2000-02-18 03:38:33 +08:00
|
|
|
/* security.cc: NT security functions
|
|
|
|
|
2001-09-12 04:01:02 +08:00
|
|
|
Copyright 1997, 1998, 1999, 2000, 2001 Red Hat, Inc.
|
2000-02-18 03:38:33 +08:00
|
|
|
|
|
|
|
Originaly written by Gunther Ebert, gunther.ebert@ixos-leipzig.de
|
2001-02-22 06:59:11 +08:00
|
|
|
Completely rewritten by Corinna Vinschen <corinna@vinschen.de>
|
2000-02-18 03:38:33 +08:00
|
|
|
|
|
|
|
This file is part of Cygwin.
|
|
|
|
|
|
|
|
This software is a copyrighted work licensed under the terms of the
|
|
|
|
Cygwin license. Please consult the file "CYGWIN_LICENSE" for
|
|
|
|
details. */
|
|
|
|
|
2000-08-03 00:28:18 +08:00
|
|
|
#include "winsup.h"
|
2000-02-18 03:38:33 +08:00
|
|
|
#include <grp.h>
|
|
|
|
#include <pwd.h>
|
|
|
|
#include <unistd.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <errno.h>
|
|
|
|
#include <limits.h>
|
|
|
|
#include <sys/types.h>
|
|
|
|
#include <sys/stat.h>
|
|
|
|
#include <sys/acl.h>
|
|
|
|
#include <ctype.h>
|
2001-05-30 04:43:40 +08:00
|
|
|
#include <winnls.h>
|
2000-12-10 08:45:12 +08:00
|
|
|
#include <wingdi.h>
|
|
|
|
#include <winuser.h>
|
2001-05-01 05:19:42 +08:00
|
|
|
#include <wininet.h>
|
|
|
|
#include <ntsecapi.h>
|
|
|
|
#include <subauth.h>
|
2000-08-22 13:10:20 +08:00
|
|
|
#include "cygerrno.h"
|
2001-03-05 14:28:25 +08:00
|
|
|
#include "perprocess.h"
|
2001-07-27 03:22:24 +08:00
|
|
|
#include "security.h"
|
2000-08-22 13:10:20 +08:00
|
|
|
#include "fhandler.h"
|
|
|
|
#include "path.h"
|
2000-08-12 13:35:42 +08:00
|
|
|
#include "dtable.h"
|
2000-08-22 13:10:20 +08:00
|
|
|
#include "sync.h"
|
|
|
|
#include "sigproc.h"
|
2000-08-12 13:35:42 +08:00
|
|
|
#include "pinfo.h"
|
2000-11-15 08:13:09 +08:00
|
|
|
#include "cygheap.h"
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
#include <ntdef.h>
|
|
|
|
#include "ntdll.h"
|
|
|
|
#include "lm.h"
|
|
|
|
|
2000-02-18 03:38:33 +08:00
|
|
|
|
|
|
|
extern BOOL allow_ntea;
|
2001-09-06 11:39:18 +08:00
|
|
|
BOOL allow_ntsec;
|
2000-12-20 03:52:57 +08:00
|
|
|
/* allow_smbntsec is handled exclusively in path.cc (path_conv::check).
|
|
|
|
It's defined here because of it's strong relationship to allow_ntsec.
|
|
|
|
The default is TRUE to reflect the old behaviour. */
|
|
|
|
BOOL allow_smbntsec = TRUE;
|
2000-02-18 03:38:33 +08:00
|
|
|
|
2000-06-17 03:36:07 +08:00
|
|
|
extern "C"
|
|
|
|
void
|
|
|
|
cygwin_set_impersonation_token (const HANDLE hToken)
|
|
|
|
{
|
|
|
|
debug_printf ("set_impersonation_token (%d)", hToken);
|
2000-11-16 05:04:02 +08:00
|
|
|
if (cygheap->user.token != hToken)
|
2000-06-17 03:36:07 +08:00
|
|
|
{
|
2000-11-16 05:04:02 +08:00
|
|
|
cygheap->user.token = hToken;
|
|
|
|
cygheap->user.impersonated = FALSE;
|
2000-06-17 03:36:07 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
void
|
2001-05-01 05:19:42 +08:00
|
|
|
extract_nt_dom_user (const struct passwd *pw, char *domain, char *user)
|
|
|
|
{
|
2001-05-30 04:43:40 +08:00
|
|
|
cygsid psid;
|
|
|
|
DWORD ulen = UNLEN + 1;
|
|
|
|
DWORD dlen = INTERNET_MAX_HOST_NAME_LENGTH + 1;
|
|
|
|
SID_NAME_USE use;
|
2001-05-01 05:19:42 +08:00
|
|
|
char buf[INTERNET_MAX_HOST_NAME_LENGTH + UNLEN + 2];
|
|
|
|
char *c;
|
|
|
|
|
|
|
|
strcpy (domain, "");
|
|
|
|
strcpy (buf, pw->pw_name);
|
|
|
|
debug_printf ("pw_gecos = %x (%s)", pw->pw_gecos, pw->pw_gecos);
|
2001-05-30 04:43:40 +08:00
|
|
|
|
|
|
|
if (psid.getfrompw (pw) &&
|
|
|
|
LookupAccountSid (NULL, psid, user, &ulen, domain, &dlen, &use))
|
|
|
|
return;
|
|
|
|
|
2001-05-01 05:19:42 +08:00
|
|
|
if (pw->pw_gecos)
|
|
|
|
{
|
|
|
|
if ((c = strstr (pw->pw_gecos, "U-")) != NULL &&
|
2001-09-08 05:32:07 +08:00
|
|
|
(c == pw->pw_gecos || c[-1] == ','))
|
2001-05-01 05:19:42 +08:00
|
|
|
{
|
|
|
|
buf[0] = '\0';
|
|
|
|
strncat (buf, c + 2, INTERNET_MAX_HOST_NAME_LENGTH + UNLEN + 1);
|
|
|
|
if ((c = strchr (buf, ',')) != NULL)
|
|
|
|
*c = '\0';
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if ((c = strchr (buf, '\\')) != NULL)
|
|
|
|
{
|
|
|
|
*c++ = '\0';
|
|
|
|
strcpy (domain, buf);
|
|
|
|
strcpy (user, c);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
strcpy (domain, "");
|
|
|
|
strcpy (user, buf);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2000-06-17 03:36:07 +08:00
|
|
|
extern "C"
|
|
|
|
HANDLE
|
|
|
|
cygwin_logon_user (const struct passwd *pw, const char *password)
|
|
|
|
{
|
* Makefile.in: Build wincap.o.
* wincap.cc: New file.
* wincap.h: Ditto.
* autoload.cc: Add dynamic load statement for `CreateHardLinkA'.
* dcrt0.cc (os_being_run): Eliminated.
(osname): Ditto.
(iswinnt): Ditto.
(set_os_type): Ditto.
(dll_crt0_1): Call wincap.init() instead of set_os_type().
(_dll_crt0): Ditto.
* environ.cc (set_chunksize): New function.
(parse_thing): `forkchunk' setting now invokes function `set_chunksize'.
* fork.cc (chunksize): Eliminated. Moved to be member of wincap.
* host_dependent.h: Removed.
* syscalls.cc (_link): Try using `CreateHardLinkA' first, if available.
* cygheap.cc, dcrt0.cc, delqueue.cc, dir.cc,
environ.cc, fhandler.cc, fhandler.h, fhandler_console.cc,
fhandler_mem.cc, fork.cc, mmap.cc, net.cc, pinfo.cc, pinfo.h,
security.cc, syscalls.cc, sysconf.cc, syslog.cc, thread.cc,
times.cc, tty.cc, uinfo.cc, uname.cc, winsup.h: Use new wincap
capability check throughout.
* winsup.h: Include wincap.h. Eliminate extern declarations of
`os_being_run' and `iswinnt'. Eliminate `os_type" definition.
* include/cygwin/version.h: Bump version to 1.3.4.
2001-09-13 01:46:37 +08:00
|
|
|
if (!wincap.has_security ())
|
2000-06-17 03:36:07 +08:00
|
|
|
{
|
|
|
|
set_errno (ENOSYS);
|
|
|
|
return INVALID_HANDLE_VALUE;
|
|
|
|
}
|
|
|
|
if (!pw)
|
|
|
|
{
|
|
|
|
set_errno (EINVAL);
|
|
|
|
return INVALID_HANDLE_VALUE;
|
|
|
|
}
|
|
|
|
|
2001-05-01 05:19:42 +08:00
|
|
|
char nt_domain[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
char nt_user[UNLEN + 1];
|
2000-06-17 03:36:07 +08:00
|
|
|
HANDLE hToken;
|
|
|
|
|
2001-05-01 05:19:42 +08:00
|
|
|
extract_nt_dom_user (pw, nt_domain, nt_user);
|
2001-03-02 19:41:09 +08:00
|
|
|
debug_printf ("LogonUserA (%s, %s, %s, ...)", nt_user, nt_domain, password);
|
2001-05-01 05:19:42 +08:00
|
|
|
if (!LogonUserA (nt_user, *nt_domain ? nt_domain : NULL, (char *) password,
|
2000-09-03 12:16:35 +08:00
|
|
|
LOGON32_LOGON_INTERACTIVE,
|
|
|
|
LOGON32_PROVIDER_DEFAULT,
|
|
|
|
&hToken)
|
2000-06-17 03:36:07 +08:00
|
|
|
|| !SetHandleInformation (hToken,
|
2000-09-03 12:16:35 +08:00
|
|
|
HANDLE_FLAG_INHERIT,
|
|
|
|
HANDLE_FLAG_INHERIT))
|
2000-06-17 03:36:07 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return INVALID_HANDLE_VALUE;
|
|
|
|
}
|
|
|
|
debug_printf ("%d = logon_user(%s,...)", hToken, pw->pw_name);
|
|
|
|
return hToken;
|
|
|
|
}
|
|
|
|
|
2001-05-01 05:19:42 +08:00
|
|
|
static void
|
|
|
|
str2lsa (LSA_STRING &tgt, const char *srcstr)
|
|
|
|
{
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
tgt.Length = strlen (srcstr);
|
2001-05-01 05:19:42 +08:00
|
|
|
tgt.MaximumLength = tgt.Length + 1;
|
|
|
|
tgt.Buffer = (PCHAR) srcstr;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
str2buf2lsa (LSA_STRING &tgt, char *buf, const char *srcstr)
|
|
|
|
{
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
tgt.Length = strlen (srcstr);
|
2001-05-01 05:19:42 +08:00
|
|
|
tgt.MaximumLength = tgt.Length + 1;
|
|
|
|
tgt.Buffer = (PCHAR) buf;
|
|
|
|
memcpy(buf, srcstr, tgt.MaximumLength);
|
|
|
|
}
|
|
|
|
|
2001-10-16 22:53:26 +08:00
|
|
|
void
|
2001-05-01 05:19:42 +08:00
|
|
|
str2buf2uni (UNICODE_STRING &tgt, WCHAR *buf, const char *srcstr)
|
|
|
|
{
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
tgt.Length = strlen (srcstr) * sizeof (WCHAR);
|
2001-05-01 05:19:42 +08:00
|
|
|
tgt.MaximumLength = tgt.Length + sizeof(WCHAR);
|
|
|
|
tgt.Buffer = (PWCHAR) buf;
|
2001-05-30 04:43:40 +08:00
|
|
|
sys_mbstowcs (buf, srcstr, tgt.MaximumLength);
|
2001-05-01 05:19:42 +08:00
|
|
|
}
|
|
|
|
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
static void
|
|
|
|
lsa2wchar (WCHAR *tgt, LSA_UNICODE_STRING &src, int size)
|
|
|
|
{
|
|
|
|
size = (size - 1) * sizeof (WCHAR);
|
|
|
|
if (src.Length < size)
|
|
|
|
size = src.Length;
|
|
|
|
memcpy (tgt, src.Buffer, size);
|
|
|
|
size >>= 1;
|
|
|
|
tgt[size] = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static LSA_HANDLE
|
|
|
|
open_local_policy ()
|
|
|
|
{
|
|
|
|
LSA_OBJECT_ATTRIBUTES oa = { 0, 0, 0, 0, 0, 0 };
|
2001-12-30 06:03:32 +08:00
|
|
|
LSA_HANDLE lsa = NULL;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
|
2001-12-31 01:38:24 +08:00
|
|
|
