:
    01519
    01520     None.
    01521
    01522
    01523 --*/
    01524
    01525 {
    01526
    01527     SE_ADT_PARAMETER_ARRAY AuditParameters;
    01528     BOOLEAN AccessGranted = TRUE;
    01529     HANDLE ProcessId;
    01530
    01531     PAGED_CODE();
    01532
    01533     if ( SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted ) ) {
    01534
    01535         //
    01536         // A completely zero'd entry will be interpreted
    01537         // as a "null string" or not supplied parameter.
    01538         //
    01539         // Initializing the entire array up front will allow
    01540         // us to avoid filling in each not supplied entry.
    01541         //
    01542
    01543         RtlZeroMemory (
    01544            (PVOID) &AuditParameters,
    01545            sizeof( AuditParameters )
    01546            );
    01547
    01548         ASSERT( SeAdtParmTypeNone == 0 );
    01549
    01550         AuditParameters.CategoryId = SE_CATEGID_OBJECT_ACCESS;
    01551         AuditParameters.AuditId = SE_AUDITID_DELETE_OBJECT;
    01552         AuditParameters.ParameterCount = 0;
    01553         AuditParameters.Type = EVENTLOG_AUDIT_SUCCESS;
    01554
    01555
    01556         //
    01557         //  Parameter[0] - User Sid
    01558         //
    01559
    01560         SepSetParmTypeSid( AuditParameters, AuditParameters.ParameterCount, UserSid );
    01561
    01562         AuditParameters.ParameterCount++;
    01563
    01564
    01565         //
    01566         //  Parameter[1] - Subsystem name (if available)
    01567         //
    01568
    01569         if ( ARGUMENT_PRESENT( CapturedSubsystemName )) {
    01570
    01571             SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, CapturedSubsystemName );
    01572         }
    01573
    01574         AuditParameters.ParameterCount++;
    01575
    01576         //
    01577         //  Parameter[2] - Subsystem name (if available)
    01578         //
    01579
    01580         if ( ARGUMENT_PRESENT( CapturedSubsystemName )) {
    01581
    01582             SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, CapturedSubsystemName );
    01583         }
    01584
    01585         AuditParameters.ParameterCount++;
    01586
    01587         //
    01588         //    Parameter[3] - New handle ID
    01589         //
    01590
    01591         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)HandleId) );
    01592
    01593         AuditParameters.ParameterCount++;
    01594
    01595         //
    01596         //    Parameter[4] - Subject's process id
    01597         //
    01598
    01599         ProcessId =  PsProcessAuditId( PsGetCurrentProcess() );
    01600
    01601         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)ProcessId) );
    01602
    01603         AuditParameters.ParameterCount++;
    01604
    01605         SepAdtLogAuditRecord( &AuditParameters );
    01606
    01607     }
    01608 }

VOID SepAdtGetAuditEventInformation | ( | OUT OPTIONAL PBOOLEAN | AuditingMode,
|  | OUT OPTIONAL PPOLICY_AUDIT_EVENT_OPTIONS | EventAuditingOptions
| ) |

VOID SepAdtHandleAuditAlarm | ( | IN PUNICODE_STRING | Source,
|  | IN LUID | OperationId,
|  | IN HANDLE | Handle,
|  | IN PSID | UserSid
| ) |

*++

Definition at line 1794 of file sepaudit.c.

References ASSERT, Handle, PAGED_CODE, PsGetCurrentProcess, PsProcessAuditId, SepAdtAuditThisEvent, SepAdtLogAuditRecord(), SepSetParmTypeSid, SepSetParmTypeString, SepSetParmTypeUlong, and TRUE.

    01803                    :
    01804
    01805     Creates an audit record for the creation of an object handle.
    01806
    01807 Arguments:
    01808
    01809
    01810 Return Value:
    01811
    01812     None.
    01813
    01814 --*/
    01815
    01816 {
    01817     BOOLEAN AccessGranted = TRUE;
    01818     SE_ADT_PARAMETER_ARRAY AuditParameters;
    01819     HANDLE ProcessID;
    01820
    01821     PAGED_CODE();
    01822
    01823     if ( SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted )) {
    01824
    01825         //
    01826         // A completely zero'd entry will be interpreted
    01827         // as a "null string" or not supplied parameter.
    01828         //
    01829         // Initializing the entire array up front will allow
    01830         // us to avoid filling in each not supplied entry.
    01831         //
    01832
    01833         RtlZeroMemory (
    01834            (PVOID) &AuditParameters,
    01835            sizeof( AuditParameters )
    01836            );
    01837
    01838         ASSERT( SeAdtParmTypeNone == 0 );
    01839
    01840         AuditParameters.CategoryId = SE_CATEGID_OBJECT_ACCESS;
    01841         AuditParameters.AuditId = SE_AUDITID_CREATE_HANDLE;
    01842         AuditParameters.ParameterCount = 0;
    01843         AuditParameters.Type = EVENTLOG_AUDIT_SUCCESS;
    01844
    01845
    01846         //
    01847         //  Parameter[0] - User Sid
    01848         //
    01849
    01850         SepSetParmTypeSid( AuditParameters, AuditParameters.ParameterCount, UserSid );
    01851
    01852         AuditParameters.ParameterCount++;
    01853
    01854
    01855         //
    01856         //  Parameter[1] - Subsystem name (if available)
    01857         //
    01858
    01859         if ( ARGUMENT_PRESENT( Source )) {
    01860
    01861             SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, Source );
    01862         }
    01863
    01864         AuditParameters.ParameterCount++;
    01865
    01866         //
    01867         //    Parameter[2] - New handle ID
    01868         //
    01869
    01870         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)Handle) );
    01871
    01872         AuditParameters.ParameterCount++;
    01873
    01874         //
    01875         //    Parameters 3,4 - Operation ID
    01876         //
    01877
    01878
    01879         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, OperationId.HighPart );
    01880
    01881         AuditParameters.ParameterCount++;
    01882
    01883         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, OperationId.LowPart );
    01884
    01885         AuditParameters.ParameterCount++;
    01886
    01887
    01888         //
    01889         //    Parameter[5] - Subject's process id
    01890         //
    01891
    01892         ProcessID =  PsProcessAuditId( PsGetCurrentProcess() );
    01893
    01894         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)ProcessID) );
    01895
    01896         AuditParameters.ParameterCount++;
    01897
    01898         SepAdtLogAuditRecord( &AuditParameters );
    01899
    01900     }
    01901 }

VOID SepAdtInitializeAuditingOptions | ( | VOID |  | ) |

Definition at line 425 of file adtinit.c.

References ASSERT, CHAR, _SEP_AUDIT_OPTIONS::DoNotAuditCloseObjectEvents, KeyName, L, NT_SUCCESS, NtClose(), NtOpenKey(), NtQueryValueKey(), NTSTATUS(), NULL, PAGED_CODE, RtlInitUnicodeString(), SepAuditOptions, Status, TRUE, and ValueName.

Referenced by SeRmInitPhase1().

    00431                    :
    00432
    00433     Initialize options that control auditing.
    00434     (please refer to note in adtp.h near the def. of SEP_AUDIT_OPTIONS)
    00435
    00436 Arguments:
    00437
    00438     None
    00439
    00440 Return Value:
    00441
    00442     None
    00443
    00444 --*/
    00445
    00446 {
    00447     HANDLE KeyHandle;
    00448     NTSTATUS Status;
    00449     NTSTATUS TmpStatus;
    00450     OBJECT_ATTRIBUTES Obja;
    00451     ULONG ResultLength;
    00452     UNICODE_STRING KeyName;
    00453     UNICODE_STRING ValueName;
    00454     CHAR KeyInfo[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(BOOLEAN)];
    00455
    00456     PAGED_CODE();
    00457
    00458     //
    00459     // Query the registry
    00460     //
    00461     RtlInitUnicodeString( &KeyName, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\AuditingOptions");
    00462
    00463     InitializeObjectAttributes( &Obja,
    00464                                 &KeyName,
    00465                                 OBJ_CASE_INSENSITIVE,
    00466                                 NULL,
    00467                                 NULL
    00468                                 );
    00469
    00470     Status = NtOpenKey(
    00471                  &KeyHandle,
    00472                  KEY_QUERY_VALUE,
    00473                  &Obja
    00474                  );
    00475
    00476
    00477     if (!NT_SUCCESS( Status )) {
    00478
    00479         goto Cleanup;
    00480     }
    00481
    00482     RtlInitUnicodeString( &ValueName, L"DoNotAuditCloseObjectEvents" );
    00483
    00484     Status = NtQueryValueKey(
    00485                  KeyHandle,
    00486                  &ValueName,
    00487                  KeyValuePartialInformation,
    00488                  KeyInfo,
    00489                  sizeof(KeyInfo),
    00490                  &ResultLength
    00491                  );
    00492
    00493     TmpStatus = NtClose(KeyHandle);
    00494     ASSERT(NT_SUCCESS(TmpStatus));
    00495
    00496     if (NT_SUCCESS( Status )) {
    00497         //
    00498         // we check for the presence of this value, its value does not matter
    00499         //
    00500         SepAuditOptions.DoNotAuditCloseObjectEvents = TRUE;
    00501     }
    00502
    00503 Cleanup:
    00504
    00505     return;
    00506 }

VOID SepAdtInitializeBounds | ( | VOID |  | ) |

Definition at line 117 of file adtinit.c.

