test: seglobal.c Source File

Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

# seglobal.c

Go to the documentation of this file.

    00001 /*++
    00002
    00003 Copyright (c) 1989  Microsoft Corporation
    00004
    00005 Module Name:
    00006
    00007     seglobal.c
    00008
    00009 Abstract:
    00010
    00011    This module contains the global variables used and exported by the security
    00012    component.
    00013
    00014 Author:
    00015
    00016     Jim Kelly (JimK) 5-Aug-1990
    00017
    00018 Environment:
    00019
    00020     Kernel mode only.
    00021
    00022 Revision History:
    00023
    00024
    00025 --*/
    00026
    00027 #include "sep.h"
    00028 #include "adt.h"
    00029 #include "seopaque.h"
    00030
    00031 VOID
    00032 SepInitializePrivilegeSets( VOID );
    00033
    00034
    00035 VOID
    00036 SepInitSystemDacls( VOID );
    00037
    00038
    00039 #ifdef ALLOC_PRAGMA
    00040 #pragma alloc_text(INIT,SepVariableInitialization)
    00041 #pragma alloc_text(INIT,SepInitializePrivilegeSets)
    00042 #pragma alloc_text(INIT,SepInitSystemDacls)
    00043 #pragma alloc_text(INIT,SepInitializeWorkList)
    00044 #pragma alloc_text(PAGE,SepAssemblePrivileges)
    00045 #endif
    00046
    00047 #ifdef    SE_DIAGNOSTICS_ENABLED
    00048
    00049 //
    00050 // Used to control the active SE diagnostic support provided
    00051 //
    00052
    00053 ULONG SeGlobalFlag = 0;
    00054
    00055 #endif // SE_DIAGNOSTICS_ENABLED
    00056
    00057
    00058
    00060 //                                                                    //
    00061 //           Global, READ ONLY, Security variables                    //
    00062 //                                                                    //
    00064
    00065 //
    00066 //  Authentication ID and source name used for system processes
    00067 //
    00068
    00069 TOKEN_SOURCE SeSystemTokenSource = {"*SYSTEM*", 0};
    00070 LUID SeSystemAuthenticationId = SYSTEM_LUID;
    00071 LUID SeAnonymousAuthenticationId = ANONYMOUS_LOGON_LUID;
    00072
    00073
    00074 //
    00075 // Universal well known SIDs
    00076 //
    00077
    00078 PSID  SeNullSid;
    00079 PSID  SeWorldSid;
    00080 PSID  SeLocalSid;
    00081 PSID  SeCreatorOwnerSid;
    00082 PSID  SeCreatorGroupSid;
    00083 PSID  SeCreatorGroupServerSid;
    00084 PSID  SeCreatorOwnerServerSid;
    00085
    00086 //
    00087 // Sids defined by NT
    00088 //
    00089
    00090 PSID SeNtAuthoritySid;
    00091
    00092 PSID SeDialupSid;
    00093 PSID SeNetworkSid;
    00094 PSID SeBatchSid;
    00095 PSID SeInteractiveSid;
    00096 PSID SeServiceSid;
    00097 PSID SePrincipalSelfSid;
    00098 PSID SeLocalSystemSid;
    00099 PSID SeAuthenticatedUsersSid;
    00100 PSID SeAliasAdminsSid;
    00101 PSID SeRestrictedSid;
    00102 PSID SeAliasUsersSid;
    00103 PSID SeAliasGuestsSid;
    00104 PSID SeAliasPowerUsersSid;
    00105 PSID SeAliasAccountOpsSid;
    00106 PSID SeAliasSystemOpsSid;
    00107 PSID SeAliasPrintOpsSid;
    00108 PSID SeAliasBackupOpsSid;
    00109 PSID SeAnonymousLogonSid;
    00110
    00111 //
    00112 // Well known tokens
    00113 //
    00114
    00115 PACCESS_TOKEN SeAnonymousLogonToken;
    00116
    00117 //
    00118 // System default DACLs & Security Descriptors
    00119 //
    00120 //  SePublicDefaultDacl     - Protects objects so that WORLD:E, Admins:ALL, System: ALL.
    00121 //                            Not inherited by sub-objects.
    00122 //
    00123 //  SePublicDefaultUnrestrictedDacl - Protects objects so that WORLD:E, Admins:ALL, System: ALL, Restricted:E
    00124 //                            Not inherited by sub-objects.
    00125 //
    00126 //  SePublicOpenDacl        - Protects so that WORLD can RWE and Admins: All.
    00127 //                            Not inherited by sub-objects.
    00128 //
    00129 //  SePublicOpenUnrestrictedDacl - Protects so that WORLD can RWE and Admins: All, Restricted:RE
    00130 //                            Not inherited by sub-objects.
    00131 //
    00132 //  SeSystemDefaultDacl     - Protects objects so that SYSTEM & ADMIN can use them.
    00133 //                            Not inherited by subobjects.
    00134 //
    00135 //  SeUnrestrictedDacl      - Protects objects so that everyone AND unrestricted have full control
    00136 //                            Not inherited by subobjects.
    00137 //
    00138
    00139 PSECURITY_DESCRIPTOR SePublicDefaultSd;
    00140 SECURITY_DESCRIPTOR  SepPublicDefaultSd;
    00141 PSECURITY_DESCRIPTOR SePublicDefaultUnrestrictedSd;
    00142 SECURITY_DESCRIPTOR  SepPublicDefaultUnrestrictedSd;
    00143 PSECURITY_DESCRIPTOR SePublicOpenUnrestrictedSd;
    00144 SECURITY_DESCRIPTOR  SepPublicOpenUnrestrictedSd;
    00145 PSECURITY_DESCRIPTOR SePublicOpenSd;
    00146 SECURITY_DESCRIPTOR  SepPublicOpenSd;
    00147 PSECURITY_DESCRIPTOR SeSystemDefaultSd;
    00148 SECURITY_DESCRIPTOR  SepSystemDefaultSd;
    00149 PSECURITY_DESCRIPTOR SeUnrestrictedSd;
    00150 SECURITY_DESCRIPTOR  SepUnrestrictedSd;
    00151
    00152 PACL SePublicDefaultDacl;
    00153 PACL SePublicDefaultUnrestrictedDacl;
    00154 PACL SePublicOpenDacl;
    00155 PACL SePublicOpenUnrestrictedDacl;
    00156 PACL SeSystemDefaultDacl;
    00157 PACL SeUnrestrictedDacl;
    00158
    00159 //
    00160 // Sid of primary domain, and admin account in that domain
    00161 //
    00162
    00163 PSID SepPrimaryDomainSid;
    00164 PSID SepPrimaryDomainAdminSid;
    00165
    00166
    00167
    00168 //
    00169 //  Well known privilege values
    00170 //
    00171
    00172
    00173 LUID SeCreateTokenPrivilege;
    00174 LUID SeAssignPrimaryTokenPrivilege;
    00175 LUID SeLockMemoryPrivilege;
    00176 LUID SeIncreaseQuotaPrivilege;
    00177 LUID SeUnsolicitedInputPrivilege;
    00178 LUID SeTcbPrivilege;
    00179 LUID SeSecurityPrivilege;
    00180 LUID SeTakeOwnershipPrivilege;
    00181 LUID SeLoadDriverPrivilege;
    00182 LUID SeCreatePagefilePrivilege;
    00183 LUID SeIncreaseBasePriorityPrivilege;
    00184 LUID SeSystemProfilePrivilege;
    00185 LUID SeSystemtimePrivilege;
    00186 LUID SeProfileSingleProcessPrivilege;
    00187 LUID SeCreatePermanentPrivilege;
    00188 LUID SeBackupPrivilege;
    00189 LUID SeRestorePrivilege;
    00190 LUID SeShutdownPrivilege;
    00191 LUID SeDebugPrivilege;
    00192 LUID SeAuditPrivilege;
    00193 LUID SeSystemEnvironmentPrivilege;
    00194 LUID SeChangeNotifyPrivilege;
    00195 LUID SeRemoteShutdownPrivilege;
    00196 LUID SeUndockPrivilege;
    00197 LUID SeSyncAgentPrivilege;
    00198 LUID SeEnableDelegationPrivilege;
    00199
    00200
    00201 //
    00202 // Define the following structures for export from the kernel.