NTSTATUS ret = LsaOpenPolicy(NULL, &oa, POLICY_EXECUTE, &lsa);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (ret != STATUS_SUCCESS)
|
|
|
|
set_errno (LsaNtStatusToWinError (ret));
|
|
|
|
return lsa;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
close_local_policy (LSA_HANDLE &lsa)
|
|
|
|
{
|
|
|
|
if (lsa != INVALID_HANDLE_VALUE)
|
|
|
|
LsaClose (lsa);
|
|
|
|
lsa = INVALID_HANDLE_VALUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL
|
|
|
|
get_lsa_srv_inf (LSA_HANDLE lsa, char *logonserver, char *domain)
|
|
|
|
{
|
|
|
|
NET_API_STATUS ret;
|
|
|
|
LPSERVER_INFO_101 buf;
|
|
|
|
DWORD cnt, tot;
|
|
|
|
char name[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
WCHAR account[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
WCHAR primary[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
PPOLICY_ACCOUNT_DOMAIN_INFO adi;
|
|
|
|
PPOLICY_PRIMARY_DOMAIN_INFO pdi;
|
|
|
|
|
|
|
|
if ((ret = LsaQueryInformationPolicy (lsa, PolicyAccountDomainInformation,
|
2001-09-08 05:32:07 +08:00
|
|
|
(PVOID *) &adi)) != STATUS_SUCCESS)
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
{
|
|
|
|
set_errno (LsaNtStatusToWinError(ret));
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
lsa2wchar (account, adi->DomainName, INTERNET_MAX_HOST_NAME_LENGTH + 1);
|
|
|
|
LsaFreeMemory (adi);
|
|
|
|
if ((ret = LsaQueryInformationPolicy (lsa, PolicyPrimaryDomainInformation,
|
2001-09-08 05:32:07 +08:00
|
|
|
(PVOID *) &pdi)) != STATUS_SUCCESS)
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
{
|
|
|
|
set_errno (LsaNtStatusToWinError(ret));
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
lsa2wchar (primary, pdi->Name, INTERNET_MAX_HOST_NAME_LENGTH + 1);
|
|
|
|
LsaFreeMemory (pdi);
|
|
|
|
if ((ret = NetServerEnum (NULL, 101, (LPBYTE *) &buf, MAX_PREFERRED_LENGTH,
|
2001-09-08 05:32:07 +08:00
|
|
|
&cnt, &tot, SV_TYPE_DOMAIN_CTRL, primary, NULL))
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
== STATUS_SUCCESS && cnt > 0)
|
|
|
|
{
|
2001-05-30 04:43:40 +08:00
|
|
|
sys_wcstombs (name, buf[0].sv101_name, INTERNET_MAX_HOST_NAME_LENGTH + 1);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (domain)
|
2001-09-08 05:32:07 +08:00
|
|
|
sys_wcstombs (domain, primary, INTERNET_MAX_HOST_NAME_LENGTH + 1);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
2001-05-30 04:43:40 +08:00
|
|
|
sys_wcstombs (name, account, INTERNET_MAX_HOST_NAME_LENGTH + 1);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (domain)
|
2001-09-08 05:32:07 +08:00
|
|
|
sys_wcstombs (domain, account, INTERNET_MAX_HOST_NAME_LENGTH + 1);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
}
|
|
|
|
if (ret == STATUS_SUCCESS)
|
|
|
|
NetApiBufferFree (buf);
|
|
|
|
strcpy (logonserver, "\\\\");
|
|
|
|
strcat (logonserver, name);
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL
|
|
|
|
get_logon_server (LSA_HANDLE lsa, char *logonserver)
|
|
|
|
{
|
|
|
|
return get_lsa_srv_inf (lsa, logonserver, NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
BOOL
|
|
|
|
get_logon_server_and_user_domain (char *logonserver, char *userdomain)
|
|
|
|
{
|
|
|
|
BOOL ret = FALSE;
|
|
|
|
LSA_HANDLE lsa = open_local_policy ();
|
|
|
|
if (lsa)
|
|
|
|
{
|
|
|
|
ret = get_lsa_srv_inf (lsa, logonserver, userdomain);
|
|
|
|
close_local_policy (lsa);
|
|
|
|
}
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL
|
|
|
|
get_user_groups (WCHAR *wlogonserver, cygsidlist &grp_list, char *user)
|
|
|
|
{
|
2001-06-26 22:47:48 +08:00
|
|
|
WCHAR wuser[UNLEN + 1];
|
2001-05-30 04:43:40 +08:00
|
|
|
sys_mbstowcs (wuser, user, UNLEN + 1);
|
2001-06-26 22:47:48 +08:00
|
|
|
LPGROUP_USERS_INFO_0 buf;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
DWORD cnt, tot;
|
|
|
|
NET_API_STATUS ret;
|
|
|
|
|
2001-07-18 20:56:26 +08:00
|
|
|
ret = NetUserGetGroups (wlogonserver, wuser, 0, (LPBYTE *) &buf,
|
|
|
|
MAX_PREFERRED_LENGTH, &cnt, &tot);
|
|
|
|
if (ret == ERROR_BAD_NETPATH || ret == RPC_S_SERVER_UNAVAILABLE)
|
|
|
|
ret = NetUserGetGroups (NULL, wuser, 0, (LPBYTE *) &buf,
|
|
|
|
MAX_PREFERRED_LENGTH, &cnt, &tot);
|
|
|
|
if (ret)
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
{
|
|
|
|
debug_printf ("%d = NetUserGetGroups ()", ret);
|
|
|
|
set_errno (ret);
|
|
|
|
/* It's no error when the user name can't be found. */
|
|
|
|
return ret == NERR_UserNotFound;
|
|
|
|
}
|
|
|
|
|
|
|
|
for (DWORD i = 0; i < cnt; ++i)
|
|
|
|
{
|
|
|
|
cygsid gsid;
|
|
|
|
char group[UNLEN + 1];
|
|
|
|
char domain[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
DWORD glen = UNLEN + 1;
|
|
|
|
DWORD dlen = INTERNET_MAX_HOST_NAME_LENGTH + 1;
|
|
|
|
SID_NAME_USE use = SidTypeInvalid;
|
|
|
|
|
2001-05-30 04:43:40 +08:00
|
|
|
sys_wcstombs (group, buf[i].grui0_name, UNLEN + 1);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (!LookupAccountName (NULL, group, gsid, &glen, domain, &dlen, &use))
|
2001-09-08 05:32:07 +08:00
|
|
|
debug_printf ("LookupAccountName(%s): %lu\n", group, GetLastError ());
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (!legal_sid_type (use))
|
2001-09-08 05:32:07 +08:00
|
|
|
{
|
|
|
|
strcat (strcpy (group, domain), "\\");
|
|
|
|
sys_wcstombs (group + strlen (group), buf[i].grui0_name,
|
|
|
|
UNLEN + 1 - strlen (group));
|
|
|
|
glen = UNLEN + 1;
|
|
|
|
dlen = INTERNET_MAX_HOST_NAME_LENGTH + 1;
|
|
|
|
if (!LookupAccountName(NULL, group, gsid, &glen, domain, &dlen, &use))
|
|
|
|
debug_printf ("LookupAccountName(%s): %lu\n", group,GetLastError());
|
|
|
|
}
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (legal_sid_type (use))
|
2001-09-08 05:32:07 +08:00
|
|
|
grp_list += gsid;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
NetApiBufferFree (buf);
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL
|
|
|
|
is_group_member (WCHAR *wlogonserver, WCHAR *wgroup,
|
2001-09-08 05:32:07 +08:00
|
|
|
cygsid &usersid, cygsidlist &grp_list)
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
{
|
|
|
|
LPLOCALGROUP_MEMBERS_INFO_0 buf;
|
|
|
|
DWORD cnt, tot;
|
2001-07-18 20:56:26 +08:00
|
|
|
NET_API_STATUS ret;
|
|
|
|
BOOL retval = FALSE;
|
|
|
|
|
2001-10-30 08:02:36 +08:00
|
|
|
ret = NetLocalGroupGetMembers (NULL, wgroup, 0, (LPBYTE *) &buf,
|
2001-07-18 20:56:26 +08:00
|
|
|
MAX_PREFERRED_LENGTH, &cnt, &tot, NULL);
|
|
|
|
if (ret)
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
return FALSE;
|
|
|
|
|
2001-07-18 20:56:26 +08:00
|
|
|
for (DWORD bidx = 0; !retval && bidx < cnt; ++bidx)
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (EqualSid (usersid, buf[bidx].lgrmi0_sid))
|
2001-07-18 20:56:26 +08:00
|
|
|
retval = TRUE;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
else
|
2001-07-18 20:56:26 +08:00
|
|
|
for (int glidx = 0; !retval && glidx < grp_list.count; ++glidx)
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (EqualSid (grp_list.sids[glidx], buf[bidx].lgrmi0_sid))
|
2001-07-18 20:56:26 +08:00
|
|
|
retval = TRUE;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
|
|
|
|
NetApiBufferFree (buf);
|
2001-07-18 20:56:26 +08:00
|
|
|
return retval;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL
|
|
|
|
get_user_local_groups (WCHAR *wlogonserver, const char *logonserver,
|
|
|
|
cygsidlist &grp_list, cygsid &usersid)
|
|
|
|
{
|
|
|
|
LPLOCALGROUP_INFO_0 buf;
|
|
|
|
DWORD cnt, tot;
|
|
|
|
NET_API_STATUS ret;
|
|
|
|
|
2001-10-30 08:02:36 +08:00
|
|
|
ret = NetLocalGroupEnum (NULL, 0, (LPBYTE *) &buf,
|
2001-07-18 20:56:26 +08:00
|
|
|
MAX_PREFERRED_LENGTH, &cnt, &tot, NULL);
|
|
|
|
if (ret)
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
{
|
|
|
|
debug_printf ("%d = NetLocalGroupEnum ()", ret);
|
|
|
|
set_errno (ret);
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
for (DWORD i = 0; i < cnt; ++i)
|
|
|
|
if (is_group_member (wlogonserver, buf[i].lgrpi0_name, usersid, grp_list))
|
|
|
|
{
|
|
|
|
cygsid gsid;
|
|
|
|
char group[UNLEN + 1];
|
|
|
|
char domain[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
DWORD glen = UNLEN + 1;
|
|
|
|
DWORD dlen = INTERNET_MAX_HOST_NAME_LENGTH + 1;
|
|
|
|
SID_NAME_USE use = SidTypeInvalid;
|
|
|
|
|
2001-05-30 04:43:40 +08:00
|
|
|
sys_wcstombs (group, buf[i].lgrpi0_name, UNLEN + 1);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (!LookupAccountName (NULL, group, gsid, &glen, domain, &dlen, &use))
|
|
|
|
{
|
|
|
|
glen = UNLEN + 1;
|
|
|
|
dlen = INTERNET_MAX_HOST_NAME_LENGTH + 1;
|
|
|
|
if (!LookupAccountName (logonserver + 2, group,
|
|
|
|
gsid, &glen, domain, &dlen, &use))
|
|
|
|
debug_printf ("LookupAccountName(%s): %lu\n", group,
|
|
|
|
GetLastError ());
|
|
|
|