References ExAllocatePool, ExFreePool(), KeyName, L, _SEP_AUDIT_BOUNDS::LowerBound, NT_SUCCESS, NtClose(), NtOpenKey(), NtQueryValueKey(), NTSTATUS(), NULL, ObjectAttributes, PAGED_CODE, PagedPool, PSEP_AUDIT_BOUNDS, RtlInitUnicodeString(), SEP_AUDIT_BOUNDS, SepAdtMaxListLength, SepAdtMinListLength, SepAdtValidateAuditBounds(), Status, _SEP_AUDIT_BOUNDS::UpperBound, and ValueName.

Referenced by SepRmSetAuditEventWrkr().

    00123                    :
    00124
    00125     Queries the registry for the high and low water mark values for the
    00126     audit log.  If they are not found or are unacceptable, returns without
    00127     modifying the current values, which are statically initialized.
    00128
    00129 Arguments:
    00130
    00131     None.
    00132
    00133 Return Value:
    00134
    00135     None.
    00136
    00137 --*/
    00138
    00139 {
    00140
    00141     HANDLE KeyHandle;
    00142     OBJECT_ATTRIBUTES ObjectAttributes;
    00143     UNICODE_STRING KeyName;
    00144     UNICODE_STRING ValueName;
    00145     NTSTATUS Status;
    00146     PSEP_AUDIT_BOUNDS AuditBounds;
    00147     PKEY_VALUE_PARTIAL_INFORMATION KeyValueInformation;
    00148     ULONG Length;
    00149
    00150     PAGED_CODE();
    00151
    00152     //
    00153     // Get the high and low water marks out of the registry.
    00154     //
    00155
    00156     RtlInitUnicodeString( &KeyName, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa");
    00157
    00158     InitializeObjectAttributes(
    00159         &ObjectAttributes,
    00160         &KeyName,
    00161         OBJ_CASE_INSENSITIVE,
    00162         NULL,
    00163         NULL
    00164         );
    00165
    00166     Status = NtOpenKey(
    00167                  &KeyHandle,
    00168                  KEY_QUERY_VALUE,
    00169                  &ObjectAttributes
    00170                  );
    00171
    00172     if (!NT_SUCCESS( Status )) {
    00173
    00174         //
    00175         // Didn't work, take the defaults
    00176         //
    00177
    00178         return;
    00179     }
    00180
    00181     RtlInitUnicodeString( &ValueName, L"Bounds");
    00182
    00183     Length = sizeof( KEY_VALUE_PARTIAL_INFORMATION ) - sizeof( UCHAR ) + sizeof( SEP_AUDIT_BOUNDS );
    00184
    00185     KeyValueInformation = ExAllocatePool( PagedPool, Length );
    00186
    00187     if ( KeyValueInformation == NULL ) {
    00188
    00189         NtClose( KeyHandle );
    00190         return;
    00191     }
    00192
    00193     Status = NtQueryValueKey(
    00194                  KeyHandle,
    00195                  &ValueName,
    00196                  KeyValuePartialInformation,
    00197                  (PVOID)KeyValueInformation,
    00198                  Length,
    00199                  &Length
    00200                  );
    00201
    00202     NtClose( KeyHandle );
    00203
    00204     if (!NT_SUCCESS( Status )) {
    00205
    00206         ExFreePool( KeyValueInformation );
    00207         return;
    00208     }
    00209
    00210
    00211     AuditBounds = (PSEP_AUDIT_BOUNDS) &KeyValueInformation->Data;
    00212
    00213     //
    00214     // Sanity check what we got back
    00215     //
    00216
    00217     if(!SepAdtValidateAuditBounds( AuditBounds->UpperBound, AuditBounds->LowerBound )) {
    00218
    00219         //
    00220         // The values we got back are not to our liking.  Use the defaults.
    00221         //
    00222
    00223         ExFreePool( KeyValueInformation );
    00224         return;
    00225     }
    00226
    00227     //
    00228     // Take what we got from the registry.
    00229     //
    00230
    00231     SepAdtMaxListLength = AuditBounds->UpperBound;
    00232     SepAdtMinListLength = AuditBounds->LowerBound;
    00233
    00234     ExFreePool( KeyValueInformation );
    00235
    00236     return;
    00237 }

NTSTATUS SepAdtInitializeCrashOnFail | ( | VOID |  | ) |

Definition at line 242 of file adtinit.c.

    00248                    :
    00249
    00250     Reads the registry to see if the user has told us to crash if an audit fails.
    00251
    00252 Arguments:
    00253
    00254     None.
    00255
    00256 Return Value:
    00257
    00258     STATUS_SUCCESS
    00259
    00260 --*/
    00261
    00262 {
    00263     HANDLE KeyHandle;
    00264     NTSTATUS Status;
    00265     NTSTATUS TmpStatus;
    00266     OBJECT_ATTRIBUTES Obja;
    00267     ULONG ResultLength;
    00268     UNICODE_STRING KeyName;
    00269     UNICODE_STRING ValueName;
    00270     CHAR KeyInfo[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(BOOLEAN)];
    00271     PKEY_VALUE_PARTIAL_INFORMATION pKeyInfo;
    00272
    00273     SepCrashOnAuditFail = FALSE;
    00274
    00275     //
    00276     // Check the value of the CrashOnAudit flag in the registry.
    00277     //
    00278
    00279     RtlInitUnicodeString( &KeyName, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa");
    00280
    00281     InitializeObjectAttributes( &Obja,
    00282                                 &KeyName,
    00283                                 OBJ_CASE_INSENSITIVE,
    00284                                 NULL,
    00285                                 NULL
    00286                                 );
    00287
    00288     Status = NtOpenKey(
    00289                  &KeyHandle,
    00290                  KEY_QUERY_VALUE | KEY_SET_VALUE,
    00291                  &Obja
    00292                  );
    00293
    00294     if (Status == STATUS_OBJECT_NAME_NOT_FOUND) {
    00295         return( STATUS_SUCCESS );
    00296     }
    00297
    00298     RtlInitUnicodeString( &ValueName, CRASH_ON_AUDIT_FAIL_VALUE );
    00299
    00300     Status = NtQueryValueKey(
    00301                  KeyHandle,
    00302                  &ValueName,
    00303                  KeyValuePartialInformation,
    00304                  KeyInfo,
    00305                  sizeof(KeyInfo),
    00306                  &ResultLength
    00307                  );
    00308
    00309     TmpStatus = NtClose(KeyHandle);
    00310     ASSERT(NT_SUCCESS(TmpStatus));
    00311
    00312     //
    00313     // If the key isn't there, don't turn on CrashOnFail.
    00314     //
    00315
    00316     if (NT_SUCCESS( Status )) {
    00317
    00318         pKeyInfo = (PKEY_VALUE_PARTIAL_INFORMATION)KeyInfo;
    00319         if ((UCHAR) *(pKeyInfo->Data) == LSAP_CRASH_ON_AUDIT_FAIL) {
    00320             SepCrashOnAuditFail = TRUE;
    00321         }
    00322     }
    00323
    00324     return( STATUS_SUCCESS );
    00325 }

BOOLEAN SepAdtInitializePrivilegeAuditing | ( | VOID |  | ) |

Definition at line 329 of file adtinit.c.