    00203 // This will allow us to export pointers to these structures
    00204 // rather than a pointer for each element in the structure.
    00205 //
    00206
    00207 PSE_EXPORTS  SeExports;
    00208 SE_EXPORTS SepExports;
    00209
    00210
    00211 static SID_IDENTIFIER_AUTHORITY    SepNullSidAuthority    = SECURITY_NULL_SID_AUTHORITY;
    00212 static SID_IDENTIFIER_AUTHORITY    SepWorldSidAuthority   = SECURITY_WORLD_SID_AUTHORITY;
    00213 static SID_IDENTIFIER_AUTHORITY    SepLocalSidAuthority   = SECURITY_LOCAL_SID_AUTHORITY;
    00214 static SID_IDENTIFIER_AUTHORITY    SepCreatorSidAuthority = SECURITY_CREATOR_SID_AUTHORITY;
    00215 static SID_IDENTIFIER_AUTHORITY    SepNtAuthority = SECURITY_NT_AUTHORITY;
    00216
    00217
    00218
    00219 //
    00220 // Some variables we are going to use to help speed up access
    00221 // checking.
    00222 //
    00223
    00224 static ULONG SinglePrivilegeSetSize;
    00225 static ULONG DoublePrivilegeSetSize;
    00226
    00227 static PPRIVILEGE_SET SepSystemSecurityPrivilegeSet;
    00228 static PPRIVILEGE_SET SepTakeOwnershipPrivilegeSet;
    00229 static PPRIVILEGE_SET SepDoublePrivilegeSet;
    00230
    00231
    00232 //
    00233 // Array containing information describing what is to be audited
    00234 //
    00235
    00236 SE_AUDITING_STATE SeAuditingState[POLICY_AUDIT_EVENT_TYPE_COUNT] =
    00237     {
    00238         { FALSE, FALSE },
    00239         { FALSE, FALSE },
    00240         { FALSE, FALSE },
    00241         { FALSE, FALSE },
    00242         { FALSE, FALSE },
    00243         { FALSE, FALSE },
    00244         { FALSE, FALSE },
    00245         { FALSE, FALSE },
    00246         { FALSE, FALSE }
    00247     };
    00248
    00249 //
    00250 // Boolean indicating whether or not auditing is enabled for the system
    00251 //
    00252
    00253 BOOLEAN SepAdtAuditingEnabled = FALSE;
    00254
    00255 //
    00256 // Boolean to hold whether or not the user wants the system to crash when
    00257 // an audit fails.
    00258 //
    00259
    00260 BOOLEAN SepCrashOnAuditFail = FALSE;
    00261
    00262 //
    00263 // Handle to the LSA process
    00264 //
    00265
    00266 HANDLE SepLsaHandle;
    00267
    00268 //
    00269 // Boolean indicating that we're auditing detailed events
    00270 // such as process creation.
    00271 //
    00272
    00273 BOOLEAN SeDetailedAuditing = FALSE;
    00274
    00275 UNICODE_STRING SeSubsystemName;
    00276
    00277
    00278 //
    00279 // Mutex protecting the queue of work being passed to LSA
    00280 //
    00281
    00282 ERESOURCE SepLsaQueueLock;
    00283
    00284 //
    00285 // Doubly linked list of work items queued to worker threads.
    00286 //
    00287
    00288 LIST_ENTRY SepLsaQueue;
    00289
    00290 //
    00291 // Count to tell us how long the queue gets in SepRmCallLsa
    00292 //
    00293
    00294 ULONG SepLsaQueueLength = 0;
    00295
    00296 SEP_WORK_ITEM SepExWorkItem;
    00297
    00298
    00299
    00301 //                                                                    //
    00302 //           Variable Initialization Routines                         //
    00303 //                                                                    //
    00305
    00306 BOOLEAN
    00307 SepVariableInitialization()
    00308 /*++
    00309
    00310 Routine Description:
    00311
    00312     This function initializes the global variables used by and exposed
    00313     by security.
    00314
    00315 Arguments:
    00316
    00317     None.
    00318
    00319 Return Value:
    00320
    00321     TRUE if variables successfully initialized.
    00322     FALSE if not successfully initialized.
    00323
    00324 --*/
    00325 {
    00326
    00327     ULONG SidWithZeroSubAuthorities;
    00328     ULONG SidWithOneSubAuthority;
    00329     ULONG SidWithTwoSubAuthorities;
    00330     ULONG SidWithThreeSubAuthorities;
    00331
    00332     SID_IDENTIFIER_AUTHORITY NullSidAuthority;
    00333     SID_IDENTIFIER_AUTHORITY WorldSidAuthority;
    00334     SID_IDENTIFIER_AUTHORITY LocalSidAuthority;
    00335     SID_IDENTIFIER_AUTHORITY CreatorSidAuthority;
    00336     SID_IDENTIFIER_AUTHORITY SeNtAuthority;
    00337
    00338     PAGED_CODE();
    00339
    00340     NullSidAuthority         = SepNullSidAuthority;
    00341     WorldSidAuthority        = SepWorldSidAuthority;
    00342     LocalSidAuthority        = SepLocalSidAuthority;
    00343     CreatorSidAuthority      = SepCreatorSidAuthority;
    00344     SeNtAuthority            = SepNtAuthority;
    00345
    00346
    00347     //
    00348     //  The following SID sizes need to be allocated
    00349     //
    00350
    00351     SidWithZeroSubAuthorities  = RtlLengthRequiredSid( 0 );
    00352     SidWithOneSubAuthority     = RtlLengthRequiredSid( 1 );
    00353     SidWithTwoSubAuthorities   = RtlLengthRequiredSid( 2 );
    00354     SidWithThreeSubAuthorities = RtlLengthRequiredSid( 3 );
    00355
    00356     //
    00357     //  Allocate and initialize the universal SIDs
    00358     //
    00359
    00360     SeNullSid         = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00361     SeWorldSid        = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00362     SeLocalSid        = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00363     SeCreatorOwnerSid = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00364     SeCreatorGroupSid = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00365     SeCreatorOwnerServerSid = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00366     SeCreatorGroupServerSid = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00367
    00368     //
    00369     // Fail initialization if we didn't get enough memory for the universal
    00370     // SIDs.