}
|
|
|
|
else if (!legal_sid_type (use))
|
|
|
|
{
|
|
|
|
strcat (strcpy (group, domain), "\\");
|
2001-05-30 04:43:40 +08:00
|
|
|
sys_wcstombs (group + strlen (group), buf[i].lgrpi0_name,
|
2001-09-08 05:32:07 +08:00
|
|
|
UNLEN + 1 - strlen (group));
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
glen = UNLEN + 1;
|
|
|
|
dlen = INTERNET_MAX_HOST_NAME_LENGTH + 1;
|
|
|
|
if (!LookupAccountName (NULL, group, gsid, &glen,
|
|
|
|
domain, &dlen, &use))
|
|
|
|
debug_printf ("LookupAccountName(%s): %lu\n", group,
|
|
|
|
GetLastError ());
|
|
|
|
}
|
|
|
|
if (legal_sid_type (use))
|
|
|
|
grp_list += gsid;
|
|
|
|
}
|
|
|
|
|
|
|
|
NetApiBufferFree (buf);
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL
|
|
|
|
sid_in_token_groups (PTOKEN_GROUPS grps, cygsid &sid)
|
|
|
|
{
|
|
|
|
if (!grps)
|
|
|
|
return FALSE;
|
|
|
|
for (DWORD i = 0; i < grps->GroupCount; ++i)
|
|
|
|
if (sid == grps->Groups[i].Sid)
|
|
|
|
return TRUE;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL
|
|
|
|
get_user_primary_group (WCHAR *wlogonserver, const char *user,
|
|
|
|
cygsid &usersid, cygsid &pgrpsid)
|
|
|
|
{
|
|
|
|
LPUSER_INFO_3 buf;
|
|
|
|
WCHAR wuser[UNLEN + 1];
|
2001-07-18 20:56:26 +08:00
|
|
|
NET_API_STATUS ret;
|
|
|
|
BOOL retval = FALSE;
|
2001-07-27 17:17:57 +08:00
|
|
|
UCHAR count = 0;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
|
|
|
|
if (usersid == well_known_system_sid)
|
|
|
|
{
|
|
|
|
pgrpsid = well_known_system_sid;
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
2001-05-30 04:43:40 +08:00
|
|
|
sys_mbstowcs (wuser, user, UNLEN + 1);
|
2001-07-18 20:56:26 +08:00
|
|
|
ret = NetUserGetInfo (wlogonserver, wuser, 3, (LPBYTE *) &buf);
|
|
|
|
if (ret == ERROR_BAD_NETPATH || ret == RPC_S_SERVER_UNAVAILABLE)
|
|
|
|
ret = NetUserGetInfo (NULL, wuser, 3, (LPBYTE *) &buf);
|
|
|
|
if (ret)
|
|
|
|
{
|
|
|
|
debug_printf ("%d = NetUserGetInfo ()", ret);
|
|
|
|
set_errno (ret);
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
pgrpsid = usersid;
|
|
|
|
if (IsValidSid (pgrpsid) && (count = *GetSidSubAuthorityCount (pgrpsid)) > 1)
|
|
|
|
{
|
|
|
|
*GetSidSubAuthority (pgrpsid, count - 1) = buf->usri3_primary_group_id;
|
2001-07-18 20:56:26 +08:00
|
|
|
retval = TRUE;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
}
|
|
|
|
NetApiBufferFree (buf);
|
2001-07-18 20:56:26 +08:00
|
|
|
return retval;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
}
|
|
|
|
|
2001-11-04 05:19:50 +08:00
|
|
|
static int
|
|
|
|
get_supplementary_group_sidlist (const char *username, cygsidlist &grp_list)
|
|
|
|
{
|
|
|
|
struct group *gr;
|
|
|
|
int cnt = 0;
|
|
|
|
|
|
|
|
for (int gidx = 0; (gr = internal_getgrent (gidx)); ++gidx)
|
|
|
|
{
|
|
|
|
if (gr->gr_mem)
|
|
|
|
for (int gi = 0; gr->gr_mem[gi]; ++gi)
|
|
|
|
if (strcasematch (username, gr->gr_mem[gi]))
|
|
|
|
{
|
|
|
|
if (gr->gr_passwd && *gr->gr_passwd)
|
|
|
|
{
|
|
|
|
cygsid sid (gr->gr_passwd);
|
|
|
|
if ((PSID)sid && grp_list.add (sid))
|
|
|
|
++cnt;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return cnt;
|
|
|
|
}
|
|
|
|
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
static BOOL
|
|
|
|
get_group_sidlist (const char *logonserver, cygsidlist &grp_list,
|
|
|
|
cygsid &usersid, cygsid &pgrpsid,
|
|
|
|
PTOKEN_GROUPS my_grps, LUID auth_luid, int &auth_pos)
|
|
|
|
{
|
|
|
|
WCHAR wserver[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
char user[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
char domain[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
DWORD ulen = INTERNET_MAX_HOST_NAME_LENGTH + 1;
|
|
|
|
DWORD dlen = INTERNET_MAX_HOST_NAME_LENGTH + 1;
|
|
|
|
SID_NAME_USE use;
|
2001-11-04 05:19:50 +08:00
|
|
|
cygsidlist sup_list;
|
2001-06-26 22:47:48 +08:00
|
|
|
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
auth_pos = -1;
|
2001-05-30 04:43:40 +08:00
|
|
|
sys_mbstowcs (wserver, logonserver, INTERNET_MAX_HOST_NAME_LENGTH + 1);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (!LookupAccountSid (NULL, usersid, user, &ulen, domain, &dlen, &use))
|
|
|
|
{
|
|
|
|
debug_printf ("LookupAccountSid () %E");
|
|
|
|
__seterrno ();
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
grp_list += well_known_world_sid;
|
|
|
|
if (usersid == well_known_system_sid)
|
|
|
|
{
|
|
|
|
grp_list += well_known_system_sid;
|
2001-07-16 06:40:07 +08:00
|
|
|
grp_list += well_known_admins_sid;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
if (my_grps)
|
|
|
|
{
|
|
|
|
if (sid_in_token_groups (my_grps, well_known_local_sid))
|
|
|
|
grp_list += well_known_local_sid;
|
|
|
|
if (sid_in_token_groups (my_grps, well_known_dialup_sid))
|
|
|
|
grp_list += well_known_dialup_sid;
|
|
|
|
if (sid_in_token_groups (my_grps, well_known_network_sid))
|
|
|
|
grp_list += well_known_network_sid;
|
|
|
|
if (sid_in_token_groups (my_grps, well_known_batch_sid))
|
|
|
|
grp_list += well_known_batch_sid;
|
|
|
|
if (sid_in_token_groups (my_grps, well_known_interactive_sid))
|
|
|
|
grp_list += well_known_interactive_sid;
|
|
|
|
if (sid_in_token_groups (my_grps, well_known_service_sid))
|
|
|
|
grp_list += well_known_service_sid;
|
|
|
|
grp_list += well_known_authenticated_users_sid;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
grp_list += well_known_local_sid;
|
|
|
|
grp_list += well_known_interactive_sid;
|
|
|
|
grp_list += well_known_authenticated_users_sid;
|
|
|
|
}
|
|
|
|
if (auth_luid.QuadPart != 999) /* != SYSTEM_LUID */
|
|
|
|
{
|
|
|
|
char buf[64];
|
|
|
|
__small_sprintf (buf, "S-1-5-5-%u-%u", auth_luid.HighPart,
|
|
|
|
auth_luid.LowPart);
|
|
|
|
grp_list += buf;
|
|
|
|
auth_pos = grp_list.count - 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!pgrpsid)
|
|
|
|
get_user_primary_group (wserver, user, usersid, pgrpsid);
|
|
|
|
if (!get_user_groups (wserver, grp_list, user) ||
|
|
|
|
!get_user_local_groups (wserver, logonserver, grp_list, usersid))
|
|
|
|
return FALSE;
|
|
|
|
if (!grp_list.contains (pgrpsid))
|
|
|
|
grp_list += pgrpsid;
|
2001-11-04 05:19:50 +08:00
|
|
|
if (get_supplementary_group_sidlist (user, sup_list))
|
|
|
|
{
|
|
|
|
for (int i = 0; i < sup_list.count; ++i)
|
2001-11-05 14:09:15 +08:00
|
|
|
if (!grp_list.contains (sup_list.sids[i]))
|
2001-11-04 05:19:50 +08:00
|
|
|
grp_list += sup_list.sids[i];
|
|
|
|
}
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static const char *sys_privs[] = {
|
|
|
|
SE_TCB_NAME,
|
|
|
|
SE_ASSIGNPRIMARYTOKEN_NAME,
|
|
|
|
SE_CREATE_TOKEN_NAME,
|
|
|
|
SE_CHANGE_NOTIFY_NAME,
|
|
|
|
SE_SECURITY_NAME,
|
|
|
|
SE_BACKUP_NAME,
|
|
|
|
SE_RESTORE_NAME,
|
|
|
|
SE_SYSTEMTIME_NAME,
|
|
|
|
SE_SHUTDOWN_NAME,
|
|
|
|
SE_REMOTE_SHUTDOWN_NAME,
|
|
|
|
SE_TAKE_OWNERSHIP_NAME,
|
|
|
|
SE_DEBUG_NAME,
|
|
|
|
SE_SYSTEM_ENVIRONMENT_NAME,
|
|
|
|
SE_SYSTEM_PROFILE_NAME,
|
|
|
|
SE_PROF_SINGLE_PROCESS_NAME,
|
|
|
|
SE_INC_BASE_PRIORITY_NAME,
|
|
|
|
SE_LOAD_DRIVER_NAME,
|
|
|
|
SE_CREATE_PAGEFILE_NAME,
|
|
|
|
SE_INCREASE_QUOTA_NAME
|
|
|
|
};
|
|
|
|
|
|
|
|
#define SYSTEM_PERMISSION_COUNT (sizeof sys_privs / sizeof (const char *))
|
|
|
|
|
|
|
|
PTOKEN_PRIVILEGES
|
|
|
|
get_system_priv_list (cygsidlist &grp_list)
|
|
|
|
{
|
|
|
|
LUID priv;
|
|
|
|
PTOKEN_PRIVILEGES privs = (PTOKEN_PRIVILEGES) malloc (sizeof (ULONG) +
|
|
|
|
20 * sizeof (LUID_AND_ATTRIBUTES));
|
|
|
|
if (!privs)
|
|
|
|
{
|
|
|
|
debug_printf ("malloc (system_privs) failed.");
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
privs->PrivilegeCount = 0;
|
|
|
|
|
|
|
|
for (DWORD i = 0; i < SYSTEM_PERMISSION_COUNT; ++i)
|
|
|
|
if (LookupPrivilegeValue (NULL, sys_privs[i], &priv))
|
|
|
|
{
|
|
|
|
privs->Privileges[privs->PrivilegeCount].Luid = priv;
|
|
|
|
privs->Privileges[privs->PrivilegeCount].Attributes =
|
2001-09-08 05:32:07 +08:00
|
|
|
SE_PRIVILEGE_ENABLED | SE_PRIVILEGE_ENABLED_BY_DEFAULT;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
++privs->PrivilegeCount;
|
|
|
|
}
|
|
|
|
return privs;
|
|
|
|
}
|
|
|
|
|
|
|
|
PTOKEN_PRIVILEGES
|
|
|
|
get_priv_list (LSA_HANDLE lsa, cygsid &usersid, cygsidlist &grp_list)
|
|
|
|
{
|
|
|
|
PLSA_UNICODE_STRING privstrs;
|
|
|
|
ULONG cnt;
|
|
|
|
PTOKEN_PRIVILEGES privs = NULL;
|
|
|
|
NTSTATUS ret;
|
|
|
|
char buf[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
|
|
|
|
if (usersid == well_known_system_sid)
|
|
|
|
return get_system_priv_list (grp_list);
|
|
|
|
|
|
|
|
for (int grp = -1; grp < grp_list.count; ++grp)
|
|
|
|
{
|
|
|
|
if (grp == -1)
|
2001-09-08 05:32:07 +08:00
|
|
|
{
|
|
|
|
if ((ret = LsaEnumerateAccountRights (lsa, usersid, &privstrs, &cnt))