    00335                    :
    00336
    00337     Checks to see if there is an entry in the registry telling us to do full privilege auditing
    00338     (which currently means audit everything we normall audit, plus backup and restore privileges).
    00339
    00340 Arguments:
    00341
    00342     None
    00343
    00344 Return Value:
    00345
    00346     BOOLEAN - TRUE if Auditing has been initialized correctly, else FALSE.
    00347
    00348 --*/
    00349
    00350 {
    00351     HANDLE KeyHandle;
    00352     NTSTATUS Status;
    00353     NTSTATUS TmpStatus;
    00354     OBJECT_ATTRIBUTES Obja;
    00355     ULONG ResultLength;
    00356     UNICODE_STRING KeyName;
    00357     UNICODE_STRING ValueName;
    00358     CHAR KeyInfo[sizeof(KEY_VALUE_PARTIAL_INFORMATION) + sizeof(BOOLEAN)];
    00359     PKEY_VALUE_PARTIAL_INFORMATION pKeyInfo;
    00360     BOOLEAN Verbose;
    00361
    00362     PAGED_CODE();
    00363
    00364     //
    00365     // Query the registry to set up the privilege auditing filter.
    00366     //
    00367
    00368     RtlInitUnicodeString( &KeyName, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa");
    00369
    00370     InitializeObjectAttributes( &Obja,
    00371                                 &KeyName,
    00372                                 OBJ_CASE_INSENSITIVE,
    00373                                 NULL,
    00374                                 NULL
    00375                                 );
    00376
    00377     Status = NtOpenKey(
    00378                  &KeyHandle,
    00379                  KEY_QUERY_VALUE | KEY_SET_VALUE,
    00380                  &Obja
    00381                  );
    00382
    00383
    00384     if (!NT_SUCCESS( Status )) {
    00385
    00386         if (Status == STATUS_OBJECT_NAME_NOT_FOUND) {
    00387
    00388             return ( SepInitializePrivilegeFilter( FALSE ));
    00389
    00390         } else {
    00391
    00392             return( FALSE );
    00393         }
    00394     }
    00395
    00396     RtlInitUnicodeString( &ValueName, FULL_PRIVILEGE_AUDITING );
    00397
    00398     Status = NtQueryValueKey(
    00399                  KeyHandle,
    00400                  &ValueName,
    00401                  KeyValuePartialInformation,
    00402                  KeyInfo,
    00403                  sizeof(KeyInfo),
    00404                  &ResultLength
    00405                  );
    00406
    00407     TmpStatus = NtClose(KeyHandle);
    00408     ASSERT(NT_SUCCESS(TmpStatus));
    00409
    00410     if (!NT_SUCCESS( Status )) {
    00411
    00412         Verbose = FALSE;
    00413
    00414     } else {
    00415
    00416         pKeyInfo = (PKEY_VALUE_PARTIAL_INFORMATION)KeyInfo;
    00417         Verbose = (BOOLEAN) *(pKeyInfo->Data);
    00418     }
    00419
    00420     return ( SepInitializePrivilegeFilter( Verbose ));
    00421 }

NTSTATUS SepAdtMarshallAuditRecord | ( | IN PSE_ADT_PARAMETER_ARRAY | AuditParameters,
|  | OUT PSE_ADT_PARAMETER_ARRAY * | MarshalledAuditParameters,
|  | OUT PSEP_RM_LSA_MEMORY_TYPE | RecordMemoryType
| ) |

Definition at line 264 of file adtlog.c.

References ASSERT, ExAllocatePoolWithTag, FALSE, NULL, PAGED_CODE, PagedPool, and SourceString.

Referenced by SepAdtLogAuditRecord().

    00272                    :
    00273
    00274     This routine will take an AuditParamters structure and create
    00275     a new AuditParameters structure that is suitable for sending
    00276     to LSA.  It will be in self-relative form and allocated as
    00277     a single chunk of memory.
    00278
    00279 Arguments:
    00280
    00281
    00282     AuditParameters - A filled in set of AuditParameters to be marshalled.
    00283
    00284     MarshalledAuditParameters - Returns a pointer to a block of heap memory
    00285         containing the passed AuditParameters in self-relative form suitable
    00286         for passing to LSA.
    00287
    00288
    00289 Return Value:
    00290
    00291     None.
    00292
    00293 --*/
    00294
    00295 {
    00296     ULONG i;
    00297     ULONG TotalSize = sizeof( SE_ADT_PARAMETER_ARRAY );
    00298     PUNICODE_STRING TargetString;
    00299     PCHAR Base;
    00300     ULONG BaseIncr;
    00301
    00302     PAGED_CODE();
    00303
    00304     //
    00305     // Calculate the total size required for the passed AuditParameters
    00306     // block.  This calculation will probably be an overestimate of the
    00307     // amount of space needed, because data smaller that 2 dwords will
    00308     // be stored directly in the parameters structure, but their length
    00309     // will be counted here anyway.  The overestimate can't be more than
    00310     // 24 dwords, and will never even approach that amount, so it isn't
    00311     // worth the time it would take to avoid it.
    00312     //
    00313
    00314     for (i=0; i<AuditParameters->ParameterCount; i++) {
    00315         TotalSize += (ULONG)LongAlignSize(AuditParameters->Parameters[i].Length);
    00316     }
    00317
    00318     //
    00319     // Allocate a big enough block of memory to hold everything.
    00320     // If it fails, quietly abort, since there isn't much else we
    00321     // can do.
    00322     //
    00323
    00324     *MarshalledAuditParameters = ExAllocatePoolWithTag( PagedPool, TotalSize, 'pAeS' );
    00325
    00326     if (*MarshalledAuditParameters == NULL) {
    00327
    00328         *RecordMemoryType = SepRmNoMemory;
    00329         return(STATUS_INSUFFICIENT_RESOURCES);
    00330     }
    00331
    00332     *RecordMemoryType = SepRmPagedPoolMemory;
    00333
    00334     RtlCopyMemory (
    00335        *MarshalledAuditParameters,
    00336        AuditParameters,
    00337        sizeof( SE_ADT_PARAMETER_ARRAY )
    00338        );
    00339
    00340    (*MarshalledAuditParameters)->Length = TotalSize;
    00341    (*MarshalledAuditParameters)->Flags  = SE_ADT_PARAMETERS_SELF_RELATIVE;
    00342
    00343     //
    00344     // Start walking down the list of parameters and marshall them
    00345     // into the target buffer.
    00346     //
    00347
    00348     Base = (PCHAR) ((PCHAR)(*MarshalledAuditParameters) + sizeof( SE_ADT_PARAMETER_ARRAY ));
    00349
    00350     for (i=0; i<AuditParameters->ParameterCount; i++) {
    00351
    00352
    00353         switch (AuditParameters->Parameters[i].Type) {
    00354             case SeAdtParmTypeNone:
    00355             case SeAdtParmTypeUlong:
    00356             case SeAdtParmTypeLogonId:
    00357             case SeAdtParmTypeNoLogonId:
    00358             case SeAdtParmTypeAccessMask:
    00359                 {
    00360                     //
    00361                     // Nothing to do for this
    00362                     //
    00363
    00364                     break;
    00365
    00366                 }
    00367             case SeAdtParmTypeString:
    00368             case SeAdtParmTypeFileSpec:
    00369                 {
    00370                     PUNICODE_STRING SourceString;
    00371                     //
    00372                     // We must copy the body of the unicode string
    00373                     // and then copy the body of the string.  Pointers
    00374                     // must be turned into offsets.
    00375
    00376                     TargetString = (PUNICODE_STRING)Base;
    00377
    00378                     SourceString = AuditParameters->Parameters[i].Address;
    00379
    00380                     *TargetString = *SourceString;
    00381
    00382                     //
    00383                     // Reset the data pointer in the output parameters to
    00384                     // 'point' to the new string structure.
    00385                     //
    00386
    00387                     (*MarshalledAuditParameters)->Parameters[i].Address = Base - (ULONG_PTR)(*MarshalledAuditParameters);
    00388
    00389                     Base += sizeof( UNICODE_STRING );
    00390
    00391                     RtlCopyMemory( Base, SourceString->Buffer, SourceString->Length );
    00392
    00393                     //
    00394                     // Make the string buffer in the target string point to where we
    00395                     // just copied the data.
    00396                     //
    00397
    00398                     TargetString->Buffer = (PWSTR)(Base - (ULONG_PTR)(*MarshalledAuditParameters));
    00399
    00400                     BaseIncr = (ULONG)LongAlignSize(SourceString->Length);
    00401
    00402                     Base += BaseIncr;
    00403
    00404                     break;
    00405                 }
    00406
    00407             //
    00408             // Handle types where we simply copy the buffer.
    00409             //
    00410             case SeAdtParmTypeSid:
    00411             case SeAdtParmTypePrivs:
    00412             case SeAdtParmTypeObjectTypes:
    00413                 {
    00414                     //
    00415                     // Copy the data into the output buffer
    00416                     //
    00417
    00418                     RtlCopyMemory( Base,
    00419                                    AuditParameters->Parameters[i].Address,
    00420                                    AuditParameters->Parameters[i].Length );
    00421
    00422                     //
    00423                     // Reset the 'address' of the data to be its offset in the
    00424                     // buffer.
    00425                     //
    00426
    00427                     (*MarshalledAuditParameters)->Parameters[i].Address = Base - (ULONG_PTR)(*MarshalledAuditParameters);
    00428
    00429                     Base +=  (ULONG)LongAlignSize( AuditParameters->Parameters[i].Length );
    00430
    00431
    00432                     break;
    00433                 }
    00434             default:
    00435                 {
    00436                     //
    00437                     // We got passed junk, complain.
    00438                     //
    00439
    00440                     ASSERT( FALSE );
    00441                     break;
    00442                 }
    00443         }
    00444     }
    00445
    00446     return( STATUS_SUCCESS );
    00447 }