    00371     //
    00372
    00373     if ( (SeNullSid         == NULL)        ||
    00374          (SeWorldSid        == NULL)        ||
    00375          (SeLocalSid        == NULL)        ||
    00376          (SeCreatorOwnerSid == NULL)        ||
    00377          (SeCreatorGroupSid == NULL)        ||
    00378          (SeCreatorOwnerServerSid == NULL ) ||
    00379          (SeCreatorGroupServerSid == NULL )
    00380        ) {
    00381
    00382         return( FALSE );
    00383     }
    00384
    00385     RtlInitializeSid( SeNullSid,         &NullSidAuthority, 1 );
    00386     RtlInitializeSid( SeWorldSid,        &WorldSidAuthority, 1 );
    00387     RtlInitializeSid( SeLocalSid,        &LocalSidAuthority, 1 );
    00388     RtlInitializeSid( SeCreatorOwnerSid, &CreatorSidAuthority, 1 );
    00389     RtlInitializeSid( SeCreatorGroupSid, &CreatorSidAuthority, 1 );
    00390     RtlInitializeSid( SeCreatorOwnerServerSid, &CreatorSidAuthority, 1 );
    00391     RtlInitializeSid( SeCreatorGroupServerSid, &CreatorSidAuthority, 1 );
    00392
    00393     *(RtlSubAuthoritySid( SeNullSid, 0 ))         = SECURITY_NULL_RID;
    00394     *(RtlSubAuthoritySid( SeWorldSid, 0 ))        = SECURITY_WORLD_RID;
    00395     *(RtlSubAuthoritySid( SeLocalSid, 0 ))        = SECURITY_LOCAL_RID;
    00396     *(RtlSubAuthoritySid( SeCreatorOwnerSid, 0 )) = SECURITY_CREATOR_OWNER_RID;
    00397     *(RtlSubAuthoritySid( SeCreatorGroupSid, 0 )) = SECURITY_CREATOR_GROUP_RID;
    00398     *(RtlSubAuthoritySid( SeCreatorOwnerServerSid, 0 )) = SECURITY_CREATOR_OWNER_SERVER_RID;
    00399     *(RtlSubAuthoritySid( SeCreatorGroupServerSid, 0 )) = SECURITY_CREATOR_GROUP_SERVER_RID;
    00400
    00401     //
    00402     // Allocate and initialize the NT defined SIDs
    00403     //
    00404
    00405     SeNtAuthoritySid  = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithZeroSubAuthorities,'iSeS');
    00406     SeDialupSid       = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00407     SeNetworkSid      = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00408     SeBatchSid        = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00409     SeInteractiveSid  = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00410     SeServiceSid      = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00411     SePrincipalSelfSid      = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00412     SeLocalSystemSid  = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00413     SeAuthenticatedUsersSid  = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00414     SeRestrictedSid   = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00415     SeAnonymousLogonSid = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithOneSubAuthority,'iSeS');
    00416
    00417     SeAliasAdminsSid     = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithTwoSubAuthorities,'iSeS');
    00418     SeAliasUsersSid      = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithTwoSubAuthorities,'iSeS');
    00419     SeAliasGuestsSid     = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithTwoSubAuthorities,'iSeS');
    00420     SeAliasPowerUsersSid = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithTwoSubAuthorities,'iSeS');
    00421     SeAliasAccountOpsSid = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithTwoSubAuthorities,'iSeS');
    00422     SeAliasSystemOpsSid  = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithTwoSubAuthorities,'iSeS');
    00423     SeAliasPrintOpsSid   = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithTwoSubAuthorities,'iSeS');
    00424     SeAliasBackupOpsSid  = (PSID)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE,SidWithTwoSubAuthorities,'iSeS');
    00425
    00426     //
    00427     // Fail initialization if we didn't get enough memory for the NT SIDs.
    00428     //
    00429
    00430     if ( (SeNtAuthoritySid          == NULL) ||
    00431          (SeDialupSid               == NULL) ||
    00432          (SeNetworkSid              == NULL) ||
    00433          (SeBatchSid                == NULL) ||
    00434          (SeInteractiveSid          == NULL) ||
    00435          (SeServiceSid              == NULL) ||
    00436          (SePrincipalSelfSid        == NULL) ||
    00437          (SeLocalSystemSid          == NULL) ||
    00438          (SeAuthenticatedUsersSid   == NULL) ||
    00439          (SeRestrictedSid           == NULL) ||
    00440          (SeAnonymousLogonSid       == NULL) ||
    00441          (SeAliasAdminsSid          == NULL) ||
    00442          (SeAliasUsersSid           == NULL) ||
    00443          (SeAliasGuestsSid          == NULL) ||
    00444          (SeAliasPowerUsersSid      == NULL) ||
    00445          (SeAliasAccountOpsSid      == NULL) ||
    00446          (SeAliasSystemOpsSid       == NULL) ||
    00447          (SeAliasPrintOpsSid        == NULL) ||
    00448          (SeAliasBackupOpsSid       == NULL)
    00449        ) {
    00450
    00451         return( FALSE );
    00452     }
    00453
    00454     RtlInitializeSid( SeNtAuthoritySid,         &SeNtAuthority, 0 );
    00455     RtlInitializeSid( SeDialupSid,              &SeNtAuthority, 1 );
    00456     RtlInitializeSid( SeNetworkSid,             &SeNtAuthority, 1 );
    00457     RtlInitializeSid( SeBatchSid,               &SeNtAuthority, 1 );
    00458     RtlInitializeSid( SeInteractiveSid,         &SeNtAuthority, 1 );
    00459     RtlInitializeSid( SeServiceSid,             &SeNtAuthority, 1 );
    00460     RtlInitializeSid( SePrincipalSelfSid,       &SeNtAuthority, 1 );
    00461     RtlInitializeSid( SeLocalSystemSid,         &SeNtAuthority, 1 );
    00462     RtlInitializeSid( SeAuthenticatedUsersSid,  &SeNtAuthority, 1 );
    00463     RtlInitializeSid( SeRestrictedSid,          &SeNtAuthority, 1 );
    00464     RtlInitializeSid( SeAnonymousLogonSid,      &SeNtAuthority, 1 );
    00465
    00466     RtlInitializeSid( SeAliasAdminsSid,     &SeNtAuthority, 2);
    00467     RtlInitializeSid( SeAliasUsersSid,      &SeNtAuthority, 2);