|
|
|
|
!= STATUS_SUCCESS)
|
|
|
|
continue;
|
|
|
|
}
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
else if ((ret = LsaEnumerateAccountRights (lsa, grp_list.sids[grp],
|
2001-09-08 05:32:07 +08:00
|
|
|
&privstrs, &cnt))
|
|
|
|
!= STATUS_SUCCESS)
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
continue;
|
|
|
|
for (ULONG i = 0; i < cnt; ++i)
|
2001-09-08 05:32:07 +08:00
|
|
|
{
|
|
|
|
LUID priv;
|
|
|
|
PTOKEN_PRIVILEGES tmp;
|
|
|
|
DWORD tmp_count;
|
|
|
|
|
|
|
|
sys_wcstombs (buf, privstrs[i].Buffer,
|
|
|
|
INTERNET_MAX_HOST_NAME_LENGTH + 1);
|
|
|
|
if (!LookupPrivilegeValue (NULL, buf, &priv))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
for (DWORD p = 0; privs && p < privs->PrivilegeCount; ++p)
|
|
|
|
if (!memcmp (&priv, &privs->Privileges[p].Luid, sizeof (LUID)))
|
|
|
|
goto next_account_right;
|
|
|
|
|
|
|
|
tmp_count = privs ? privs->PrivilegeCount : 0;
|
|
|
|
tmp = (PTOKEN_PRIVILEGES)
|
|
|
|
realloc (privs, sizeof (ULONG) +
|
|
|
|
(tmp_count + 1) * sizeof (LUID_AND_ATTRIBUTES));
|
|
|
|
if (!tmp)
|
|
|
|
{
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (privs)
|
|
|
|
free (privs);
|
2001-09-08 05:32:07 +08:00
|
|
|
LsaFreeMemory (privstrs);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
debug_printf ("realloc (privs) failed.");
|
2001-09-08 05:32:07 +08:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
tmp->PrivilegeCount = tmp_count;
|
|
|
|
privs = tmp;
|
|
|
|
privs->Privileges[privs->PrivilegeCount].Luid = priv;
|
|
|
|
privs->Privileges[privs->PrivilegeCount].Attributes =
|
|
|
|
SE_PRIVILEGE_ENABLED | SE_PRIVILEGE_ENABLED_BY_DEFAULT;
|
|
|
|
++privs->PrivilegeCount;
|
|
|
|
|
|
|
|
next_account_right:
|
|
|
|
;
|
|
|
|
}
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
LsaFreeMemory (privstrs);
|
|
|
|
}
|
|
|
|
return privs;
|
|
|
|
}
|
|
|
|
|
|
|
|
#define token_acl_size (sizeof (ACL) + \
|
|
|
|
2 * (sizeof (ACCESS_ALLOWED_ACE) + MAX_SID_LEN))
|
|
|
|
|
|
|
|
static BOOL
|
|
|
|
get_dacl (PACL acl, cygsid usersid, cygsidlist &grp_list)
|
|
|
|
{
|
|
|
|
if (!InitializeAcl(acl, token_acl_size, ACL_REVISION))
|
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return FALSE;
|
2001-06-26 22:47:48 +08:00
|
|
|
}
|
2001-07-16 06:40:07 +08:00
|
|
|
if (grp_list.contains (well_known_admins_sid))
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
{
|
|
|
|
if (!AddAccessAllowedAce(acl, ACL_REVISION, GENERIC_ALL,
|
2001-07-16 06:40:07 +08:00
|
|
|
well_known_admins_sid))
|
2001-09-08 05:32:07 +08:00
|
|
|
{
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
__seterrno ();
|
2001-09-08 05:32:07 +08:00
|
|
|
return FALSE;
|
|
|
|
}
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
}
|
|
|
|
else if (!AddAccessAllowedAce(acl, ACL_REVISION, GENERIC_ALL, usersid))
|
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
if (!AddAccessAllowedAce(acl, ACL_REVISION, GENERIC_ALL,
|
|
|
|
well_known_system_sid))
|
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
HANDLE
|
|
|
|
create_token (cygsid &usersid, cygsid &pgrpsid)
|
|
|
|
{
|
|
|
|
NTSTATUS ret;
|
|
|
|
LSA_HANDLE lsa = NULL;
|
|
|
|
char logonserver[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
int old_priv_state;
|
|
|
|
|
|
|
|
cygsidlist grpsids;
|
|
|
|
|
|
|
|
SECURITY_QUALITY_OF_SERVICE sqos =
|
|
|
|
{ sizeof sqos, SecurityImpersonation, SECURITY_STATIC_TRACKING, FALSE };
|
|
|
|
OBJECT_ATTRIBUTES oa =
|
|
|
|
{ sizeof oa, 0, 0, 0, 0, &sqos };
|
|
|
|
SECURITY_ATTRIBUTES sa = { sizeof sa, NULL, TRUE };
|
|
|
|
LUID auth_luid = SYSTEM_LUID;
|
2001-09-01 03:48:34 +08:00
|
|
|
LARGE_INTEGER exp = { QuadPart:0x7fffffffffffffffLL };
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
|
|
|
|
TOKEN_USER user;
|
|
|
|
PTOKEN_GROUPS grps = NULL;
|
|
|
|
PTOKEN_PRIVILEGES privs = NULL;
|
|
|
|
TOKEN_OWNER owner;
|
|
|
|
TOKEN_PRIMARY_GROUP pgrp;
|
|
|
|
char acl_buf[token_acl_size];
|
|
|
|
TOKEN_DEFAULT_DACL dacl;
|
|
|
|
TOKEN_SOURCE source;
|
|
|
|
TOKEN_STATISTICS stats;
|
|
|
|
memcpy(source.SourceName, "Cygwin.1", 8);
|
|
|
|
source.SourceIdentifier.HighPart = 0;
|
|
|
|
source.SourceIdentifier.LowPart = 0x0101;
|
|
|
|
|
|
|
|
HANDLE token;
|
|
|
|
HANDLE primary_token = INVALID_HANDLE_VALUE;
|
|
|
|
|
|
|
|
HANDLE my_token = INVALID_HANDLE_VALUE;
|
|
|
|
PTOKEN_GROUPS my_grps = NULL;
|
|
|
|
DWORD size;
|
|
|
|
|
|
|
|
/* SE_CREATE_TOKEN_NAME privilege needed to call NtCreateToken. */
|
|
|
|
if ((old_priv_state = set_process_privilege (SE_CREATE_TOKEN_NAME)) < 0)
|
|
|
|
goto out;
|
2001-09-08 05:32:07 +08:00
|
|
|
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
/* Open policy object. */
|
2001-12-30 06:03:32 +08:00
|
|
|
if (!(lsa = open_local_policy ()))
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* Get logon server. */
|
|
|
|
if (!get_logon_server (lsa, logonserver))
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* User, owner, primary group. */
|
|
|
|
user.User.Sid = usersid;
|
|
|
|
user.User.Attributes = 0;
|
|
|
|
owner.Owner = usersid;
|
|
|
|
|
|
|
|
/* Retrieve authentication id and group list from own process. */
|
|
|
|
if (!OpenProcessToken (GetCurrentProcess (), TOKEN_QUERY, &my_token))
|
|
|
|
debug_printf ("OpenProcessToken(my_token): %E\n");
|
|
|
|
else
|
|
|
|
{
|
|
|
|
/* Switching user context to SYSTEM doesn't inherit the authentication
|
2001-06-26 22:47:48 +08:00
|
|
|
id of the user account running current process. */
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (usersid != well_known_system_sid)
|
|
|
|
if (!GetTokenInformation (my_token, TokenStatistics,
|
|
|
|
&stats, sizeof stats, &size))
|
|
|
|
debug_printf ("GetTokenInformation(my_token, TokenStatistics): %E\n");
|
|
|
|
else
|
|
|
|
auth_luid = stats.AuthenticationId;
|
|
|
|
|
|
|
|
/* Retrieving current processes group list to be able to inherit
|
2001-06-26 22:47:48 +08:00
|
|
|
some important well known group sids. */
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (!GetTokenInformation (my_token, TokenGroups, NULL, 0, &size) &&
|
2001-06-26 22:47:48 +08:00
|
|
|
GetLastError () != ERROR_INSUFFICIENT_BUFFER)
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
debug_printf ("GetTokenInformation(my_token, TokenGroups): %E\n");
|
|
|
|
else if (!(my_grps = (PTOKEN_GROUPS) malloc (size)))
|
|
|
|
debug_printf ("malloc (my_grps) failed.");
|
|
|
|
else if (!GetTokenInformation (my_token, TokenGroups, my_grps,
|
|
|
|
size, &size))
|
|
|
|
{
|
|
|
|
debug_printf ("GetTokenInformation(my_token, TokenGroups): %E\n");
|
|
|
|
free (my_grps);
|
|
|
|
my_grps = NULL;
|
|
|
|
}
|
2002-01-20 00:06:11 +08:00
|
|
|
CloseHandle (my_token);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Create list of groups, the user is member in. */
|
|
|
|
int auth_pos;
|
|
|
|
if (!get_group_sidlist (logonserver, grpsids, usersid, pgrpsid,
|
|
|
|
my_grps, auth_luid, auth_pos))
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* Primary group. */
|
|
|
|
pgrp.PrimaryGroup = pgrpsid;
|
|
|
|
|
|
|
|
/* Create a TOKEN_GROUPS list from the above retrieved list of sids. */
|
|
|
|
char grps_buf[sizeof (ULONG) + grpsids.count * sizeof (SID_AND_ATTRIBUTES)];
|
|
|
|
grps = (PTOKEN_GROUPS) grps_buf;
|
|
|
|
grps->GroupCount = grpsids.count;
|
|
|
|
for (DWORD i = 0; i < grps->GroupCount; ++i)
|
|
|
|
{
|
|
|
|
grps->Groups[i].Sid = grpsids.sids[i];
|
|
|
|
grps->Groups[i].Attributes = SE_GROUP_MANDATORY |
|
2001-06-26 22:47:48 +08:00
|
|
|
SE_GROUP_ENABLED_BY_DEFAULT |
|
|
|
|
SE_GROUP_ENABLED;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if (auth_pos >= 0 && i == (DWORD) auth_pos)
|
2001-06-26 22:47:48 +08:00
|
|
|
grps->Groups[i].Attributes |= SE_GROUP_LOGON_ID;
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Retrieve list of privileges of that user. */
|
|
|
|
if (!(privs = get_priv_list (lsa, usersid, grpsids)))
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* Create default dacl. */
|
|
|
|
if (!get_dacl ((PACL) acl_buf, usersid, grpsids))
|
|
|
|
goto out;
|
|
|
|
dacl.DefaultDacl = (PACL) acl_buf;
|
|
|
|
|
|
|
|
/* Let's be heroic... */
|
|
|
|
ret = NtCreateToken (&token, TOKEN_ALL_ACCESS, &oa, TokenImpersonation,
|
|
|
|
&auth_luid, &exp, &user, grps, privs, &owner, &pgrp,
|
|
|
|
&dacl, &source);
|
|
|
|
if (ret)
|
|
|
|
set_errno (RtlNtStatusToDosError (ret));
|
|
|
|
else if (GetLastError () == ERROR_PROC_NOT_FOUND)
|
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
debug_printf ("Loading NtCreateToken failed.");
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Convert to primary token. */
|
|
|
|