VOID SepAdtObjectReferenceAuditAlarm | ( | IN PLUID OperationID | OPTIONAL,
|  | IN PVOID | Object,
|  | IN PSECURITY_SUBJECT_CONTEXT | SubjectSecurityContext,
|  | IN ACCESS_MASK | DesiredAccess,
|  | IN PPRIVILEGE_SET Privileges | OPTIONAL,
|  | IN BOOLEAN | AccessGranted,
|  | IN BOOLEAN | GenerateAudit,
|  | IN BOOLEAN | GenerateAlarm
| ) |

BOOLEAN SepAdtOpenObjectAuditAlarm | ( | IN PUNICODE_STRING | CapturedSubsystemName,
|  | IN PVOID *HandleId | OPTIONAL,
|  | IN PUNICODE_STRING | CapturedObjectTypeName,
|  | IN PVOID Object | OPTIONAL,
|  | IN PUNICODE_STRING CapturedObjectName | OPTIONAL,
|  | IN PTOKEN ClientToken | OPTIONAL,
|  | IN PTOKEN | PrimaryToken,
|  | IN ACCESS_MASK | DesiredAccess,
|  | IN ACCESS_MASK | GrantedAccess,
|  | IN PLUID | OperationId,
|  | IN PPRIVILEGE_SET CapturedPrivileges | OPTIONAL,
|  | IN BOOLEAN | ObjectCreated,
|  | IN BOOLEAN | AccessGranted,
|  | IN BOOLEAN | GenerateAudit,
|  | IN BOOLEAN | GenerateAlarm,
|  | IN HANDLE | ProcessID,
|  | IN POLICY_AUDIT_EVENT_TYPE | AuditType,
|  | IN PIOBJECT_TYPE_LIST ObjectTypeList | OPTIONAL,
|  | IN ULONG | ObjectTypeListLength,
|  | IN PACCESS_MASK GrantedAccessArray | OPTIONAL
| ) |

Definition at line 571 of file sepaudit.c.

References ASSERT, ClientToken, ExAllocatePoolWithTag, ExFreePool(), FlagMask, NULL, OBJECT_FAILURE_AUDIT, OBJECT_SUCCESS_AUDIT, PAGED_CODE, PagedPool, PrimaryToken, SepAdtLogAuditRecord(), SepSetParmTypeAccessMask, SepSetParmTypeFileSpec, SepSetParmTypeLogonId, SepSetParmTypeNoLogon, SepSetParmTypeObjectTypes, SepSetParmTypePrivileges, SepSetParmTypeSid, SepSetParmTypeString, SepSetParmTypeUlong, SepTokenAuthenticationId, SepTokenUserSid, TRUE, and USHORT.

Referenced by NtOpenObjectAuditAlarm(), SeAuditHandleCreation(), SeOpenObjectAuditAlarm(), SeOpenObjectForDeleteAuditAlarm(), and SepAccessCheckAndAuditAlarm().