    00468     RtlInitializeSid( SeAliasGuestsSid,     &SeNtAuthority, 2);
    00469     RtlInitializeSid( SeAliasPowerUsersSid, &SeNtAuthority, 2);
    00470     RtlInitializeSid( SeAliasAccountOpsSid, &SeNtAuthority, 2);
    00471     RtlInitializeSid( SeAliasSystemOpsSid,  &SeNtAuthority, 2);
    00472     RtlInitializeSid( SeAliasPrintOpsSid,   &SeNtAuthority, 2);
    00473     RtlInitializeSid( SeAliasBackupOpsSid,  &SeNtAuthority, 2);
    00474
    00475     *(RtlSubAuthoritySid( SeDialupSid,              0 )) = SECURITY_DIALUP_RID;
    00476     *(RtlSubAuthoritySid( SeNetworkSid,             0 )) = SECURITY_NETWORK_RID;
    00477     *(RtlSubAuthoritySid( SeBatchSid,               0 )) = SECURITY_BATCH_RID;
    00478     *(RtlSubAuthoritySid( SeInteractiveSid,         0 )) = SECURITY_INTERACTIVE_RID;
    00479     *(RtlSubAuthoritySid( SeServiceSid,             0 )) = SECURITY_SERVICE_RID;
    00480     *(RtlSubAuthoritySid( SePrincipalSelfSid,       0 )) = SECURITY_PRINCIPAL_SELF_RID;
    00481     *(RtlSubAuthoritySid( SeLocalSystemSid,         0 )) = SECURITY_LOCAL_SYSTEM_RID;
    00482     *(RtlSubAuthoritySid( SeAuthenticatedUsersSid,  0 )) = SECURITY_AUTHENTICATED_USER_RID;
    00483     *(RtlSubAuthoritySid( SeRestrictedSid,          0 )) = SECURITY_RESTRICTED_CODE_RID;
    00484     *(RtlSubAuthoritySid( SeAnonymousLogonSid,      0 )) = SECURITY_ANONYMOUS_LOGON_RID;
    00485
    00486
    00487     *(RtlSubAuthoritySid( SeAliasAdminsSid,     0 )) = SECURITY_BUILTIN_DOMAIN_RID;
    00488     *(RtlSubAuthoritySid( SeAliasUsersSid,      0 )) = SECURITY_BUILTIN_DOMAIN_RID;
    00489     *(RtlSubAuthoritySid( SeAliasGuestsSid,     0 )) = SECURITY_BUILTIN_DOMAIN_RID;
    00490     *(RtlSubAuthoritySid( SeAliasPowerUsersSid, 0 )) = SECURITY_BUILTIN_DOMAIN_RID;
    00491     *(RtlSubAuthoritySid( SeAliasAccountOpsSid, 0 )) = SECURITY_BUILTIN_DOMAIN_RID;
    00492     *(RtlSubAuthoritySid( SeAliasSystemOpsSid,  0 )) = SECURITY_BUILTIN_DOMAIN_RID;
    00493     *(RtlSubAuthoritySid( SeAliasPrintOpsSid,   0 )) = SECURITY_BUILTIN_DOMAIN_RID;
    00494     *(RtlSubAuthoritySid( SeAliasBackupOpsSid,  0 )) = SECURITY_BUILTIN_DOMAIN_RID;
    00495
    00496     *(RtlSubAuthoritySid( SeAliasAdminsSid,     1 )) = DOMAIN_ALIAS_RID_ADMINS;
    00497     *(RtlSubAuthoritySid( SeAliasUsersSid,      1 )) = DOMAIN_ALIAS_RID_USERS;
    00498     *(RtlSubAuthoritySid( SeAliasGuestsSid,     1 )) = DOMAIN_ALIAS_RID_GUESTS;
    00499     *(RtlSubAuthoritySid( SeAliasPowerUsersSid, 1 )) = DOMAIN_ALIAS_RID_POWER_USERS;
    00500     *(RtlSubAuthoritySid( SeAliasAccountOpsSid, 1 )) = DOMAIN_ALIAS_RID_ACCOUNT_OPS;
    00501     *(RtlSubAuthoritySid( SeAliasSystemOpsSid,  1 )) = DOMAIN_ALIAS_RID_SYSTEM_OPS;
    00502     *(RtlSubAuthoritySid( SeAliasPrintOpsSid,   1 )) = DOMAIN_ALIAS_RID_PRINT_OPS;
    00503     *(RtlSubAuthoritySid( SeAliasBackupOpsSid,  1 )) = DOMAIN_ALIAS_RID_BACKUP_OPS;
    00504
    00505
    00506
    00507     //
    00508     // Initialize system default dacl
    00509     //
    00510
    00511     SepInitSystemDacls();
    00512
    00513
    00514     //
    00515     // Initialize the well known privilege values
    00516     //
    00517
    00518     SeCreateTokenPrivilege =
    00519         RtlConvertLongToLuid(SE_CREATE_TOKEN_PRIVILEGE);
    00520     SeAssignPrimaryTokenPrivilege =
    00521         RtlConvertLongToLuid(SE_ASSIGNPRIMARYTOKEN_PRIVILEGE);
    00522     SeLockMemoryPrivilege =
    00523         RtlConvertLongToLuid(SE_LOCK_MEMORY_PRIVILEGE);
    00524     SeIncreaseQuotaPrivilege =
    00525         RtlConvertLongToLuid(SE_INCREASE_QUOTA_PRIVILEGE);
    00526     SeUnsolicitedInputPrivilege =
    00527         RtlConvertLongToLuid(SE_UNSOLICITED_INPUT_PRIVILEGE);
    00528     SeTcbPrivilege =
    00529         RtlConvertLongToLuid(SE_TCB_PRIVILEGE);
    00530     SeSecurityPrivilege =
    00531         RtlConvertLongToLuid(SE_SECURITY_PRIVILEGE);
    00532     SeTakeOwnershipPrivilege =
    00533         RtlConvertLongToLuid(SE_TAKE_OWNERSHIP_PRIVILEGE);
    00534     SeLoadDriverPrivilege =
    00535         RtlConvertLongToLuid(SE_LOAD_DRIVER_PRIVILEGE);
    00536     SeCreatePagefilePrivilege =
    00537         RtlConvertLongToLuid(SE_CREATE_PAGEFILE_PRIVILEGE);
    00538     SeIncreaseBasePriorityPrivilege =
    00539         RtlConvertLongToLuid(SE_INC_BASE_PRIORITY_PRIVILEGE);
    00540     SeSystemProfilePrivilege =
    00541         RtlConvertLongToLuid(SE_SYSTEM_PROFILE_PRIVILEGE);
    00542     SeSystemtimePrivilege =
    00543         RtlConvertLongToLuid(SE_SYSTEMTIME_PRIVILEGE);
    00544     SeProfileSingleProcessPrivilege =
    00545         RtlConvertLongToLuid(SE_PROF_SINGLE_PROCESS_PRIVILEGE);
    00546     SeCreatePermanentPrivilege =
    00547         RtlConvertLongToLuid(SE_CREATE_PERMANENT_PRIVILEGE);
    00548     SeBackupPrivilege =
    00549         RtlConvertLongToLuid(SE_BACKUP_PRIVILEGE);
    00550     SeRestorePrivilege =
    00551         RtlConvertLongToLuid(SE_RESTORE_PRIVILEGE);
    00552     SeShutdownPrivilege =
    00553         RtlConvertLongToLuid(SE_SHUTDOWN_PRIVILEGE);
    00554     SeDebugPrivilege =
    00555         RtlConvertLongToLuid(SE_DEBUG_PRIVILEGE);
    00556     SeAuditPrivilege =
    00557         RtlConvertLongToLuid(SE_AUDIT_PRIVILEGE);
    00558     SeSystemEnvironmentPrivilege =
    00559         RtlConvertLongToLuid(SE_SYSTEM_ENVIRONMENT_PRIVILEGE);
    00560     SeChangeNotifyPrivilege =
    00561         RtlConvertLongToLuid(SE_CHANGE_NOTIFY_PRIVILEGE);
    00562     SeRemoteShutdownPrivilege =
    00563         RtlConvertLongToLuid(SE_REMOTE_SHUTDOWN_PRIVILEGE);
    00564     SeUndockPrivilege =
    00565         RtlConvertLongToLuid(SE_UNDOCK_PRIVILEGE);
    00566     SeSyncAgentPrivilege =
    00567         RtlConvertLongToLuid(SE_SYNC_AGENT_PRIVILEGE);
    00568     SeEnableDelegationPrivilege =
    00569         RtlConvertLongToLuid(SE_ENABLE_DELEGATION_PRIVILEGE);
    00570
    00571
    00572     //
    00573     // Initialize the SeExports structure for exporting all
    00574     // of the information we've created out of the kernel.