if (!DuplicateTokenEx (token, TOKEN_ALL_ACCESS, &sa,
|
2001-06-26 22:47:48 +08:00
|
|
|
SecurityImpersonation, TokenPrimary,
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
&primary_token))
|
|
|
|
__seterrno ();
|
|
|
|
|
|
|
|
out:
|
|
|
|
if (old_priv_state >= 0)
|
|
|
|
set_process_privilege (SE_CREATE_TOKEN_NAME, old_priv_state);
|
|
|
|
if (token != INVALID_HANDLE_VALUE)
|
|
|
|
CloseHandle (token);
|
|
|
|
if (privs)
|
|
|
|
free (privs);
|
|
|
|
if (my_grps)
|
|
|
|
free (my_grps);
|
|
|
|
close_local_policy (lsa);
|
|
|
|
|
|
|
|
debug_printf ("%d = create_token ()", primary_token);
|
|
|
|
return primary_token;
|
|
|
|
}
|
|
|
|
|
2001-05-01 05:19:42 +08:00
|
|
|
int subauth_id = 255;
|
|
|
|
|
|
|
|
HANDLE
|
|
|
|
subauth (struct passwd *pw)
|
|
|
|
{
|
|
|
|
LSA_STRING name;
|
|
|
|
HANDLE lsa_hdl;
|
|
|
|
LSA_OPERATIONAL_MODE sec_mode;
|
|
|
|
NTSTATUS ret, ret2;
|
|
|
|
ULONG package_id, size;
|
|
|
|
struct {
|
|
|
|
LSA_STRING str;
|
|
|
|
CHAR buf[16];
|
|
|
|
} origin;
|
|
|
|
struct {
|
|
|
|
MSV1_0_LM20_LOGON auth;
|
|
|
|
WCHAR dombuf[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
WCHAR usrbuf[UNLEN + 1];
|
|
|
|
WCHAR wkstbuf[1];
|
|
|
|
CHAR authinf1[1];
|
|
|
|
CHAR authinf2[1];
|
|
|
|
} subbuf;
|
|
|
|
TOKEN_SOURCE ts;
|
|
|
|
PMSV1_0_LM20_LOGON_PROFILE profile;
|
|
|
|
LUID luid;
|
|
|
|
QUOTA_LIMITS quota;
|
|
|
|
char nt_domain[INTERNET_MAX_HOST_NAME_LENGTH + 1];
|
|
|
|
char nt_user[UNLEN + 1];
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
SECURITY_ATTRIBUTES sa = { sizeof sa, NULL, TRUE };
|
|
|
|
HANDLE user_token = INVALID_HANDLE_VALUE;
|
|
|
|
HANDLE primary_token = INVALID_HANDLE_VALUE;
|
|
|
|
int old_tcb_state;
|
2001-05-01 05:19:42 +08:00
|
|
|
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
if ((old_tcb_state = set_process_privilege(SE_TCB_NAME)) < 0)
|
|
|
|
return INVALID_HANDLE_VALUE;
|
2001-05-01 05:19:42 +08:00
|
|
|
|
|
|
|
/* Register as logon process. */
|
|
|
|
str2lsa (name, "Cygwin");
|
2001-05-15 16:15:54 +08:00
|
|
|
SetLastError (0);
|
2001-05-01 05:19:42 +08:00
|
|
|
ret = LsaRegisterLogonProcess(&name, &lsa_hdl, &sec_mode);
|
|
|
|
if (ret != STATUS_SUCCESS)
|
|
|
|
{
|
|
|
|
debug_printf ("LsaRegisterLogonProcess: %d", ret);
|
|
|
|
set_errno (LsaNtStatusToWinError(ret));
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
goto out;
|
2001-05-01 05:19:42 +08:00
|
|
|
}
|
2001-05-14 22:14:19 +08:00
|
|
|
else if (GetLastError () == ERROR_PROC_NOT_FOUND)
|
|
|
|
{
|
|
|
|
debug_printf ("Couldn't load Secur32.dll");
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
goto out;
|
2001-05-14 22:14:19 +08:00
|
|
|
}
|
2001-05-01 05:19:42 +08:00
|
|
|
/* Get handle to MSV1_0 package. */
|
|
|
|
str2lsa (name, MSV1_0_PACKAGE_NAME);
|
|
|
|
ret = LsaLookupAuthenticationPackage(lsa_hdl, &name, &package_id);
|
|
|
|
if (ret != STATUS_SUCCESS)
|
|
|
|
{
|
|
|
|
debug_printf ("LsaLookupAuthenticationPackage: %d", ret);
|
|
|
|
set_errno (LsaNtStatusToWinError(ret));
|
|
|
|
LsaDeregisterLogonProcess(lsa_hdl);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
goto out;
|
2001-05-01 05:19:42 +08:00
|
|
|
}
|
|
|
|
/* Create origin. */
|
|
|
|
str2buf2lsa (origin.str, origin.buf, "Cygwin");
|
|
|
|
/* Create token source. */
|
|
|
|
memcpy(ts.SourceName, "Cygwin.1", 8);
|
2001-05-17 21:31:45 +08:00
|
|
|
ts.SourceIdentifier.HighPart = 0;
|
|
|
|
ts.SourceIdentifier.LowPart = 0x0100;
|
2001-05-01 05:19:42 +08:00
|
|
|
/* Get user information. */
|
|
|
|
extract_nt_dom_user (pw, nt_domain, nt_user);
|
|
|
|
/* Fill subauth with values. */
|
|
|
|
subbuf.auth.MessageType = MsV1_0NetworkLogon;
|
|
|
|
str2buf2uni(subbuf.auth.LogonDomainName, subbuf.dombuf, nt_domain);
|
|
|
|
str2buf2uni(subbuf.auth.UserName, subbuf.usrbuf, nt_user);
|
|
|
|
str2buf2uni(subbuf.auth.Workstation, subbuf.wkstbuf, "");
|
|
|
|
memcpy(subbuf.auth.ChallengeToClient, "12345678", MSV1_0_CHALLENGE_LENGTH);
|
|
|
|
str2buf2lsa(subbuf.auth.CaseSensitiveChallengeResponse, subbuf.authinf1, "");
|
|
|
|
str2buf2lsa(subbuf.auth.CaseInsensitiveChallengeResponse, subbuf.authinf2,"");
|
|
|
|
subbuf.auth.ParameterControl = 0 | (subauth_id << 24);
|
|
|
|
/* Try to logon... */
|
|
|
|
ret = LsaLogonUser(lsa_hdl, (PLSA_STRING) &origin, Network,
|
2001-06-26 22:47:48 +08:00
|
|
|
package_id, &subbuf, sizeof subbuf,
|
2001-05-01 05:19:42 +08:00
|
|
|
NULL, &ts, (PVOID *)&profile, &size,
|
|
|
|
&luid, &user_token, "a, &ret2);
|
|
|
|
if (ret != STATUS_SUCCESS)
|
|
|
|
{
|
|
|
|
debug_printf ("LsaLogonUser: %d", ret);
|
|
|
|
set_errno (LsaNtStatusToWinError(ret));
|
|
|
|
LsaDeregisterLogonProcess(lsa_hdl);
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
goto out;
|
2001-05-01 05:19:42 +08:00
|
|
|
}
|
|
|
|
LsaFreeReturnBuffer(profile);
|
|
|
|
/* Convert to primary token. */
|
|
|
|
if (!DuplicateTokenEx (user_token, TOKEN_ALL_ACCESS, &sa,
|
2001-06-26 22:47:48 +08:00
|
|
|
SecurityImpersonation, TokenPrimary,
|
2001-05-01 05:19:42 +08:00
|
|
|
&primary_token))
|
* autoload.cc: Add load statements for `LookupAccountNameW',
`LsaClose', `LsaEnumerateAccountRights', `LsaFreeMemory',
`LsaOpenPolicy', `LsaQueryInformationPolicy', `NetLocalGroupEnum',
`NetLocalGroupGetMembers', `NetServerEnum', `NetUserGetGroups' and
`NtCreateToken'.
* ntdll.h: Add declaration for `NtCreateToken'.
* sec_helper.cc: Add `well_known_local_sid', `well_known_dialup_sid',
`well_known_network_sid', `well_known_batch_sid',
`well_known_interactive_sid', `well_known_service_sid' and
`well_known_authenticated_users_sid'.
(cygsid::string): Define as const method.
(cygsid::get_sid): Set psid to NO_SID on error.
(cygsid::getfromstr): Ditto.
(cygsid::getfrompw): Simplify.
(cygsid::getfromgr): Check for gr == NULL.
(legal_sid_type): Move to security.h.
(set_process_privilege): Return -1 on error, otherwise 0 or 1 related
to previous privilege setting.
* security.cc (extract_nt_dom_user): Remove `static'.
(lsa2wchar): New function.
(open_local_policy): Ditto.
(close_local_policy): Ditto.
(get_lsa_srv_inf): Ditto.
(get_logon_server): Ditto.
(get_logon_server_and_user_domain): Ditto.
(get_user_groups): Ditto.
(is_group_member): Ditto.
(get_user_local_groups): Ditto.
(sid_in_token_groups): Ditto.
(get_user_primary_group): Ditto.
(get_group_sidlist): Ditto.
(get_system_priv_list): Ditto.
(get_priv_list): Ditto.
(get_dacl): Ditto.
(create_token): Ditto.
(subauth): Return immediately if SE_TCB_NAME can't be assigned.
Change all return statements in case of error to jumps to `out'
label. Add `out' label to support cleanup.
* security.h: Add extern declarations for `well_known_local_sid',
`well_known_dialup_sid', `well_known_network_sid',
`well_known_batch_sid', `well_known_interactive_sid',
`well_known_service_sid' and `well_known_authenticated_users_sid'.
Add extern declarations for functions `create_token',
`extract_nt_dom_user' and `get_logon_server_and_user_domain'.
(class cygsid): Add method `assign'. Change operator= to call new
`assign' method. Add `debug_print' method.
(class cygsidlist): New class.
(legal_sid_type): Moved from sec_helper.cc to here.
* spawn.cc (spawn_guts) Revert reversion of previous patch.
Call `RevertToSelf' and `ImpersonateLoggedOnUser' instead of `seteuid'
again.
* syscalls.cc (seteuid): Rearranged. Call `create_token' now when
needed. Call `subauth' if `create_token' fails. Try setting token
owner and primary group only if token was not explicitely created
by `create_token'.
* uinfo.cc (internal_getlogin): Try harder to generate correct user
information. Especially don't trust return value of `GetUserName'.
2001-05-20 16:10:47 +08:00
|
|
|
__seterrno ();
|
|
|
|
|
|
|
|
out:
|
|
|
|
set_process_privilege(SE_TCB_NAME, old_tcb_state);
|
|
|
|
if (user_token != INVALID_HANDLE_VALUE)
|
|
|
|
CloseHandle (user_token);
|
2001-05-01 05:19:42 +08:00
|
|
|
return primary_token;
|
|
|
|
}
|
|
|
|
|
2000-04-26 00:31:14 +08:00
|
|
|
/* read_sd reads a security descriptor from a file.
|
2000-02-18 03:38:33 +08:00
|
|
|
In case of error, -1 is returned and errno is set.
|
2000-05-02 17:38:32 +08:00
|
|
|
If sd_buf is too small, 0 is returned and sd_size
|
|
|
|
is set to the needed buffer size.
|
|
|
|
On success, 1 is returned.
|
|
|
|
|
|
|
|
GetFileSecurity() is used instead of BackupRead()
|
|
|
|
to avoid access denied errors if the caller has
|
|
|
|
not the permission to open that file for read.
|
|
|
|
|
|
|
|
Originally the function should return the size
|
|
|
|
of the SD on success. Unfortunately NT returns
|
|
|
|
0 in `len' on success, while W2K returns the
|
|
|
|
correct size!