    00596                        :
    00597
    00598     Implements NtOpenObjectAuditAlarm after parameters have been captured.
    00599
    00600     This routine is used to generate audit and alarm messages when an
    00601     attempt is made to access an existing protected subsystem object or
    00602     create a new one.  This routine may result in several messages being
    00603     generated and sent to Port objects.  This may result in a significant
    00604     latency before returning.  Design of routines that must call this
    00605     routine must take this potential latency into account.  This may have
    00606     an impact on the approach taken for data structure mutex locking, for
    00607     example.  This API requires the caller have SeTcbPrivilege privilege.
    00608     The test for this privilege is always against the primary token of the
    00609     calling process, not the impersonation token of the thread.
    00610
    00611
    00612     This routine will create an SE_ADT_PARAMETERS array organized as follows:
    00613
    00614     Parameter[0] - User Sid
    00615
    00616     Parameter[1] - Subsystem name (if available)
    00617
    00618     Parameter[2] - Server name (if available)
    00619
    00620     Parameter[3] - Object Type Name
    00621
    00622     Parameter[4] - Object Name
    00623
    00624     Parameter[5] - New handle ID
    00625
    00626     Parameter[6] - Subject's process id
    00627
    00628     Parameter[7] - Subject's primary authentication ID
    00629
    00630     Parameter[8] - Subject's client authentication ID
    00631
    00632     Parameter[9] - DesiredAccess mask
    00633
    00634     Parameter[10] - Privileges used for open
    00635
    00636     Parameter[11] - Guid/Level/AccessMask of objects/property sets/properties accesses.
    00637
    00638 Arguments:
    00639
    00640     CapturedSubsystemName - Supplies a name string identifying the
    00641         subsystem calling the routine.
    00642
    00643     HandleId - A unique value representing the client's handle to the
    00644         object.  If the access attempt was not successful (AccessGranted is
    00645         FALSE), then this parameter is ignored.
    00646
    00647     CapturedObjectTypeName - Supplies the name of the type of object being
    00648         accessed.
    00649
    00650     CapturedObjectName - Supplies the name of the object the client
    00651         accessed or attempted to access.
    00652
    00653     CapturedSecurityDescriptor - A pointer to the security descriptor of
    00654         the object being accessed.
    00655
    00656     ClientToken - Optionally provides a pointer to the client token
    00657         (only if the caller is currently impersonating)
    00658
    00659     PrimaryToken - Provides a pointer to the caller's primary token.
    00660
    00661     DesiredAccess - The desired access mask.  This mask must have been
    00662         previously mapped to contain no generic accesses.
    00663
    00664     GrantedAccess - The mask of accesses that were actually granted.
    00665
    00666     CapturedPrivileges - Optionally points to a set of privileges that were
    00667         required for the access attempt.  Those privileges that were held
    00668         by the subject are marked using the UsedForAccess flag of the
    00669         attributes associated with each privilege.
    00670
    00671     ObjectCreation - A boolean flag indicating whether the access will
    00672         result in a new object being created if granted.  A value of TRUE
    00673         indicates an object will be created, FALSE indicates an existing
    00674         object will be opened.
    00675
    00676     AccessGranted - Indicates whether the requested access was granted or
    00677         not.  A value of TRUE indicates the access was granted.  A value of
    00678         FALSE indicates the access was not granted.
    00679
    00680     GenerateOnClose - Points to a boolean that is set by the audit
    00681         generation routine and must be passed to NtCloseObjectAuditAlarm()
    00682         when the object handle is closed.
    00683
    00684     GenerateAudit - Indicates if we should generate an audit for this operation.
    00685
    00686     GenerateAlarm - Indicates if we should generate an alarm for this operation.
    00687
    00688     AuditType - Specifies the type of audit to be generated.  Valid values
    00689         are: AuditCategoryObjectAccess and AuditCategoryDirectoryServiceAccess.
    00690
    00691     ObjectTypeList - Supplies a list of GUIDs representing the object (and
    00692         sub-objects) being accessed.
    00693
    00694     ObjectTypeListLength - Specifies the number of elements in the ObjectTypeList.
    00695
    00696     GrantedAccessArray - If non NULL, specifies an array of access mask granted
    00697         to each object in ObjectTypeList.
    00698
    00699 Return Value:
    00700
    00701     Returns TRUE if audit is generated, FALSE otherwise.
    00702
    00703 --*/
    00704
    00705 {
    00706     SE_ADT_PARAMETER_ARRAY AuditParameters;
    00707     ULONG ObjectTypeIndex;
    00708     PSID CapturedUserSid;
    00709     LUID PrimaryAuthenticationId;
    00710     LUID ClientAuthenticationId;
    00711     PSE_ADT_OBJECT_TYPE AdtObjectTypeBuffer = NULL;
    00712
    00713     PAGED_CODE();
    00714
    00715     if ( ARGUMENT_PRESENT( ClientToken )) {
    00716
    00717         CapturedUserSid = SepTokenUserSid( ClientToken );
    00718         ClientAuthenticationId =  SepTokenAuthenticationId( ClientToken );
    00719
    00720     } else {
    00721
    00722         CapturedUserSid = SepTokenUserSid( PrimaryToken );
    00723     }
    00724
    00725     PrimaryAuthenticationId = SepTokenAuthenticationId( PrimaryToken );
    00726
    00727     //
    00728     // A completely zero'd entry will be interpreted
    00729     // as a "null string" or not supplied parameter.
    00730     //
    00731     // Initializing the entire array up front will allow
    00732     // us to avoid filling in each not supplied entry.
    00733     //
    00734
    00735     RtlZeroMemory (
    00736        (PVOID) &AuditParameters,
    00737        sizeof( AuditParameters )
    00738        );
    00739
    00740     ASSERT( SeAdtParmTypeNone == 0 );
    00741
    00742     ASSERT( ( AuditType == AuditCategoryObjectAccess ) ||
    00743             ( AuditType == AuditCategoryDirectoryServiceAccess ) );
    00744
    00745     if (AuditType == AuditCategoryObjectAccess) {
    00746
    00747         AuditParameters.CategoryId = SE_CATEGID_OBJECT_ACCESS;
    00748     } else {
    00749
    00750         AuditParameters.CategoryId = SE_CATEGID_DS_ACCESS;
    00751     }
    00752
    00753     AuditParameters.AuditId = SE_AUDITID_OPEN_HANDLE;
    00754     AuditParameters.ParameterCount = 0;
    00755
    00756     if ( AccessGranted ) {
    00757
    00758         AuditParameters.Type = EVENTLOG_AUDIT_SUCCESS;
    00759
    00760     } else {
    00761
    00762         AuditParameters.Type = EVENTLOG_AUDIT_FAILURE;
    00763     }
    00764
    00765     //
    00766     //  Parameter[0] - User Sid
    00767     //
    00768
    00769     SepSetParmTypeSid( AuditParameters, AuditParameters.ParameterCount, CapturedUserSid );
    00770
    00771     AuditParameters.ParameterCount++;
    00772
    00773     //
    00774     //  Parameter[1] - Subsystem name (if available)
    00775     //
    00776
    00777     SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, CapturedSubsystemName );
    00778
    00779     AuditParameters.ParameterCount++;
    00780
    00781     //
    00782     //  Parameter[2] - Object Server (if available)
    00783     //
    00784
    00785     if ( ARGUMENT_PRESENT( CapturedSubsystemName )) {
    00786
    00787         SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, CapturedSubsystemName );
    00788     }
    00789
    00790     AuditParameters.ParameterCount++;
    00791
    00792     //
    00793     //  Parameter[3] - Object Type Name
    00794     //
    00795
    00796     if ( ARGUMENT_PRESENT( CapturedObjectTypeName )) {
    00797
    00798         SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, CapturedObjectTypeName );
    00799         ObjectTypeIndex = AuditParameters.ParameterCount;
    00800     }
    00801
    00802     AuditParameters.ParameterCount++;
    00803
    00804     //
    00805     //  Parameter[4] - Object Name
    00806     //
    00807
    00808     if ( ARGUMENT_PRESENT( CapturedObjectName )) {
    00809
    00810         SepSetParmTypeFileSpec( AuditParameters, AuditParameters.ParameterCount, CapturedObjectName );
    00811     }
    00812
    00813     AuditParameters.ParameterCount++;
    00814
    00815     //
    00816     //  Parameter[5] - New handle ID
    00817     //
    00818
    00819     if ( ARGUMENT_PRESENT( HandleId )) {
    00820
    00821         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)*HandleId) );
    00822     }
    00823
    00824     AuditParameters.ParameterCount++;
    00825
    00826     if ( ARGUMENT_PRESENT( OperationId )) {
    00827
    00828         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (*OperationId).HighPart );
    00829
    00830         AuditParameters.ParameterCount++;
    00831
    00832         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (*OperationId).LowPart );
    00833
    00834         AuditParameters.ParameterCount++;
    00835
    00836     } else {
    00837
    00838         AuditParameters.ParameterCount += 2;
    00839     }
    00840
    00841     //
    00842     //  Parameter[6] - Subject's process id
    00843     //
    00844
    00845     SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)ProcessID) );
    00846
    00847     AuditParameters.ParameterCount++;
    00848
    00849     //
    00850     //  Parameter[7] - Subject's primary authentication ID
    00851     //
    00852
    00853     SepSetParmTypeLogonId( AuditParameters, AuditParameters.ParameterCount, PrimaryAuthenticationId );
    00854
    00855     AuditParameters.ParameterCount++;
    00856
    00857     //
    00858     //  Parameter[8] - Subject's client authentication ID
    00859     //
    00860
    00861     if ( ARGUMENT_PRESENT( ClientToken )) {
    00862
    00863         SepSetParmTypeLogonId( AuditParameters, AuditParameters.ParameterCount, ClientAuthenticationId );
    00864
    00865     } else {
    00866
    00867         SepSetParmTypeNoLogon( AuditParameters, AuditParameters.ParameterCount  );
    00868     }
    00869
    00870     AuditParameters.ParameterCount++;
    00871
    00872     //
    00873     //  Parameter[9] - DesiredAccess mask
    00874     //
    00875
    00876     if ( AccessGranted ) {
    00877
    00878         SepSetParmTypeAccessMask( AuditParameters, AuditParameters.ParameterCount, GrantedAccess, ObjectTypeIndex );
    00879
    00880     } else {
    00881
    00882         SepSetParmTypeAccessMask( AuditParameters, AuditParameters.ParameterCount, DesiredAccess, ObjectTypeIndex );
    00883     }
    00884
    00885     AuditParameters.ParameterCount++;
    00886
    00887     //
    00888     //    Parameter[10] - Privileges used for open
    00889     //
    00890
    00891     if ( (CapturedPrivileges != NULL) && (CapturedPrivileges->PrivilegeCount > 0) ) {
    00892
    00893         SepSetParmTypePrivileges( AuditParameters, AuditParameters.ParameterCount, CapturedPrivileges );
    00894     }
    00895
    00896     AuditParameters.ParameterCount++;
    00897
    00898     //
    00899     //    Parameter[11] - ObjectTypes of Audited objects/parameter sets/parameters
    00900     //
    00901
    00902     if ( ObjectTypeListLength != 0 ) {
    00903         ULONG GuidCount;
    00904         ULONG i;
    00905         USHORT FlagMask = AccessGranted ? OBJECT_SUCCESS_AUDIT : OBJECT_FAILURE_AUDIT;
    00906
    00907         //
    00908         // Count the number of GUIDs to audit.
    00909         //
    00910
    00911         GuidCount = 0;
    00912         for ( i=0; i<ObjectTypeListLength; i++ ) {
    00913
    00914             if ( i == 0 ) {
    00915                 GuidCount++;
    00916             } else if ( ObjectTypeList[i].Flags & FlagMask ) {
    00917                 GuidCount ++;
    00918             }
    00919         }
    00920
    00921         //
    00922         // If there are any Guids to audit,
    00923         //  copy them into a locally allocated buffer.
    00924         //
    00925
    00926         if ( GuidCount > 0 ) {
    00927
    00928             AdtObjectTypeBuffer = ExAllocatePoolWithTag( PagedPool, GuidCount * sizeof(SE_ADT_OBJECT_TYPE), 'pAeS' );
    00929
    00930             //
    00931             // If the buffer can be allocated,
    00932             //  fill it in.
    00933             // If not,
    00934             //  generate a truncated audit.
    00935             //
    00936
    00937             if ( AdtObjectTypeBuffer != NULL ) {
    00938
    00939                 //
    00940                 // Copy the GUIDs and optional access masks to the buffer.
    00941                 //
    00942
    00943                 GuidCount = 0;
    00944                 for ( i=0; i<ObjectTypeListLength; i++ ) {
    00945
    00946                     if ( ( i > 0 ) && !( ObjectTypeList[i].Flags & FlagMask ) ) {
    00947
    00948                         continue;
    00949
    00950                     } else {
    00951
    00952                         AdtObjectTypeBuffer[GuidCount].ObjectType = ObjectTypeList[i].ObjectType;
    00953                         AdtObjectTypeBuffer[GuidCount].Level      = ObjectTypeList[i].Level;
    00954
    00955                         if ( i == 0 ) {
    00956                             //
    00957                             // Always copy the GUID representing the object itself.
    00958                             //  Mark it as a such to avoid including it in the audit.
    00959                             //
    00960                             AdtObjectTypeBuffer[GuidCount].Flags      = SE_ADT_OBJECT_ONLY;
    00961                             AdtObjectTypeBuffer[GuidCount].AccessMask = 0;
    00962
    00963                         } else  {
    00964
    00965                             AdtObjectTypeBuffer[GuidCount].Flags = 0;
    00966                             if ( ARGUMENT_PRESENT(GrantedAccessArray) && AccessGranted ) {
    00967
    00968                                 AdtObjectTypeBuffer[GuidCount].AccessMask = GrantedAccessArray[i];
    00969                             }
    00970                         }
    00971                         GuidCount ++;
    00972                     }
    00973                 }
    00974
    00975                 //
    00976                 // Store the Object Types.
    00977                 //
    00978
    00979                 SepSetParmTypeObjectTypes( AuditParameters, AuditParameters.ParameterCount, AdtObjectTypeBuffer, GuidCount, ObjectTypeIndex );
    00980                 AuditParameters.ParameterCount ++;
    00981                 AuditParameters.AuditId = SE_AUDITID_OPEN_HANDLE_OBJECT_TYPE;
    00982             }
    00983         }
    00984
    00985     }
    00986
    00987
    00988
    00989     //
    00990     // Audit it.
    00991     //
    00992     SepAdtLogAuditRecord( &AuditParameters );
    00993
    00994     if ( AdtObjectTypeBuffer != NULL ) {
    00995         ExFreePool( AdtObjectTypeBuffer );
    00996     }
    00997
    00998     return( TRUE );
    00999 }