    00575     //
    00576
    00577     //
    00578     // Package these together for export
    00579     //
    00580
    00581
    00582     SepExports.SeNullSid         = SeNullSid;
    00583     SepExports.SeWorldSid        = SeWorldSid;
    00584     SepExports.SeLocalSid        = SeLocalSid;
    00585     SepExports.SeCreatorOwnerSid = SeCreatorOwnerSid;
    00586     SepExports.SeCreatorGroupSid = SeCreatorGroupSid;
    00587
    00588
    00589     SepExports.SeNtAuthoritySid         = SeNtAuthoritySid;
    00590     SepExports.SeDialupSid              = SeDialupSid;
    00591     SepExports.SeNetworkSid             = SeNetworkSid;
    00592     SepExports.SeBatchSid               = SeBatchSid;
    00593     SepExports.SeInteractiveSid         = SeInteractiveSid;
    00594     SepExports.SeLocalSystemSid         = SeLocalSystemSid;
    00595     SepExports.SeAuthenticatedUsersSid  = SeAuthenticatedUsersSid;
    00596     SepExports.SeRestrictedSid          = SeRestrictedSid;
    00597     SepExports.SeAnonymousLogonSid      = SeAnonymousLogonSid;
    00598     SepExports.SeAliasAdminsSid         = SeAliasAdminsSid;
    00599     SepExports.SeAliasUsersSid          = SeAliasUsersSid;
    00600     SepExports.SeAliasGuestsSid         = SeAliasGuestsSid;
    00601     SepExports.SeAliasPowerUsersSid     = SeAliasPowerUsersSid;
    00602     SepExports.SeAliasAccountOpsSid     = SeAliasAccountOpsSid;
    00603     SepExports.SeAliasSystemOpsSid      = SeAliasSystemOpsSid;
    00604     SepExports.SeAliasPrintOpsSid       = SeAliasPrintOpsSid;
    00605     SepExports.SeAliasBackupOpsSid      = SeAliasBackupOpsSid;
    00606
    00607
    00608
    00609     SepExports.SeCreateTokenPrivilege          = SeCreateTokenPrivilege;
    00610     SepExports.SeAssignPrimaryTokenPrivilege   = SeAssignPrimaryTokenPrivilege;
    00611     SepExports.SeLockMemoryPrivilege           = SeLockMemoryPrivilege;
    00612     SepExports.SeIncreaseQuotaPrivilege        = SeIncreaseQuotaPrivilege;
    00613     SepExports.SeUnsolicitedInputPrivilege     = SeUnsolicitedInputPrivilege;
    00614     SepExports.SeTcbPrivilege                  = SeTcbPrivilege;
    00615     SepExports.SeSecurityPrivilege             = SeSecurityPrivilege;
    00616     SepExports.SeTakeOwnershipPrivilege        = SeTakeOwnershipPrivilege;
    00617     SepExports.SeLoadDriverPrivilege           = SeLoadDriverPrivilege;
    00618     SepExports.SeCreatePagefilePrivilege       = SeCreatePagefilePrivilege;
    00619     SepExports.SeIncreaseBasePriorityPrivilege = SeIncreaseBasePriorityPrivilege;
    00620     SepExports.SeSystemProfilePrivilege        = SeSystemProfilePrivilege;
    00621     SepExports.SeSystemtimePrivilege           = SeSystemtimePrivilege;
    00622     SepExports.SeProfileSingleProcessPrivilege = SeProfileSingleProcessPrivilege;
    00623     SepExports.SeCreatePermanentPrivilege      = SeCreatePermanentPrivilege;
    00624     SepExports.SeBackupPrivilege               = SeBackupPrivilege;
    00625     SepExports.SeRestorePrivilege              = SeRestorePrivilege;
    00626     SepExports.SeShutdownPrivilege             = SeShutdownPrivilege;
    00627     SepExports.SeDebugPrivilege                = SeDebugPrivilege;
    00628     SepExports.SeAuditPrivilege                = SeAuditPrivilege;
    00629     SepExports.SeSystemEnvironmentPrivilege    = SeSystemEnvironmentPrivilege;
    00630     SepExports.SeChangeNotifyPrivilege         = SeChangeNotifyPrivilege;
    00631     SepExports.SeRemoteShutdownPrivilege       = SeRemoteShutdownPrivilege;
    00632     SepExports.SeUndockPrivilege               = SeUndockPrivilege;
    00633     SepExports.SeSyncAgentPrivilege            = SeSyncAgentPrivilege;
    00634     SepExports.SeEnableDelegationPrivilege     = SeEnableDelegationPrivilege;
    00635
    00636
    00637     SeExports = &SepExports;
    00638
    00639     //
    00640     // Initialize frequently used privilege sets to speed up access
    00641     // validation.
    00642     //
    00643
    00644     SepInitializePrivilegeSets();
    00645
    00646     return TRUE;
    00647
    00648 }
    00649
    00650 VOID
    00651 SepInitSystemDacls( VOID )
    00652 /*++
    00653
    00654 Routine Description:
    00655
    00656     This function initializes the system's default dacls & security
    00657     descriptors.