|
2000-02-18 03:38:33 +08:00
|
|
|
*/
|
|
|
|
|
|
|
|
LONG
|
2000-04-26 00:31:14 +08:00
|
|
|
read_sd(const char *file, PSECURITY_DESCRIPTOR sd_buf, LPDWORD sd_size)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
/* Check parameters */
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!sd_size)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
set_errno (EINVAL);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2000-04-13 14:53:24 +08:00
|
|
|
debug_printf("file = %s", file);
|
2000-02-18 03:38:33 +08:00
|
|
|
|
2000-04-26 00:31:14 +08:00
|
|
|
DWORD len = 0;
|
2000-12-10 08:45:12 +08:00
|
|
|
const char *pfile = file;
|
|
|
|
char fbuf [PATH_MAX];
|
|
|
|
if (current_codepage == oem_cp)
|
|
|
|
{
|
|
|
|
DWORD fname_len = min (sizeof (fbuf) - 1, strlen (file));
|
|
|
|
bzero (fbuf, sizeof (fbuf));
|
|
|
|
OemToCharBuff(file, fbuf, fname_len);
|
|
|
|
pfile = fbuf;
|
|
|
|
}
|
|
|
|
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!GetFileSecurity (pfile,
|
2001-06-26 22:47:48 +08:00
|
|
|
OWNER_SECURITY_INFORMATION
|
2000-09-03 12:16:35 +08:00
|
|
|
| GROUP_SECURITY_INFORMATION
|
|
|
|
| DACL_SECURITY_INFORMATION,
|
|
|
|
sd_buf, *sd_size, &len))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return -1;
|
|
|
|
}
|
2000-05-02 08:25:43 +08:00
|
|
|
debug_printf("file = %s: len=%d", file, len);
|
2000-04-26 00:31:14 +08:00
|
|
|
if (len > *sd_size)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
2000-04-26 00:31:14 +08:00
|
|
|
*sd_size = len;
|
|
|
|
return 0;
|
2000-02-18 03:38:33 +08:00
|
|
|
}
|
2000-05-02 17:38:32 +08:00
|
|
|
return 1;
|
2000-02-18 03:38:33 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
LONG
|
2000-04-26 00:31:14 +08:00
|
|
|
write_sd(const char *file, PSECURITY_DESCRIPTOR sd_buf, DWORD sd_size)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
/* Check parameters */
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!sd_buf || !sd_size)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
set_errno (EINVAL);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2000-10-22 18:13:30 +08:00
|
|
|
/* No need to be thread save. */
|
|
|
|
static BOOL first_time = TRUE;
|
|
|
|
if (first_time)
|
|
|
|
{
|
2001-04-21 04:36:13 +08:00
|
|
|
set_process_privilege (SE_RESTORE_NAME);
|
2000-10-22 18:13:30 +08:00
|
|
|
first_time = FALSE;
|
|
|
|
}
|
|
|
|
|
2000-04-26 00:31:14 +08:00
|
|
|
HANDLE fh;
|
|
|
|
fh = CreateFile (file,
|
2000-09-03 12:16:35 +08:00
|
|
|
WRITE_OWNER | WRITE_DAC,
|
|
|
|
FILE_SHARE_READ | FILE_SHARE_WRITE,
|
|
|
|
&sec_none_nih,
|
|
|
|
OPEN_EXISTING,
|
|
|
|
FILE_ATTRIBUTE_NORMAL | FILE_FLAG_BACKUP_SEMANTICS,
|
|
|
|
NULL);
|
2000-02-18 03:38:33 +08:00
|
|
|
|
2000-04-26 00:31:14 +08:00
|
|
|
if (fh == INVALID_HANDLE_VALUE)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
LPVOID context = NULL;
|
|
|
|
DWORD bytes_written = 0;
|
|
|
|
WIN32_STREAM_ID header;
|
|
|
|
|
|
|
|
memset (&header, 0, sizeof (header));
|
|
|
|
/* write new security info header */
|
|
|
|
header.dwStreamId = BACKUP_SECURITY_DATA;
|
|
|
|
header.dwStreamAttributes = STREAM_CONTAINS_SECURITY;
|
|
|
|
header.Size.HighPart = 0;
|
2000-04-26 00:31:14 +08:00
|
|
|
header.Size.LowPart = sd_size;
|
2000-02-18 03:38:33 +08:00
|
|
|
header.dwStreamNameSize = 0;
|
2000-04-26 00:31:14 +08:00
|
|
|
if (!BackupWrite (fh, (LPBYTE) &header,
|
2000-02-18 03:38:33 +08:00
|
|
|
3 * sizeof (DWORD) + sizeof (LARGE_INTEGER),
|
|
|
|
&bytes_written, FALSE, TRUE, &context))
|
|
|
|
{
|
|
|
|
__seterrno ();
|
2000-04-26 00:31:14 +08:00
|
|
|
CloseHandle (fh);
|
2000-02-18 03:38:33 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* write new security descriptor */
|
2000-04-26 00:31:14 +08:00
|
|
|
if (!BackupWrite (fh, (LPBYTE) sd_buf,
|
2000-02-18 03:38:33 +08:00
|
|
|
header.Size.LowPart + header.dwStreamNameSize,
|
|
|
|
&bytes_written, FALSE, TRUE, &context))
|
|
|
|
{
|
|
|
|
/* Samba returns ERROR_NOT_SUPPORTED.
|
2000-09-03 12:16:35 +08:00
|
|
|
FAT returns ERROR_INVALID_SECURITY_DESCR.
|
|
|
|
This shouldn't return as error, but better be ignored. */
|
2000-02-18 03:38:33 +08:00
|
|
|
DWORD ret = GetLastError ();
|
|
|
|
if (ret != ERROR_NOT_SUPPORTED && ret != ERROR_INVALID_SECURITY_DESCR)
|
|
|
|
{
|
|
|
|
__seterrno ();
|
2000-04-26 00:31:14 +08:00
|
|
|
BackupWrite (fh, NULL, 0, &bytes_written, TRUE, TRUE, &context);
|
|
|
|
CloseHandle (fh);
|
2000-02-18 03:38:33 +08:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* terminate the restore process */
|
2000-04-26 00:31:14 +08:00
|
|
|
BackupWrite (fh, NULL, 0, &bytes_written, TRUE, TRUE, &context);
|
|
|
|
CloseHandle (fh);
|
2000-02-18 03:38:33 +08:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2000-03-17 03:35:18 +08:00
|
|
|
get_nt_attribute (const char *file, int *attribute,
|
2000-09-03 12:16:35 +08:00
|
|
|
uid_t *uidret, gid_t *gidret)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
* Makefile.in: Build wincap.o.
* wincap.cc: New file.
* wincap.h: Ditto.
* autoload.cc: Add dynamic load statement for `CreateHardLinkA'.
* dcrt0.cc (os_being_run): Eliminated.
(osname): Ditto.
(iswinnt): Ditto.
(set_os_type): Ditto.
(dll_crt0_1): Call wincap.init() instead of set_os_type().
(_dll_crt0): Ditto.
* environ.cc (set_chunksize): New function.
(parse_thing): `forkchunk' setting now invokes function `set_chunksize'.
* fork.cc (chunksize): Eliminated. Moved to be member of wincap.
* host_dependent.h: Removed.
* syscalls.cc (_link): Try using `CreateHardLinkA' first, if available.
* cygheap.cc, dcrt0.cc, delqueue.cc, dir.cc,
environ.cc, fhandler.cc, fhandler.h, fhandler_console.cc,
fhandler_mem.cc, fork.cc, mmap.cc, net.cc, pinfo.cc, pinfo.h,
security.cc, syscalls.cc, sysconf.cc, syslog.cc, thread.cc,
times.cc, tty.cc, uinfo.cc, uname.cc, winsup.h: Use new wincap
capability check throughout.
* winsup.h: Include wincap.h. Eliminate extern declarations of
`os_being_run' and `iswinnt'. Eliminate `os_type" definition.
* include/cygwin/version.h: Bump version to 1.3.4.
2001-09-13 01:46:37 +08:00
|
|
|
if (!wincap.has_security ())
|
2000-02-18 03:38:33 +08:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
syscall_printf ("file: %s", file);
|
|
|
|
|
2001-01-28 13:51:15 +08:00
|
|
|
/* Yeah, sounds too much, but I've seen SDs of 2100 bytes!*/
|
2000-02-18 03:38:33 +08:00
|
|
|
DWORD sd_size = 4096;
|
|
|
|
char sd_buf[4096];
|
|
|
|
PSECURITY_DESCRIPTOR psd = (PSECURITY_DESCRIPTOR) sd_buf;
|
|
|
|
|
|
|
|
int ret;
|
2000-04-26 00:31:14 +08:00
|
|
|
if ((ret = read_sd (file, psd, &sd_size)) <= 0)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
2000-04-26 00:31:14 +08:00
|
|
|
debug_printf ("read_sd %E");
|
2000-02-18 03:38:33 +08:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
PSID owner_sid;
|
|
|
|
PSID group_sid;
|
|
|
|
BOOL dummy;
|
|
|
|
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!GetSecurityDescriptorOwner (psd, &owner_sid, &dummy))
|
2000-02-18 03:38:33 +08:00
|
|
|
debug_printf ("GetSecurityDescriptorOwner %E");
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!GetSecurityDescriptorGroup (psd, &group_sid, &dummy))
|
2000-02-18 03:38:33 +08:00
|
|
|
debug_printf ("GetSecurityDescriptorGroup %E");
|
|
|
|
|
|
|
|
PACL acl;
|
|
|
|
BOOL acl_exists;
|
|
|
|
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!GetSecurityDescriptorDacl (psd, &acl_exists, &acl, &dummy))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
debug_printf ("GetSecurityDescriptorDacl %E");
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
* fork.cc (fork): Eliminate superfluous call to getuid().
* security.h: New define `NO_SID'. Remove declarations of functions
moved to methods into class cygsid.
(class cygsid): Declare new methods `getfromstr', `get_sid',
`getfrompw', `getfromgr', `get_rid', `get_uid', `get_gid', `string'
and new constructors and operators =, == and !=.
Declare new global cygsids `well_known_XXX_sid' substituting the
corresponding `get_XXX_sid' functions. Remove declarations of
these functions.
* sec_helper.cc (well_known_admin_sid): New global variable.
(well_known_system_sid): Ditto
(well_known_creator_owner_sid): Ditto
(well_known_world_sid): Ditto
(cygsid::string): New method, substituting `convert_sid_to_string_sid'.
(cygsid::get_sid): New method, substituting `get_sid'.
(cygsid::getfromstr): New method, substituting
`convert_string_sid_to_sid'.
(cygsid::getfrompw): New method, substituting `get_pw_sid'.
(cygsid::getfromgr): New method, substituting `get_gr_sid'.
(cygsid::get_id): New method, substituting `get_id_from_sid'.
(get_admin_sid): Eliminated.
(get_system_sid): Ditto.
(get_creator_owner_sid): Ditto.
(get_world_sid): Ditto.
* grp.cc: Use new cygsid methods and well known sids throughout.
* registry.cc: Ditto.
* sec_acl.cc: Ditto.
* security.cc: Ditto.
* shared.cc: Ditto.
* syscalls.cc (seteuid): Ditto. Eliminate redundant conditional.
* uinfo.cc (internal_getlogin): Ditto.
* spawn.cc (spawn_guts) Revert previous patch.
2001-05-16 03:23:31 +08:00
|
|
|
uid_t uid = cygsid(owner_sid).get_uid ();
|
|
|
|
gid_t gid = cygsid(group_sid).get_gid ();
|
2000-03-17 03:35:18 +08:00
|
|
|
if (uidret)
|
|
|
|
*uidret = uid;
|
|
|
|
if (gidret)
|
|
|
|
*gidret = gid;
|
|
|
|
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!attribute)
|
2000-03-17 03:35:18 +08:00
|
|
|
{
|
2000-05-25 04:09:43 +08:00
|
|
|
syscall_printf ("file: %s uid %d, gid %d", file, uid, gid);
|
2000-03-17 03:35:18 +08:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
BOOL grp_member = is_grp_member (uid, gid);
|
|
|
|
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!acl_exists || !acl)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
*attribute |= S_IRWXU | S_IRWXG | S_IRWXO;
|
2000-03-17 03:35:18 +08:00
|
|
|
syscall_printf ("file: %s No ACL = %x, uid %d, gid %d",
|
2000-09-03 12:16:35 +08:00
|
|
|
file, *attribute, uid, gid);
|
2000-02-18 03:38:33 +08:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
ACCESS_ALLOWED_ACE *ace;
|
|
|
|
int allow = 0;
|
|
|
|
int deny = 0;
|
|
|
|
int *flags, *anti;
|
|
|
|
|
|
|
|
for (DWORD i = 0; i < acl->AceCount; ++i)
|
|
|
|
{
|
|
|
|
if (!GetAce (acl, i, (PVOID *) &ace))
|
2000-09-03 12:16:35 +08:00
|
|
|
continue;
|
2000-02-18 03:38:33 +08:00
|
|
|
if (ace->Header.AceFlags & INHERIT_ONLY_ACE)
|
2000-09-03 12:16:35 +08:00
|
|
|
continue;
|
2000-02-18 03:38:33 +08:00
|
|
|
switch (ace->Header.AceType)
|
2000-09-03 12:16:35 +08:00
|
|
|
{
|
|
|
|
case ACCESS_ALLOWED_ACE_TYPE:
|
|
|
|
flags = &allow;
|
|
|
|
anti = &deny;
|
|
|
|
break;
|
|
|
|
case ACCESS_DENIED_ACE_TYPE:
|
|
|
|
flags = &deny;
|
|
|
|
anti = &allow;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
continue;
|
|
|
|
}
|
2000-02-18 03:38:33 +08:00
|
|
|
|
2001-04-25 17:43:25 +08:00
|
|
|
cygsid ace_sid ((PSID) &ace->SidStart);
|
|
|
|
if (owner_sid && ace_sid == owner_sid)
|
2000-09-03 12:16:35 +08:00
|
|
|
{
|
|
|
|
if (ace->Mask & FILE_READ_DATA)
|
|
|
|
*flags |= S_IRUSR;
|
|
|
|
if (ace->Mask & FILE_WRITE_DATA)
|
|
|
|
*flags |= S_IWUSR;
|
|
|
|
if (ace->Mask & FILE_EXECUTE)
|
|
|
|
*flags |= S_IXUSR;
|
|
|
|
}
|
2001-04-25 17:43:25 +08:00
|
|
|
else if (group_sid && ace_sid == group_sid)
|
2000-09-03 12:16:35 +08:00
|
|
|
{
|
|
|
|
if (ace->Mask & FILE_READ_DATA)
|
|
|
|
*flags |= S_IRGRP
|
|
|
|
| ((grp_member && !(*anti & S_IRUSR)) ? S_IRUSR : 0);
|
|
|
|
if (ace->Mask & FILE_WRITE_DATA)
|
|
|
|
*flags |= S_IWGRP
|
|
|
|
| ((grp_member && !(*anti & S_IWUSR)) ? S_IWUSR : 0);
|
|
|
|
if (ace->Mask & FILE_EXECUTE)
|
|
|
|
*flags |= S_IXGRP
|
|
|
|
| ((grp_member && !(*anti & S_IXUSR)) ? S_IXUSR : 0);
|
|
|
|
}
|
* fork.cc (fork): Eliminate superfluous call to getuid().