BOOLEAN SepAdtOpenObjectForDeleteAuditAlarm | ( | IN PUNICODE_STRING | CapturedSubsystemName,
|  | IN PVOID * | HandleId,
|  | IN PUNICODE_STRING | CapturedObjectTypeName,
|  | IN PVOID | Object,
|  | IN PUNICODE_STRING | CapturedObjectName,
|  | IN PTOKEN ClientToken | OPTIONAL,
|  | IN PTOKEN | PrimaryToken,
|  | IN ACCESS_MASK | DesiredAccess,
|  | IN ACCESS_MASK | GrantedAccess,
|  | IN PLUID | OperationId,
|  | IN PPRIVILEGE_SET CapturedPrivileges | OPTIONAL,
|  | IN BOOLEAN | ObjectCreated,
|  | IN BOOLEAN | AccessGranted,
|  | IN BOOLEAN | GenerateAudit,
|  | IN BOOLEAN | GenerateAlarm,
|  | IN HANDLE | ProcessID
| ) |

VOID SepAdtPrivilegedServiceAuditAlarm | ( | IN PUNICODE_STRING | CapturedSubsystemName,
|  | IN PUNICODE_STRING | CapturedServiceName,
|  | IN PTOKEN ClientToken | OPTIONAL,
|  | IN PTOKEN | PrimaryToken,
|  | IN PPRIVILEGE_SET | CapturedPrivileges,
|  | IN BOOLEAN | AccessGranted
| ) |

Definition at line 346 of file sepaudit.c.

References ASSERT, ClientToken, NULL, PAGED_CODE, PrimaryToken, SepAdtAuditThisEvent, SepAdtLogAuditRecord(), SepSetParmTypeLogonId, SepSetParmTypeNoLogon, SepSetParmTypePrivileges, SepSetParmTypeSid, SepSetParmTypeString, SepTokenAuthenticationId, SepTokenUserSid, and SeSubsystemName.

Referenced by NtPrivilegedServiceAuditAlarm(), and SePrivilegedServiceAuditAlarm().

    00357                    :
    00358
    00359     This routine is the active part of NtPrivilegedServiceAuditAlarm.
    00360
    00361     This routine is used to generate audit and alarm messages when an
    00362     attempt is made to perform privileged system service operations.  This
    00363     routine may result in several messages being generated and sent to Port
    00364     objects.  This may result in a significant latency before returning.
    00365     Design of routines that must call this routine must take this potential
    00366     latency into account.  This may have an impact on the approach taken
    00367     for data structure mutex locking, for example.
    00368
    00369     This API requires the caller have SeTcbPrivilege privilege.  The test
    00370     for this privilege is always against the primary token of the calling
    00371     process, allowing the caller to be impersonating a client during the
    00372     call with no ill effects.  The test for this privilege is assumed to
    00373     have occurred at a higher level.
    00374
    00375     This routine will create an SE_ADT_PARAMETERS array organized as follows:
    00376
    00377     Parameter[0] - User Sid
    00378
    00379     Parameter[1] - Subsystem name (if available)
    00380
    00381     Parameter[2] - Subject's primary authentication ID
    00382
    00383     Parameter[3] - Subject's client authentication ID
    00384
    00385     Parameter[4] - Privileges used for open
    00386
    00387 Arguments:
    00388
    00389     SubsystemName - Supplies a name string identifying the subsystem
    00390         calling the routine.
    00391
    00392     ServiceName - Supplies a name of the privileged subsystem service.  For
    00393         example, "RESET RUNTIME LOCAL SECURITY POLICY" might be specified
    00394         by a Local Security Authority service used to update the local
    00395         security policy database.
    00396
    00397     ClientToken - Optionally provides a pointer to the client token
    00398         (only if the caller is currently impersonating)
    00399
    00400     PrimaryToken - Provides a pointer to the caller's primary token.
    00401
    00402     Privileges - Points to a set of privileges required to perform the
    00403         privileged operation.  Those privileges that were held by the
    00404         subject are marked using the UsedForAccess flag of the
    00405         attributes associated with each privilege.
    00406
    00407     AccessGranted - Indicates whether the requested access was granted or
    00408         not.  A value of TRUE indicates the access was granted.  A value of
    00409         FALSE indicates the access was not granted.
    00410
    00411
    00412 Return value:
    00413
    00414
    00415 --*/
    00416
    00417 {
    00418
    00419     SE_ADT_PARAMETER_ARRAY AuditParameters;
    00420     PSID CapturedUserSid;
    00421     LUID ClientAuthenticationId;
    00422     LUID PrimaryAuthenticationId;
    00423     PUNICODE_STRING SubsystemName;
    00424
    00425     PAGED_CODE();
    00426
    00427     //
    00428     // Determine if we are auditing privileged services
    00429     //
    00430
    00431     if ( SepAdtAuditThisEvent( AuditCategoryPrivilegeUse, &AccessGranted )) {
    00432
    00433         if ( ARGUMENT_PRESENT( ClientToken )) {
    00434
    00435             CapturedUserSid = SepTokenUserSid( ClientToken );
    00436             ClientAuthenticationId =  SepTokenAuthenticationId( ClientToken );
    00437
    00438         } else {
    00439
    00440             CapturedUserSid = SepTokenUserSid( PrimaryToken );
    00441         }
    00442
    00443         PrimaryAuthenticationId = SepTokenAuthenticationId( PrimaryToken );
    00444
    00445         if ( !ARGUMENT_PRESENT( CapturedSubsystemName )) {
    00446
    00447             SubsystemName = &SeSubsystemName;
    00448
    00449         } else {
    00450
    00451             SubsystemName = CapturedSubsystemName;
    00452         }
    00453
    00454         //
    00455         // A completely zero'd entry will be interpreted
    00456         // as a "null string" or not supplied parameter.
    00457         //
    00458         // Initializing the entire array up front will allow
    00459         // us to avoid filling in each not supplied entry.
    00460         //
    00461
    00462         RtlZeroMemory (
    00463            (PVOID) &AuditParameters,
    00464            sizeof( AuditParameters )
    00465            );
    00466
    00467         ASSERT( SeAdtParmTypeNone == 0 );
    00468
    00469         AuditParameters.CategoryId = SE_CATEGID_PRIVILEGE_USE;
    00470         AuditParameters.AuditId = SE_AUDITID_PRIVILEGED_SERVICE;
    00471         AuditParameters.ParameterCount = 0;
    00472
    00473         if ( AccessGranted ) {
    00474
    00475             AuditParameters.Type = EVENTLOG_AUDIT_SUCCESS;
    00476
    00477         } else {
    00478
    00479             AuditParameters.Type = EVENTLOG_AUDIT_FAILURE;
    00480         }
    00481
    00482
    00483     //
    00484     //    Parameter[0] - User Sid
    00485     //
    00486
    00487         SepSetParmTypeSid( AuditParameters, AuditParameters.ParameterCount, CapturedUserSid );
    00488
    00489         AuditParameters.ParameterCount++;
    00490
    00491     //
    00492     //    Parameter[1] - Subsystem name (if available)
    00493     //
    00494
    00495     SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, SubsystemName );
    00496
    00497     AuditParameters.ParameterCount++;
    00498
    00499
    00500     //
    00501     //    Parameter[2] - Server
    00502     //
    00503
    00504     SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, SubsystemName );
    00505
    00506     AuditParameters.ParameterCount++;
    00507
    00508
    00509     //
    00510     //    Parameter[3] - Service name (if available)
    00511     //
    00512
    00513     if ( ARGUMENT_PRESENT( CapturedServiceName )) {
    00514
    00515         SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, CapturedServiceName );
    00516     }
    00517
    00518     AuditParameters.ParameterCount++;
    00519
    00520     //
    00521     //    Parameter[3] - Subject's primary authentication ID
    00522     //
    00523
    00524
    00525     SepSetParmTypeLogonId( AuditParameters, AuditParameters.ParameterCount, PrimaryAuthenticationId );
    00526
    00527     AuditParameters.ParameterCount++;
    00528
    00529
    00530     //
    00531     //    Parameter[4] - Subject's client authentication ID
    00532     //
    00533
    00534     if ( ARGUMENT_PRESENT( ClientToken )) {
    00535
    00536         SepSetParmTypeLogonId( AuditParameters, AuditParameters.ParameterCount, ClientAuthenticationId );
    00537
    00538     } else {
    00539
    00540         SepSetParmTypeNoLogon( AuditParameters, AuditParameters.ParameterCount );
    00541     }
    00542
    00543     AuditParameters.ParameterCount++;
    00544
    00545
    00546     //
    00547     //    Parameter[5] - Privileges used for open
    00548     //
    00549
    00550
    00551     if ( (CapturedPrivileges != NULL) && (CapturedPrivileges->PrivilegeCount > 0) ) {
    00552
    00553         SepSetParmTypePrivileges( AuditParameters, AuditParameters.ParameterCount, CapturedPrivileges );
    00554     }
    00555
    00556     AuditParameters.ParameterCount++;
    00557
    00558
    00559     SepAdtLogAuditRecord( &AuditParameters );
    00560
    00561     }
    00562
    00563 }

BOOLEAN SepAdtPrivilegeObjectAuditAlarm | ( | IN PUNICODE_STRING CapturedSubsystemName | OPTIONAL,
|  | IN PVOID | HandleId,
|  | IN PTOKEN ClientToken | OPTIONAL,
|  | IN PTOKEN | PrimaryToken,
|  | IN PVOID | ProcessId,
|  | IN ACCESS_MASK | DesiredAccess,
|  | IN PPRIVILEGE_SET | CapturedPrivileges,
|  | IN BOOLEAN | AccessGranted
| ) |

Definition at line 125 of file sepaudit.c.