    00658
    00659 Arguments:
    00660
    00661     None.
    00662
    00663 Return Value:
    00664
    00665     None.
    00666
    00667
    00668 --*/
    00669 {
    00670
    00671     NTSTATUS
    00672         Status;
    00673
    00674     ULONG
    00675         PublicLength,
    00676         PublicUnrestrictedLength,
    00677         SystemLength,
    00678         PublicOpenLength,
    00679         UnrestrictedLength;
    00680
    00681
    00682     PAGED_CODE();
    00683
    00684     //
    00685     // Set up a default ACLs
    00686     //
    00687     //    Public:       WORLD:execute, SYSTEM:all, ADMINS:all
    00688     //    PublicUnrestricted: WORLD:execute, SYSTEM:all, ADMINS:all, Restricted:execute
    00689     //    Public Open:  WORLD:(Read|Write|Execute), ADMINS:(all), SYSTEM:all
    00690     //    System:       SYSTEM:all, ADMINS:(read|execute|read_control)
    00691     //    Unrestricted: WORLD:(all), Restricted:(all)
    00692
    00693     SystemLength = (ULONG)sizeof(ACL) +
    00694                    (2*((ULONG)sizeof(ACCESS_ALLOWED_ACE))) +
    00695                    SeLengthSid( SeLocalSystemSid ) +
    00696                    SeLengthSid( SeAliasAdminsSid ) +
    00697                    8; // The 8 is just for good measure
    00698
    00699     PublicLength = SystemLength +
    00700                    ((ULONG)sizeof(ACCESS_ALLOWED_ACE)) +
    00701                    SeLengthSid( SeWorldSid );
    00702
    00703     PublicUnrestrictedLength = SystemLength +
    00704                    ((ULONG)sizeof(ACCESS_ALLOWED_ACE)) +
    00705                    SeLengthSid( SeRestrictedSid );
    00706
    00707     PublicOpenLength = PublicLength;
    00708
    00709     UnrestrictedLength = (ULONG)sizeof(ACL) +
    00710                    (2*((ULONG)sizeof(ACCESS_ALLOWED_ACE))) +
    00711                    SeLengthSid( SeWorldSid ) +
    00712                    SeLengthSid( SeRestrictedSid ) +
    00713                    8; // The 8 is just for good measure
    00714
    00715
    00716     SePublicDefaultDacl = (PACL)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE, PublicLength, 'cAeS');
    00717     SePublicDefaultUnrestrictedDacl = (PACL)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE, PublicUnrestrictedLength, 'cAeS');
    00718     SePublicOpenDacl = (PACL)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE, PublicOpenLength, 'cAeS');
    00719     SePublicOpenUnrestrictedDacl = (PACL)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE, PublicUnrestrictedLength, 'cAeS');
    00720     SeSystemDefaultDacl = (PACL)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE, SystemLength, 'cAeS');
    00721     SeUnrestrictedDacl = (PACL)ExAllocatePoolWithTag(PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE, UnrestrictedLength, 'cAeS');
    00722     ASSERT(SePublicDefaultDacl != NULL);
    00723     ASSERT(SePublicDefaultUnrestrictedDacl != NULL);
    00724     ASSERT(SePublicOpenDacl    != NULL);
    00725     ASSERT(SePublicOpenUnrestrictedDacl    != NULL);
    00726     ASSERT(SeSystemDefaultDacl != NULL);
    00727     ASSERT(SeUnrestrictedDacl != NULL);
    00728
    00729
    00730
    00731     Status = RtlCreateAcl( SePublicDefaultDacl, PublicLength, ACL_REVISION2);
    00732     ASSERT( NT_SUCCESS(Status) );
    00733     Status = RtlCreateAcl( SePublicDefaultUnrestrictedDacl, PublicUnrestrictedLength, ACL_REVISION2);
    00734     ASSERT( NT_SUCCESS(Status) );
    00735     Status = RtlCreateAcl( SePublicOpenDacl, PublicUnrestrictedLength, ACL_REVISION2);
    00736     ASSERT( NT_SUCCESS(Status) );
    00737     Status = RtlCreateAcl( SePublicOpenUnrestrictedDacl, PublicOpenLength, ACL_REVISION2);
    00738     ASSERT( NT_SUCCESS(Status) );
    00739     Status = RtlCreateAcl( SeSystemDefaultDacl, SystemLength, ACL_REVISION2);
    00740     ASSERT( NT_SUCCESS(Status) );
    00741     Status = RtlCreateAcl( SeUnrestrictedDacl, UnrestrictedLength, ACL_REVISION2);
    00742     ASSERT( NT_SUCCESS(Status) );
    00743
    00744
    00745     //
    00746     // WORLD access (Public DACLs and Unrestricted only)
    00747     //
    00748
    00749     Status = RtlAddAccessAllowedAce (
    00750                  SePublicDefaultDacl,
    00751                  ACL_REVISION2,
    00752                  GENERIC_EXECUTE,
    00753                  SeWorldSid
    00754                  );
    00755     ASSERT( NT_SUCCESS(Status) );
    00756
    00757     Status = RtlAddAccessAllowedAce (
    00758                  SePublicDefaultUnrestrictedDacl,
    00759                  ACL_REVISION2,
    00760                  GENERIC_EXECUTE,
    00761                  SeWorldSid
    00762                  );
    00763     ASSERT( NT_SUCCESS(Status) );
    00764
    00765     Status = RtlAddAccessAllowedAce (
    00766                  SePublicOpenDacl,
    00767                  ACL_REVISION2,
    00768                  (GENERIC_READ | GENERIC_WRITE  | GENERIC_EXECUTE),
    00769                  SeWorldSid
    00770                  );
    00771     ASSERT( NT_SUCCESS(Status) );
    00772
    00773     Status = RtlAddAccessAllowedAce (
    00774                  SePublicOpenUnrestrictedDacl,
    00775                  ACL_REVISION2,
    00776                  (GENERIC_READ | GENERIC_WRITE  | GENERIC_EXECUTE),
    00777                  SeWorldSid
    00778                  );
    00779     ASSERT( NT_SUCCESS(Status) );
    00780
    00781     Status = RtlAddAccessAllowedAce (
    00782                  SeUnrestrictedDacl,
    00783                  ACL_REVISION2,
    00784                  GENERIC_ALL,
    00785                  SeWorldSid
    00786                  );
    00787     ASSERT( NT_SUCCESS(Status) );
    00788
    00789
    00790
    00791     //
    00792     // SYSTEM access  (PublicDefault, PublicOpen, and SystemDefault)
    00793     //
    00794
    00795
    00796     Status = RtlAddAccessAllowedAce (
    00797                  SePublicDefaultDacl,
    00798                  ACL_REVISION2,
    00799                  GENERIC_ALL,
    00800                  SeLocalSystemSid
    00801                  );
    00802     ASSERT( NT_SUCCESS(Status) );
    00803
    00804
    00805     Status = RtlAddAccessAllowedAce (
    00806                  SePublicDefaultUnrestrictedDacl,
    00807                  ACL_REVISION2,
    00808                  GENERIC_ALL,
    00809                  SeLocalSystemSid
    00810                  );
    00811     ASSERT( NT_SUCCESS(Status) );
    00812
    00813
    00814     Status = RtlAddAccessAllowedAce (
    00815                  SePublicOpenDacl,
    00816                  ACL_REVISION2,
    00817                  GENERIC_ALL,
    00818                  SeLocalSystemSid
    00819                  );
    00820     ASSERT( NT_SUCCESS(Status) );
    00821
    00822     Status = RtlAddAccessAllowedAce (
    00823                  SePublicOpenUnrestrictedDacl,
    00824                  ACL_REVISION2,
    00825                  GENERIC_ALL,
    00826                  SeLocalSystemSid
    00827                  );
    00828     ASSERT( NT_SUCCESS(Status) );
    00829
    00830
    00831     Status = RtlAddAccessAllowedAce (
    00832                  SeSystemDefaultDacl,
    00833                  ACL_REVISION2,
    00834                  GENERIC_ALL,
    00835                  SeLocalSystemSid
    00836                  );
    00837     ASSERT( NT_SUCCESS(Status) );
    00838
    00839     //