* security.h: New define `NO_SID'. Remove declarations of functions
moved to methods into class cygsid.
(class cygsid): Declare new methods `getfromstr', `get_sid',
`getfrompw', `getfromgr', `get_rid', `get_uid', `get_gid', `string'
and new constructors and operators =, == and !=.
Declare new global cygsids `well_known_XXX_sid' substituting the
corresponding `get_XXX_sid' functions. Remove declarations of
these functions.
* sec_helper.cc (well_known_admin_sid): New global variable.
(well_known_system_sid): Ditto
(well_known_creator_owner_sid): Ditto
(well_known_world_sid): Ditto
(cygsid::string): New method, substituting `convert_sid_to_string_sid'.
(cygsid::get_sid): New method, substituting `get_sid'.
(cygsid::getfromstr): New method, substituting
`convert_string_sid_to_sid'.
(cygsid::getfrompw): New method, substituting `get_pw_sid'.
(cygsid::getfromgr): New method, substituting `get_gr_sid'.
(cygsid::get_id): New method, substituting `get_id_from_sid'.
(get_admin_sid): Eliminated.
(get_system_sid): Ditto.
(get_creator_owner_sid): Ditto.
(get_world_sid): Ditto.
* grp.cc: Use new cygsid methods and well known sids throughout.
* registry.cc: Ditto.
* sec_acl.cc: Ditto.
* security.cc: Ditto.
* shared.cc: Ditto.
* syscalls.cc (seteuid): Ditto. Eliminate redundant conditional.
* uinfo.cc (internal_getlogin): Ditto.
* spawn.cc (spawn_guts) Revert previous patch.
2001-05-16 03:23:31 +08:00
|
|
|
else if (ace_sid == well_known_world_sid)
|
2000-09-03 12:16:35 +08:00
|
|
|
{
|
|
|
|
if (ace->Mask & FILE_READ_DATA)
|
|
|
|
*flags |= S_IROTH
|
|
|
|
| ((!(*anti & S_IRGRP)) ? S_IRGRP : 0)
|
|
|
|
| ((!(*anti & S_IRUSR)) ? S_IRUSR : 0);
|
|
|
|
if (ace->Mask & FILE_WRITE_DATA)
|
|
|
|
*flags |= S_IWOTH
|
|
|
|
| ((!(*anti & S_IWGRP)) ? S_IWGRP : 0)
|
|
|
|
| ((!(*anti & S_IWUSR)) ? S_IWUSR : 0);
|
|
|
|
if (ace->Mask & FILE_EXECUTE)
|
|
|
|
{
|
|
|
|
*flags |= S_IXOTH
|
|
|
|
| ((!(*anti & S_IXGRP)) ? S_IXGRP : 0)
|
|
|
|
| ((!(*anti & S_IXUSR)) ? S_IXUSR : 0);
|
|
|
|
}
|
2001-07-16 06:40:07 +08:00
|
|
|
if ((*attribute & S_IFDIR) &&
|
|
|
|
(ace->Mask & (FILE_WRITE_DATA | FILE_EXECUTE | FILE_DELETE_CHILD))
|
|
|
|
== (FILE_WRITE_DATA | FILE_EXECUTE))
|
|
|
|
*flags |= S_ISVTX;
|
|
|
|
}
|
|
|
|
else if (ace_sid == well_known_null_sid)
|
2001-09-08 05:32:07 +08:00
|
|
|
{
|
2001-07-16 06:40:07 +08:00
|
|
|
/* Read SUID, SGID and VTX bits from NULL ACE. */
|
|
|
|
if (ace->Mask & FILE_READ_DATA)
|
|
|
|
*flags |= S_ISVTX;
|
|
|
|
if (ace->Mask & FILE_WRITE_DATA)
|
|
|
|
*flags |= S_ISGID;
|
|
|
|
if (ace->Mask & FILE_APPEND_DATA)
|
|
|
|
*flags |= S_ISUID;
|
2000-09-03 12:16:35 +08:00
|
|
|
}
|
2000-02-18 03:38:33 +08:00
|
|
|
}
|
2001-07-16 06:40:07 +08:00
|
|
|
*attribute &= ~(S_IRWXU | S_IRWXG | S_IRWXO | S_ISVTX | S_ISGID | S_ISUID);
|
2000-02-18 03:38:33 +08:00
|
|
|
*attribute |= allow;
|
|
|
|
*attribute &= ~deny;
|
2000-03-17 03:35:18 +08:00
|
|
|
syscall_printf ("file: %s %x, uid %d, gid %d", file, *attribute, uid, gid);
|
2000-02-18 03:38:33 +08:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
int
|
2000-04-26 00:31:14 +08:00
|
|
|
get_file_attribute (int use_ntsec, const char *file,
|
2000-09-03 12:16:35 +08:00
|
|
|
int *attribute, uid_t *uidret, gid_t *gidret)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
2001-02-22 05:49:37 +08:00
|
|
|
int res;
|
|
|
|
|
2000-03-17 03:35:18 +08:00
|
|
|
if (use_ntsec && allow_ntsec)
|
2001-02-22 05:49:37 +08:00
|
|
|
{
|
|
|
|
res = get_nt_attribute (file, attribute, uidret, gidret);
|
|
|
|
if (attribute && (*attribute & S_IFLNK) == S_IFLNK)
|
|
|
|
*attribute |= S_IRWXU | S_IRWXG | S_IRWXO;
|
|
|
|
return res;
|
|
|
|
}
|
2000-02-18 03:38:33 +08:00
|
|
|
|
2000-03-17 03:35:18 +08:00
|
|
|
if (uidret)
|
|
|
|
*uidret = getuid ();
|
|
|
|
if (gidret)
|
|
|
|
*gidret = getgid ();
|
2000-02-18 03:38:33 +08:00
|
|
|
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!attribute)
|
2000-03-17 03:35:18 +08:00
|
|
|
return 0;
|
2000-02-18 03:38:33 +08:00
|
|
|
|
2001-06-05 18:45:52 +08:00
|
|
|
if (allow_ntea)
|
|
|
|
{
|
|
|
|
int oatt = *attribute;
|
|
|
|
res = NTReadEA (file, ".UNIXATTR", (char *) attribute, sizeof (*attribute));
|
|
|
|
*attribute |= oatt;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
res = 0;
|
2000-02-18 03:38:33 +08:00
|
|
|
|
2001-01-28 13:51:15 +08:00
|
|
|
/* symlinks are everything for everyone!*/
|
2000-02-18 03:38:33 +08:00
|
|
|
if ((*attribute & S_IFLNK) == S_IFLNK)
|
|
|
|
*attribute |= S_IRWXU | S_IRWXG | S_IRWXO;
|
|
|
|
|
2000-03-17 03:35:18 +08:00
|
|
|
return res > 0 ? 0 : -1;
|
2000-02-18 03:38:33 +08:00
|
|
|
}
|
|
|
|
|
2001-04-20 21:02:32 +08:00
|
|
|
BOOL
|
|
|
|
add_access_allowed_ace (PACL acl, int offset, DWORD attributes,
|
|
|
|
PSID sid, size_t &len_add, DWORD inherit)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!AddAccessAllowedAce (acl, ACL_REVISION, attributes, sid))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
ACCESS_ALLOWED_ACE *ace;
|
|
|
|
if (GetAce(acl, offset, (PVOID *) &ace))
|
|
|
|
ace->Header.AceFlags |= inherit;
|
|
|
|
len_add += sizeof (ACCESS_DENIED_ACE) - sizeof (DWORD)
|
2000-09-03 12:16:35 +08:00
|
|
|
+ GetLengthSid (sid);
|
2000-02-18 03:38:33 +08:00
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
2001-04-20 21:02:32 +08:00
|
|
|
BOOL
|
|
|
|
add_access_denied_ace (PACL acl, int offset, DWORD attributes,
|
|
|
|
PSID sid, size_t &len_add, DWORD inherit)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!AddAccessDeniedAce (acl, ACL_REVISION, attributes, sid))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
ACCESS_DENIED_ACE *ace;
|
|
|
|
if (GetAce(acl, offset, (PVOID *) &ace))
|
|
|
|
ace->Header.AceFlags |= inherit;
|
|
|
|
len_add += sizeof (ACCESS_DENIED_ACE) - sizeof (DWORD)
|
2000-09-03 12:16:35 +08:00
|
|
|
+ GetLengthSid (sid);
|
2000-02-18 03:38:33 +08:00
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
PSECURITY_DESCRIPTOR
|
|
|
|
alloc_sd (uid_t uid, gid_t gid, const char *logsrv, int attribute,
|
|
|
|
PSECURITY_DESCRIPTOR sd_ret, DWORD *sd_size_ret)
|
|
|
|
{
|
|
|
|
BOOL dummy;
|
|
|
|
|
* Makefile.in: Build wincap.o.
* wincap.cc: New file.
* wincap.h: Ditto.
* autoload.cc: Add dynamic load statement for `CreateHardLinkA'.
* dcrt0.cc (os_being_run): Eliminated.
(osname): Ditto.
(iswinnt): Ditto.
(set_os_type): Ditto.
(dll_crt0_1): Call wincap.init() instead of set_os_type().
(_dll_crt0): Ditto.
* environ.cc (set_chunksize): New function.
(parse_thing): `forkchunk' setting now invokes function `set_chunksize'.
* fork.cc (chunksize): Eliminated. Moved to be member of wincap.
* host_dependent.h: Removed.
* syscalls.cc (_link): Try using `CreateHardLinkA' first, if available.
* cygheap.cc, dcrt0.cc, delqueue.cc, dir.cc,
environ.cc, fhandler.cc, fhandler.h, fhandler_console.cc,
fhandler_mem.cc, fork.cc, mmap.cc, net.cc, pinfo.cc, pinfo.h,
security.cc, syscalls.cc, sysconf.cc, syslog.cc, thread.cc,
times.cc, tty.cc, uinfo.cc, uname.cc, winsup.h: Use new wincap
capability check throughout.
* winsup.h: Include wincap.h. Eliminate extern declarations of
`os_being_run' and `iswinnt'. Eliminate `os_type" definition.
* include/cygwin/version.h: Bump version to 1.3.4.
2001-09-13 01:46:37 +08:00
|
|
|
if (!wincap.has_security ())
|
2000-02-18 03:38:33 +08:00
|
|
|
return NULL;
|
|
|
|
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!sd_ret || !sd_size_ret)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
set_errno (EINVAL);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Get SID and name of new owner. */
|
2001-05-01 02:21:48 +08:00
|
|
|
char owner[UNLEN + 1];
|
2001-04-25 17:43:25 +08:00
|
|
|
cygsid owner_sid;
|
2000-02-18 03:38:33 +08:00
|
|
|
struct passwd *pw = getpwuid (uid);
|
|
|
|
strcpy (owner, pw ? pw->pw_name : getlogin ());
|
* fork.cc (fork): Eliminate superfluous call to getuid().
* security.h: New define `NO_SID'. Remove declarations of functions
moved to methods into class cygsid.