References ASSERT, ClientToken, FALSE, NULL, PAGED_CODE, PrimaryToken, RtlEqualSid(), SeLocalSystemSid, SepAdtAuditThisEvent, SepAdtLogAuditRecord(), SepFilterPrivilegeAudits(), SepSetParmTypeLogonId, SepSetParmTypeNoLogon, SepSetParmTypePrivileges, SepSetParmTypeSid, SepSetParmTypeString, SepSetParmTypeUlong, SepTokenAuthenticationId, SepTokenUserSid, and TRUE.

Referenced by NtOpenObjectAuditAlarm(), NtPrivilegeObjectAuditAlarm(), SeAuditHandleCreation(), SepAccessCheckAndAuditAlarm(), and SePrivilegeObjectAuditAlarm().

    00138                    :
    00139
    00140     Implements NtPrivilegeObjectAuditAlarm after parameters have been
    00141     captured.
    00142
    00143     This routine is used to generate audit and alarm messages when an
    00144     attempt is made to perform privileged operations on a protected
    00145     subsystem object after the object is already opened.  This routine may
    00146     result in several messages being generated and sent to Port objects.
    00147     This may result in a significant latency before returning.  Design of
    00148     routines that must call this routine must take this potential latency
    00149     into account.  This may have an impact on the approach taken for data
    00150     structure mutex locking, for example.
    00151
    00152     This API requires the caller have SeTcbPrivilege privilege.  The test
    00153     for this privilege is always against the primary token of the calling
    00154     process, allowing the caller to be impersonating a client during the
    00155     call with no ill effects.
    00156
    00157     This routine will create an SE_ADT_PARAMETERS array organized as follows:
    00158
    00159     Parameter[0] - User Sid
    00160
    00161     Parameter[1] - Subsystem name (if available)
    00162
    00163     Parameter[2] - New handle ID
    00164
    00165     Parameter[3] - Subject's process id
    00166
    00167     Parameter[4] - Subject's primary authentication ID
    00168
    00169     Parameter[5] - Subject's client authentication ID
    00170
    00171     Parameter[6] - Privileges used for open
    00172
    00173 Arguments:
    00174
    00175     CapturedSubsystemName - Supplies a name string identifying the
    00176         subsystem calling the routine.
    00177
    00178     HandleId - A unique value representing the client's handle to the
    00179         object.
    00180
    00181     ClientToken - Optionally provides a pointer to the client token
    00182         (only if the caller is currently impersonating)
    00183
    00184     PrimaryToken - Provides a pointer to the caller's primary token.
    00185
    00186     DesiredAccess - The desired access mask.  This mask must have been
    00187         previously mapped to contain no generic accesses.
    00188
    00189     CapturedPrivileges - The set of privileges required for the requested
    00190         operation.  Those privileges that were held by the subject are
    00191         marked using the UsedForAccess flag of the attributes
    00192         associated with each privilege.
    00193
    00194     AccessGranted - Indicates whether the requested access was granted or
    00195         not.  A value of TRUE indicates the access was granted.  A value of
    00196         FALSE indicates the access was not granted.
    00197
    00198 Return value:
    00199
    00200 --*/
    00201 {
    00202     SE_ADT_PARAMETER_ARRAY AuditParameters;
    00203     PSID CapturedUserSid;
    00204     LUID ClientAuthenticationId;
    00205     LUID PrimaryAuthenticationId;
    00206
    00207     PAGED_CODE();
    00208
    00209     //
    00210     // Determine if we are auditing the use of privileges
    00211     //
    00212
    00213     if ( SepAdtAuditThisEvent( AuditCategoryPrivilegeUse, &AccessGranted ) &&
    00214          SepFilterPrivilegeAudits( CapturedPrivileges )) {
    00215
    00216         if ( ARGUMENT_PRESENT( ClientToken )) {
    00217
    00218             CapturedUserSid = SepTokenUserSid( ClientToken );
    00219             ClientAuthenticationId =  SepTokenAuthenticationId( ClientToken );
    00220
    00221         } else {
    00222
    00223             CapturedUserSid = SepTokenUserSid( PrimaryToken );
    00224         }
    00225
    00226         if ( RtlEqualSid( SeLocalSystemSid, CapturedUserSid )) {
    00227
    00228             return (FALSE);
    00229         }
    00230
    00231         PrimaryAuthenticationId = SepTokenAuthenticationId( PrimaryToken );
    00232
    00233         //
    00234         // A completely zero'd entry will be interpreted
    00235         // as a "null string" or not supplied parameter.
    00236         //
    00237         // Initializing the entire array up front will allow
    00238         // us to avoid filling in each not supplied entry.
    00239         //
    00240
    00241         RtlZeroMemory (
    00242            (PVOID) &AuditParameters,
    00243            sizeof( AuditParameters )
    00244            );
    00245
    00246         ASSERT( SeAdtParmTypeNone == 0 );
    00247
    00248         AuditParameters.CategoryId = SE_CATEGID_PRIVILEGE_USE;
    00249         AuditParameters.AuditId = SE_AUDITID_PRIVILEGED_OBJECT;
    00250         AuditParameters.ParameterCount = 0;
    00251
    00252         if ( AccessGranted ) {
    00253
    00254             AuditParameters.Type = EVENTLOG_AUDIT_SUCCESS;
    00255
    00256         } else {
    00257
    00258             AuditParameters.Type = EVENTLOG_AUDIT_FAILURE;
    00259         }
    00260
    00261         //
    00262         //    Parameter[0] - User Sid
    00263         //
    00264
    00265         SepSetParmTypeSid( AuditParameters, AuditParameters.ParameterCount, CapturedUserSid );
    00266
    00267         AuditParameters.ParameterCount++;
    00268
    00269         //
    00270         //    Parameter[1] - Subsystem name (if available)
    00271         //
    00272
    00273         SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, CapturedSubsystemName );
    00274
    00275         AuditParameters.ParameterCount++;
    00276
    00277         //
    00278         //    Parameter[1] - Subsystem name (if available)
    00279         //
    00280
    00281         SepSetParmTypeString( AuditParameters, AuditParameters.ParameterCount, CapturedSubsystemName );
    00282
    00283         AuditParameters.ParameterCount++;
    00284
    00285         //
    00286         //    Parameter[2] - New handle ID
    00287         //
    00288
    00289         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)HandleId) );
    00290
    00291         AuditParameters.ParameterCount++;
    00292
    00293         //
    00294         //    Parameter[3] - Subject's process id
    00295         //
    00296
    00297         SepSetParmTypeUlong( AuditParameters, AuditParameters.ParameterCount, (ULONG)((ULONG_PTR)ProcessId) );
    00298
    00299         AuditParameters.ParameterCount++;
    00300
    00301         //
    00302         //    Parameter[4] - Subject's primary authentication ID
    00303         //
    00304
    00305         SepSetParmTypeLogonId( AuditParameters, AuditParameters.ParameterCount, PrimaryAuthenticationId );
    00306
    00307         AuditParameters.ParameterCount++;
    00308
    00309         //
    00310         //    Parameter[5] - Subject's client authentication ID
    00311         //
    00312
    00313         if ( ARGUMENT_PRESENT( ClientToken )) {
    00314
    00315             SepSetParmTypeLogonId( AuditParameters, AuditParameters.ParameterCount, ClientAuthenticationId );
    00316
    00317         } else {
    00318
    00319             SepSetParmTypeNoLogon( AuditParameters, AuditParameters.ParameterCount );
    00320         }
    00321
    00322         AuditParameters.ParameterCount++;
    00323
    00324         //
    00325         //    Parameter[6] - Privileges used for open
    00326         //
    00327
    00328         if ( (CapturedPrivileges != NULL) && (CapturedPrivileges->PrivilegeCount > 0) ) {
    00329
    00330             SepSetParmTypePrivileges( AuditParameters, AuditParameters.ParameterCount, CapturedPrivileges );
    00331         }
    00332
    00333         AuditParameters.ParameterCount++;
    00334
    00335         SepAdtLogAuditRecord( &AuditParameters );
    00336
    00337         return( TRUE );
    00338
    00339     }
    00340
    00341     return( FALSE );
    00342 }

VOID SepAdtSetAuditEventInformation | ( | IN OPTIONAL PBOOLEAN | AuditingMode,
|  | IN OPTIONAL PPOLICY_AUDIT_EVENT_OPTIONS | EventAuditingOptions
| ) |

VOID SepAdtSetAuditLogInformation | ( | IN PPOLICY_AUDIT_LOG_INFO | AuditLogInformation | ) |

Definition at line 451 of file adtlog.c.