    00840     // ADMINISTRATORS access  (PublicDefault, PublicOpen, and SystemDefault)
    00841     //
    00842
    00843     Status = RtlAddAccessAllowedAce (
    00844                  SePublicDefaultDacl,
    00845                  ACL_REVISION2,
    00846                  GENERIC_ALL,
    00847                  SeAliasAdminsSid
    00848                  );
    00849     ASSERT( NT_SUCCESS(Status) );
    00850
    00851
    00852     Status = RtlAddAccessAllowedAce (
    00853                  SePublicDefaultUnrestrictedDacl,
    00854                  ACL_REVISION2,
    00855                  GENERIC_ALL,
    00856                  SeAliasAdminsSid
    00857                  );
    00858     ASSERT( NT_SUCCESS(Status) );
    00859
    00860
    00861     Status = RtlAddAccessAllowedAce (
    00862                  SePublicOpenDacl,
    00863                  ACL_REVISION2,
    00864                  GENERIC_ALL,
    00865                  SeAliasAdminsSid
    00866                  );
    00867     ASSERT( NT_SUCCESS(Status) );
    00868
    00869
    00870     Status = RtlAddAccessAllowedAce (
    00871                  SePublicOpenUnrestrictedDacl,
    00872                  ACL_REVISION2,
    00873                  GENERIC_ALL,
    00874                  SeAliasAdminsSid
    00875                  );
    00876     ASSERT( NT_SUCCESS(Status) );
    00877
    00878
    00879     Status = RtlAddAccessAllowedAce (
    00880                  SeSystemDefaultDacl,
    00881                  ACL_REVISION2,
    00882                  GENERIC_READ | GENERIC_EXECUTE | READ_CONTROL,
    00883                  SeAliasAdminsSid
    00884                  );
    00885     ASSERT( NT_SUCCESS(Status) );
    00886
    00887     //
    00888     // RESTRICTED access  (PublicDefaultUnrestricted and Unrestricted)
    00889     //
    00890
    00891     Status = RtlAddAccessAllowedAce (
    00892                  SePublicDefaultUnrestrictedDacl,
    00893                  ACL_REVISION2,
    00894                  GENERIC_EXECUTE,
    00895                  SeRestrictedSid
    00896                  );
    00897     ASSERT( NT_SUCCESS(Status) );
    00898
    00899     Status = RtlAddAccessAllowedAce (
    00900                  SePublicOpenUnrestrictedDacl,
    00901                  ACL_REVISION2,
    00902                  GENERIC_EXECUTE | GENERIC_READ,
    00903                  SeRestrictedSid
    00904                  );
    00905     ASSERT( NT_SUCCESS(Status) );
    00906
    00907     Status = RtlAddAccessAllowedAce (
    00908                  SeUnrestrictedDacl,
    00909                  ACL_REVISION2,
    00910                  GENERIC_ALL,
    00911                  SeRestrictedSid
    00912                  );
    00913     ASSERT( NT_SUCCESS(Status) );
    00914
    00915
    00916
    00917
    00918     //
    00919     // Now initialize security descriptors
    00920     // that export this protection
    00921     //
    00922
    00923
    00924     SePublicDefaultSd = (PSECURITY_DESCRIPTOR)&SepPublicDefaultSd;
    00925     Status = RtlCreateSecurityDescriptor(
    00926                  SePublicDefaultSd,
    00927                  SECURITY_DESCRIPTOR_REVISION1
    00928                  );
    00929     ASSERT( NT_SUCCESS(Status) );
    00930     Status = RtlSetDaclSecurityDescriptor(
    00931                  SePublicDefaultSd,
    00932                  TRUE,                       // DaclPresent
    00933                  SePublicDefaultDacl,
    00934                  FALSE                       // DaclDefaulted
    00935                  );
    00936     ASSERT( NT_SUCCESS(Status) );
    00937
    00938
    00939     SePublicDefaultUnrestrictedSd = (PSECURITY_DESCRIPTOR)&SepPublicDefaultUnrestrictedSd;
    00940     Status = RtlCreateSecurityDescriptor(
    00941                  SePublicDefaultUnrestrictedSd,
    00942                  SECURITY_DESCRIPTOR_REVISION1
    00943                  );
    00944     ASSERT( NT_SUCCESS(Status) );
    00945     Status = RtlSetDaclSecurityDescriptor(
    00946                  SePublicDefaultUnrestrictedSd,
    00947                  TRUE,                       // DaclPresent
    00948                  SePublicDefaultUnrestrictedDacl,
    00949                  FALSE                       // DaclDefaulted
    00950                  );
    00951     ASSERT( NT_SUCCESS(Status) );
    00952
    00953
    00954     SePublicOpenSd = (PSECURITY_DESCRIPTOR)&SepPublicOpenSd;
    00955     Status = RtlCreateSecurityDescriptor(
    00956                  SePublicOpenSd,
    00957                  SECURITY_DESCRIPTOR_REVISION1
    00958                  );
    00959     ASSERT( NT_SUCCESS(Status) );
    00960     Status = RtlSetDaclSecurityDescriptor(
    00961                  SePublicOpenSd,
    00962                  TRUE,                       // DaclPresent
    00963                  SePublicOpenDacl,
    00964                  FALSE                       // DaclDefaulted
    00965                  );
    00966     ASSERT( NT_SUCCESS(Status) );
    00967
    00968
    00969     SePublicOpenUnrestrictedSd = (PSECURITY_DESCRIPTOR)&SepPublicOpenUnrestrictedSd;
    00970     Status = RtlCreateSecurityDescriptor(
    00971                  SePublicOpenUnrestrictedSd,
    00972                  SECURITY_DESCRIPTOR_REVISION1
    00973                  );
    00974     ASSERT( NT_SUCCESS(Status) );
    00975     Status = RtlSetDaclSecurityDescriptor(
    00976                  SePublicOpenUnrestrictedSd,
    00977                  TRUE,                       // DaclPresent
    00978                  SePublicOpenUnrestrictedDacl,
    00979                  FALSE                       // DaclDefaulted
    00980                  );
    00981     ASSERT( NT_SUCCESS(Status) );
    00982
    00983
    00984     SeSystemDefaultSd = (PSECURITY_DESCRIPTOR)&SepSystemDefaultSd;
    00985     Status = RtlCreateSecurityDescriptor(
    00986                  SeSystemDefaultSd,
    00987                  SECURITY_DESCRIPTOR_REVISION1
    00988                  );
    00989     ASSERT( NT_SUCCESS(Status) );
    00990     Status = RtlSetDaclSecurityDescriptor(
    00991                  SeSystemDefaultSd,
    00992                  TRUE,                       // DaclPresent
    00993                  SeSystemDefaultDacl,
    00994                  FALSE                       // DaclDefaulted
    00995                  );
    00996     ASSERT( NT_SUCCESS(Status) );
    00997
    00998     SeUnrestrictedSd = (PSECURITY_DESCRIPTOR)&SepUnrestrictedSd;
    00999     Status = RtlCreateSecurityDescriptor(
    01000                  SeUnrestrictedSd,
    01001                  SECURITY_DESCRIPTOR_REVISION1
    01002                  );
    01003     ASSERT( NT_SUCCESS(Status) );
    01004     Status = RtlSetDaclSecurityDescriptor(
    01005                  SeUnrestrictedSd,
    01006                  TRUE,                       // DaclPresent
    01007                  SeUnrestrictedDacl,
    01008                  FALSE                       // DaclDefaulted
    01009                  );
    01010     ASSERT( NT_SUCCESS(Status) );
    01011
    01012
    01013     return;
    01014
    01015 }
    01016
    01017
    01018 VOID
    01019 SepInitializePrivilegeSets( VOID )
    01020 /*++
    01021
    01022 Routine Description:
    01023
    01024     This routine is called once during system initialization to pre-allocate
    01025     and initialize some commonly used privilege sets.