References PAGED_CODE, SepAdtLogInformation, SepRmAcquireDbWriteLock, and SepRmReleaseDbWriteLock.

Referenced by SepRmSetAuditLogWrkr().

    00457                    :
    00458
    00459     This function stores Audit Log Information in the Reference Monitor's
    00460     in-memory database.  This information contains parameters such as Audit
    00461     Log size etc.  It is the caller's responsibility to ensure that the
    00462     supplied information is valid.
    00463
    00464     NOTE:  After initialization, this function is only called by the LSA
    00465     via a Reference Monitor command.  This is a necessary restriction
    00466     because the Audit Log Information stored in the LSA Database must
    00467     remain in sync
    00468
    00469 Arguments:
    00470
    00471     AuditLogInformation - Pointer to Audit Log Information structure.
    00472
    00473 Return Value:
    00474
    00475     None.
    00476
    00477 --*/
    00478
    00479 {
    00480     PAGED_CODE();
    00481
    00482     //
    00483     // Acquire Reference Monitor Database write lock.
    00484     //
    00485
    00486     SepRmAcquireDbWriteLock();
    00487
    00488     //
    00489     // Write the information
    00490     //
    00491
    00492     SepAdtLogInformation = *AuditLogInformation;
    00493
    00494     //
    00495     // Release Reference Monitor Database write lock
    00496     //
    00497
    00498     SepRmReleaseDbWriteLock();
    00499 }

VOID SepAdtTraverseAuditAlarm | ( | IN PLUID | OperationID,
|  | IN PVOID | DirectoryObject,
|  | IN PSID | UserSid,
|  | IN LUID | AuthenticationId,
|  | IN ACCESS_MASK | DesiredAccess,
|  | IN PPRIVILEGE_SET Privileges | OPTIONAL,
|  | IN BOOLEAN | AccessGranted,
|  | IN BOOLEAN | GenerateAudit,
|  | IN BOOLEAN | GenerateAlarm
| ) |

| Referenced by SeTraverseAuditAlarm().

VOID SepAuditFailed | ( | VOID |  | ) |

Definition at line 153 of file adtlog.c.

References ASSERT, FALSE, KeBugCheck(), KeyName, L, NT_SUCCESS, NTSTATUS(), NULL, RtlInitUnicodeString(), SepCrashOnAuditFail, Status, and ValueName.

Referenced by SepAdtLogAuditRecord().

    00159                    :
    00160
    00161     Bugchecks the system due to a missed audit (optional requirement
    00162     for C2 compliance).
    00163
    00164 Arguments:
    00165
    00166     None.
    00167
    00168 Return Value:
    00169
    00170     None.
    00171
    00172 --*/
    00173
    00174 {
    00175     NTSTATUS Status;
    00176     OBJECT_ATTRIBUTES Obja;
    00177     HANDLE KeyHandle;
    00178     UNICODE_STRING KeyName;
    00179     UNICODE_STRING ValueName;
    00180     UCHAR NewValue;
    00181
    00182     ASSERT(sizeof(UCHAR) == sizeof(BOOLEAN));
    00183
    00184     if (!SepCrashOnAuditFail) {
    00185         return;
    00186     }
    00187
    00188     //
    00189     // Turn off flag in the registry that controls crashing on audit failure
    00190     //
    00191
    00192     RtlInitUnicodeString( &KeyName, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa");
    00193
    00194     InitializeObjectAttributes( &Obja,
    00195                                 &KeyName,
    00196                                 OBJ_CASE_INSENSITIVE |
    00197                                     OBJ_KERNEL_HANDLE,
    00198                                 NULL,
    00199                                 NULL
    00200                                 );
    00201     do {
    00202
    00203         Status = ZwOpenKey(
    00204                      &KeyHandle,
    00205                      KEY_SET_VALUE,
    00206                      &Obja
    00207                      );
    00208
    00209     } while ((Status == STATUS_INSUFFICIENT_RESOURCES) || (Status == STATUS_NO_MEMORY));
    00210
    00211     //
    00212     // If the LSA key isn't there, he's got big problems.  But don't crash.
    00213     //
    00214
    00215     if (Status == STATUS_OBJECT_NAME_NOT_FOUND) {
    00216         SepCrashOnAuditFail = FALSE;
    00217         return;
    00218     }
    00219
    00220     if (!NT_SUCCESS( Status )) {
    00221         goto bugcheck;
    00222     }
    00223
    00224     RtlInitUnicodeString( &ValueName, CRASH_ON_AUDIT_FAIL_VALUE );
    00225
    00226     NewValue = LSAP_ALLOW_ADIMIN_LOGONS_ONLY;
    00227
    00228     do {
    00229
    00230         Status = ZwSetValueKey( KeyHandle,
    00231                                 &ValueName,
    00232                                 0,
    00233                                 REG_NONE,
    00234                                 &NewValue,
    00235                                 sizeof(UCHAR)
    00236                                 );
    00237
    00238     } while ((Status == STATUS_INSUFFICIENT_RESOURCES) || (Status == STATUS_NO_MEMORY));
    00239     ASSERT(NT_SUCCESS(Status));
    00240
    00241     if (!NT_SUCCESS( Status )) {
    00242         goto bugcheck;
    00243     }
    00244
    00245     do {
    00246
    00247         Status = ZwFlushKey( KeyHandle );
    00248
    00249     } while ((Status == STATUS_INSUFFICIENT_RESOURCES) || (Status == STATUS_NO_MEMORY));
    00250     ASSERT(NT_SUCCESS(Status));
    00251
    00252     //
    00253     // go boom.
    00254     //
    00255
    00256 bugcheck:
    00257
    00258     KeBugCheck(AUDIT_FAILURE);
    00259 }

BOOLEAN SepInitializePrivilegeFilter | ( | BOOLEAN | Verbose | ) |

Definition at line 4556 of file seaudit.c.

References SepFilterPrivileges, SepFilterPrivilegesLong, SepFilterPrivilegesShort, and TRUE.

Referenced by SepAdtInitializePrivilegeAuditing().

    04561                    :
    04562
    04563     Initializes SepFilterPrivileges for either normal or verbose auditing.
    04564
    04565 Arguments:
    04566
    04567     Verbose - Whether we want to filter by the short or long privileges
    04568     list.  Verbose == TRUE means use the short list.
    04569
    04570 Return Value:
    04571
    04572     TRUE for success, FALSE for failure
    04573
    04574 --*/
    04575 {
    04576     if (Verbose) {
    04577         SepFilterPrivileges = SepFilterPrivilegesShort;
    04578     } else {
    04579         SepFilterPrivileges = SepFilterPrivilegesLong;
    04580     }
    04581
    04582     return( TRUE );
    04583 }

## Variable Documentation

BOOLEAN SepAdtAuditingEnabled

| Definition at line 31 of file adtp.h.

ULONG SepAdtCountEventsDiscarded

| Definition at line 56 of file adtp.h. Referenced by SepAdtGenerateDiscardAudit(), and SepQueueWorkItem().

ULONG SepAdtCurrentListLength

| Definition at line 63 of file adtp.h. Referenced by SepDequeueWorkItem(), and SepQueueWorkItem().

BOOLEAN SepAdtDiscardingAudits

| Definition at line 70 of file adtp.h. Referenced by SepQueueWorkItem().

POLICY_AUDIT_LOG_INFO SepAdtLogInformation

| Definition at line 29 of file adtp.h. Referenced by SepAdtSetAuditLogInformation().

ULONG SepAdtMaxListLength

| Definition at line 37 of file adtp.h. Referenced by SepAdtInitializeBounds(), and SepQueueWorkItem().

ULONG SepAdtMinListLength

| Definition at line 38 of file adtp.h. Referenced by SepAdtInitializeBounds(), and SepQueueWorkItem().

SEP_AUDIT_OPTIONS SepAuditOptions

| Definition at line 323 of file adtp.h. Referenced by SepAdtCloseObjectAuditAlarm(), and SepAdtInitializeAuditingOptions().

BOOLEAN SepCrashOnAuditFail

| Definition at line 77 of file adtp.h. Referenced by SepAdtInitializeCrashOnFail(), SepAdtLogAuditRecord(), and SepAuditFailed().