    01026
    01027 Arguments:
    01028
    01029     None
    01030
    01031 Return Value:
    01032
    01033     None.
    01034
    01035 --*/
    01036 {
    01037     PAGED_CODE();
    01038
    01039     SinglePrivilegeSetSize = sizeof( PRIVILEGE_SET );
    01040     DoublePrivilegeSetSize = sizeof( PRIVILEGE_SET ) +
    01041                                 (ULONG)sizeof( LUID_AND_ATTRIBUTES );
    01042
    01043     SepSystemSecurityPrivilegeSet = ExAllocatePoolWithTag( PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE, SinglePrivilegeSetSize, 'rPeS' );
    01044     SepTakeOwnershipPrivilegeSet  = ExAllocatePoolWithTag( PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE, SinglePrivilegeSetSize, 'rPeS' );
    01045     SepDoublePrivilegeSet         = ExAllocatePoolWithTag( PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE, DoublePrivilegeSetSize, 'rPeS' );
    01046
    01047     SepSystemSecurityPrivilegeSet->PrivilegeCount = 1;
    01048     SepSystemSecurityPrivilegeSet->Control = 0;
    01049     SepSystemSecurityPrivilegeSet->Privilege[0].Luid = SeSecurityPrivilege;
    01050     SepSystemSecurityPrivilegeSet->Privilege[0].Attributes = SE_PRIVILEGE_USED_FOR_ACCESS;
    01051
    01052     SepTakeOwnershipPrivilegeSet->PrivilegeCount = 1;
    01053     SepTakeOwnershipPrivilegeSet->Control = 0;
    01054     SepTakeOwnershipPrivilegeSet->Privilege[0].Luid = SeTakeOwnershipPrivilege;
    01055     SepTakeOwnershipPrivilegeSet->Privilege[0].Attributes = SE_PRIVILEGE_USED_FOR_ACCESS;
    01056
    01057     SepDoublePrivilegeSet->PrivilegeCount = 2;
    01058     SepDoublePrivilegeSet->Control = 0;
    01059
    01060     SepDoublePrivilegeSet->Privilege[0].Luid = SeSecurityPrivilege;
    01061     SepDoublePrivilegeSet->Privilege[0].Attributes = SE_PRIVILEGE_USED_FOR_ACCESS;
    01062
    01063     SepDoublePrivilegeSet->Privilege[1].Luid = SeTakeOwnershipPrivilege;
    01064     SepDoublePrivilegeSet->Privilege[1].Attributes = SE_PRIVILEGE_USED_FOR_ACCESS;
    01065
    01066 }
    01067
    01068
    01069
    01070 VOID
    01071 SepAssemblePrivileges(
    01072     IN ULONG PrivilegeCount,
    01073     IN BOOLEAN SystemSecurity,
    01074     IN BOOLEAN WriteOwner,
    01075     OUT PPRIVILEGE_SET *Privileges
    01076     )
    01077 /*++
    01078
    01079 Routine Description:
    01080
    01081     This routine takes the results of the various privilege checks
    01082     in SeAccessCheck and returns an appropriate privilege set.
    01083
    01084 Arguments:
    01085
    01086     PrivilegeCount - The number of privileges granted.
    01087
    01088     SystemSecurity - Provides a boolean indicating whether to put
    01089         SeSecurityPrivilege into the output privilege set.
    01090
    01091     WriteOwner - Provides a boolean indicating whether to put
    01092         SeTakeOwnershipPrivilege into the output privilege set.
    01093
    01094     Privileges - Supplies a pointer that will return the privilege
    01095         set.  Should be freed with ExFreePool when no longer needed.
    01096
    01097 Return Value:
    01098
    01099     None.
    01100
    01101 --*/
    01102 {
    01103     PPRIVILEGE_SET PrivilegeSet;
    01104     ULONG SizeRequired;
    01105
    01106     PAGED_CODE();
    01107
    01108     ASSERT( (PrivilegeCount != 0) && (PrivilegeCount <= 2) );
    01109
    01110     if ( !ARGUMENT_PRESENT( Privileges ) ) {
    01111         return;
    01112     }
    01113
    01114     if ( PrivilegeCount == 1 ) {
    01115
    01116         SizeRequired = SinglePrivilegeSetSize;
    01117
    01118         if ( SystemSecurity ) {
    01119
    01120             PrivilegeSet = SepSystemSecurityPrivilegeSet;
    01121
    01122         } else {
    01123
    01124             ASSERT( WriteOwner );
    01125
    01126             PrivilegeSet = SepTakeOwnershipPrivilegeSet;
    01127         }
    01128
    01129     } else {
    01130
    01131         SizeRequired = DoublePrivilegeSetSize;
    01132         PrivilegeSet = SepDoublePrivilegeSet;
    01133     }
    01134
    01135     *Privileges = ExAllocatePoolWithTag( PagedPool | POOL_RAISE_IF_ALLOCATION_FAILURE, SizeRequired, 'rPeS' );
    01136
    01137     if ( *Privileges != NULL ) {
    01138
    01139         RtlCopyMemory (
    01140            *Privileges,
    01141            PrivilegeSet,
    01142            SizeRequired
    01143            );
    01144     }
    01145 }
    01146
    01147
    01148
    01149
    01150
    01151 BOOLEAN
    01152 SepInitializeWorkList(
    01153     VOID
    01154     )
    01155
    01156 /*++
    01157
    01158 Routine Description:
    01159
    01160     Initializes the mutex and list head used to queue work from the
    01161     Executive to LSA.  This mechanism operates on top of the normal ExWorkerThread
    01162     mechanism by capturing the first thread to perform LSA work and keeping it
    01163     until all the current work is done.
    01164
    01165     The reduces the number of worker threads that are blocked on I/O to LSA.
    01166
    01167 Arguments:
    01168
    01169     None.
    01170
    01171
    01172 Return Value:
    01173
    01174     TRUE if successful, FALSE otherwise.
    01175
    01176 --*/
    01177
    01178 {
    01179     PAGED_CODE();
    01180
    01181     ExInitializeResource(&SepLsaQueueLock);
    01182     InitializeListHead(&SepLsaQueue);
    01183     return( TRUE );
    01184 }