(class cygsid): Declare new methods `getfromstr', `get_sid',
`getfrompw', `getfromgr', `get_rid', `get_uid', `get_gid', `string'
and new constructors and operators =, == and !=.
Declare new global cygsids `well_known_XXX_sid' substituting the
corresponding `get_XXX_sid' functions. Remove declarations of
these functions.
* sec_helper.cc (well_known_admin_sid): New global variable.
(well_known_system_sid): Ditto
(well_known_creator_owner_sid): Ditto
(well_known_world_sid): Ditto
(cygsid::string): New method, substituting `convert_sid_to_string_sid'.
(cygsid::get_sid): New method, substituting `get_sid'.
(cygsid::getfromstr): New method, substituting
`convert_string_sid_to_sid'.
(cygsid::getfrompw): New method, substituting `get_pw_sid'.
(cygsid::getfromgr): New method, substituting `get_gr_sid'.
(cygsid::get_id): New method, substituting `get_id_from_sid'.
(get_admin_sid): Eliminated.
(get_system_sid): Ditto.
(get_creator_owner_sid): Ditto.
(get_world_sid): Ditto.
* grp.cc: Use new cygsid methods and well known sids throughout.
* registry.cc: Ditto.
* sec_acl.cc: Ditto.
* security.cc: Ditto.
* shared.cc: Ditto.
* syscalls.cc (seteuid): Ditto. Eliminate redundant conditional.
* uinfo.cc (internal_getlogin): Ditto.
* spawn.cc (spawn_guts) Revert previous patch.
2001-05-16 03:23:31 +08:00
|
|
|
if ((!pw || !owner_sid.getfrompw (pw))
|
2001-01-28 13:51:15 +08:00
|
|
|
&& !lookup_name (owner, logsrv, owner_sid))
|
2000-02-18 03:38:33 +08:00
|
|
|
return NULL;
|
|
|
|
debug_printf ("owner: %s [%d]", owner,
|
2001-04-25 17:43:25 +08:00
|
|
|
*GetSidSubAuthority(owner_sid,
|
|
|
|
*GetSidSubAuthorityCount(owner_sid) - 1));
|
2000-02-18 03:38:33 +08:00
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Get SID and name of new group. */
|
* fork.cc (fork): Eliminate superfluous call to getuid().
* security.h: New define `NO_SID'. Remove declarations of functions
moved to methods into class cygsid.
(class cygsid): Declare new methods `getfromstr', `get_sid',
`getfrompw', `getfromgr', `get_rid', `get_uid', `get_gid', `string'
and new constructors and operators =, == and !=.
Declare new global cygsids `well_known_XXX_sid' substituting the
corresponding `get_XXX_sid' functions. Remove declarations of
these functions.
* sec_helper.cc (well_known_admin_sid): New global variable.
(well_known_system_sid): Ditto
(well_known_creator_owner_sid): Ditto
(well_known_world_sid): Ditto
(cygsid::string): New method, substituting `convert_sid_to_string_sid'.
(cygsid::get_sid): New method, substituting `get_sid'.
(cygsid::getfromstr): New method, substituting
`convert_string_sid_to_sid'.
(cygsid::getfrompw): New method, substituting `get_pw_sid'.
(cygsid::getfromgr): New method, substituting `get_gr_sid'.
(cygsid::get_id): New method, substituting `get_id_from_sid'.
(get_admin_sid): Eliminated.
(get_system_sid): Ditto.
(get_creator_owner_sid): Ditto.
(get_world_sid): Ditto.
* grp.cc: Use new cygsid methods and well known sids throughout.
* registry.cc: Ditto.
* sec_acl.cc: Ditto.
* security.cc: Ditto.
* shared.cc: Ditto.
* syscalls.cc (seteuid): Ditto. Eliminate redundant conditional.
* uinfo.cc (internal_getlogin): Ditto.
* spawn.cc (spawn_guts) Revert previous patch.
2001-05-16 03:23:31 +08:00
|
|
|
cygsid group_sid (NO_SID);
|
2000-02-18 03:38:33 +08:00
|
|
|
struct group *grp = getgrgid (gid);
|
|
|
|
if (grp)
|
|
|
|
{
|
* fork.cc (fork): Eliminate superfluous call to getuid().
* security.h: New define `NO_SID'. Remove declarations of functions
moved to methods into class cygsid.
(class cygsid): Declare new methods `getfromstr', `get_sid',
`getfrompw', `getfromgr', `get_rid', `get_uid', `get_gid', `string'
and new constructors and operators =, == and !=.
Declare new global cygsids `well_known_XXX_sid' substituting the
corresponding `get_XXX_sid' functions. Remove declarations of
these functions.
* sec_helper.cc (well_known_admin_sid): New global variable.
(well_known_system_sid): Ditto
(well_known_creator_owner_sid): Ditto
(well_known_world_sid): Ditto
(cygsid::string): New method, substituting `convert_sid_to_string_sid'.
(cygsid::get_sid): New method, substituting `get_sid'.
(cygsid::getfromstr): New method, substituting
`convert_string_sid_to_sid'.
(cygsid::getfrompw): New method, substituting `get_pw_sid'.
(cygsid::getfromgr): New method, substituting `get_gr_sid'.
(cygsid::get_id): New method, substituting `get_id_from_sid'.
(get_admin_sid): Eliminated.
(get_system_sid): Ditto.
(get_creator_owner_sid): Ditto.
(get_world_sid): Ditto.
* grp.cc: Use new cygsid methods and well known sids throughout.
* registry.cc: Ditto.
* sec_acl.cc: Ditto.
* security.cc: Ditto.
* shared.cc: Ditto.
* syscalls.cc (seteuid): Ditto. Eliminate redundant conditional.
* uinfo.cc (internal_getlogin): Ditto.
* spawn.cc (spawn_guts) Revert previous patch.
2001-05-16 03:23:31 +08:00
|
|
|
if ((!grp || !group_sid.getfromgr (grp))
|
2001-01-28 13:51:15 +08:00
|
|
|
&& !lookup_name (grp->gr_name, logsrv, group_sid))
|
2000-09-03 12:16:35 +08:00
|
|
|
return NULL;
|
2000-02-18 03:38:33 +08:00
|
|
|
}
|
|
|
|
else
|
|
|
|
debug_printf ("no group");
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Initialize local security descriptor. */
|
2000-02-18 03:38:33 +08:00
|
|
|
SECURITY_DESCRIPTOR sd;
|
|
|
|
PSECURITY_DESCRIPTOR psd = NULL;
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!InitializeSecurityDescriptor (&sd, SECURITY_DESCRIPTOR_REVISION))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2000-12-20 20:42:43 +08:00
|
|
|
/*
|
2001-04-23 06:12:12 +08:00
|
|
|
* We set the SE_DACL_PROTECTED flag here to prevent the DACL from being
|
|
|
|
* modified by inheritable ACEs.
|
|
|
|
* This flag as well as the SetSecurityDescriptorControl call are available
|
|
|
|
* only since Win2K.
|
2000-12-20 20:42:43 +08:00
|
|
|
*/
|
* Makefile.in: Build wincap.o.
* wincap.cc: New file.
* wincap.h: Ditto.
* autoload.cc: Add dynamic load statement for `CreateHardLinkA'.
* dcrt0.cc (os_being_run): Eliminated.
(osname): Ditto.
(iswinnt): Ditto.
(set_os_type): Ditto.
(dll_crt0_1): Call wincap.init() instead of set_os_type().
(_dll_crt0): Ditto.
* environ.cc (set_chunksize): New function.
(parse_thing): `forkchunk' setting now invokes function `set_chunksize'.
* fork.cc (chunksize): Eliminated. Moved to be member of wincap.
* host_dependent.h: Removed.
* syscalls.cc (_link): Try using `CreateHardLinkA' first, if available.
* cygheap.cc, dcrt0.cc, delqueue.cc, dir.cc,
environ.cc, fhandler.cc, fhandler.h, fhandler_console.cc,
fhandler_mem.cc, fork.cc, mmap.cc, net.cc, pinfo.cc, pinfo.h,
security.cc, syscalls.cc, sysconf.cc, syslog.cc, thread.cc,
times.cc, tty.cc, uinfo.cc, uname.cc, winsup.h: Use new wincap
capability check throughout.
* winsup.h: Include wincap.h. Eliminate extern declarations of
`os_being_run' and `iswinnt'. Eliminate `os_type" definition.
* include/cygwin/version.h: Bump version to 1.3.4.
2001-09-13 01:46:37 +08:00
|
|
|
if (wincap.has_security_descriptor_control ())
|
2000-12-20 20:42:43 +08:00
|
|
|
SetSecurityDescriptorControl (&sd, SE_DACL_PROTECTED, SE_DACL_PROTECTED);
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Create owner for local security descriptor. */
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!SetSecurityDescriptorOwner(&sd, owner_sid, FALSE))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return NULL;
|
|
|
|
}
|
2000-10-23 16:02:38 +08:00
|
|
|
|
|
|
|
/* Create group for local security descriptor. */
|
2001-01-28 13:51:15 +08:00
|
|
|
if (group_sid && !SetSecurityDescriptorGroup(&sd, group_sid, FALSE))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Initialize local access control list. */
|
2000-02-18 03:38:33 +08:00
|
|
|
char acl_buf[3072];
|
|
|
|
PACL acl = (PACL) acl_buf;
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!InitializeAcl (acl, 3072, ACL_REVISION))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* From here fill ACL. */
|
2000-02-18 03:38:33 +08:00
|
|
|
size_t acl_len = sizeof (ACL);
|
|
|
|
int ace_off = 0;
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Construct allow attribute for owner. */
|
2000-02-18 03:38:33 +08:00
|
|
|
DWORD owner_allow = (STANDARD_RIGHTS_ALL & ~DELETE)
|
2000-09-03 12:16:35 +08:00
|
|
|
| FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA;
|
2000-02-18 03:38:33 +08:00
|
|
|
if (attribute & S_IRUSR)
|
|
|
|
owner_allow |= FILE_GENERIC_READ;
|
|
|
|
if (attribute & S_IWUSR)
|
2001-07-27 17:17:57 +08:00
|
|
|
owner_allow |= FILE_GENERIC_WRITE | DELETE;
|
2000-02-18 03:38:33 +08:00
|
|
|
if (attribute & S_IXUSR)
|
|
|
|
owner_allow |= FILE_GENERIC_EXECUTE;
|
2001-07-16 06:40:07 +08:00
|
|
|
if ((attribute & (S_IFDIR | S_IWUSR | S_IXUSR))
|
|
|
|
== (S_IFDIR | S_IWUSR | S_IXUSR))
|
2000-02-18 03:38:33 +08:00
|
|
|
owner_allow |= FILE_DELETE_CHILD;
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Construct allow attribute for group. */
|
2000-02-18 03:38:33 +08:00
|
|
|
DWORD group_allow = STANDARD_RIGHTS_READ
|
2000-09-03 12:16:35 +08:00
|
|
|
| FILE_READ_ATTRIBUTES | FILE_READ_EA;
|
2000-02-18 03:38:33 +08:00
|
|
|
if (attribute & S_IRGRP)
|
|
|
|
group_allow |= FILE_GENERIC_READ;
|
|
|
|
if (attribute & S_IWGRP)
|
2001-07-16 06:40:07 +08:00
|
|
|
group_allow |= STANDARD_RIGHTS_WRITE | FILE_GENERIC_WRITE;
|
2000-02-18 03:38:33 +08:00
|
|
|
if (attribute & S_IXGRP)
|
|
|
|
group_allow |= FILE_GENERIC_EXECUTE;
|
2001-07-16 06:40:07 +08:00
|
|
|
if ((attribute & (S_IFDIR | S_IWGRP | S_IXGRP))
|
2001-08-08 00:14:59 +08:00
|
|
|
== (S_IFDIR | S_IWGRP | S_IXGRP)
|
|
|
|
&& !(attribute & S_ISVTX))
|
2000-02-18 03:38:33 +08:00
|
|
|
group_allow |= FILE_DELETE_CHILD;
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Construct allow attribute for everyone. */
|
2000-02-18 03:38:33 +08:00
|
|
|
DWORD other_allow = STANDARD_RIGHTS_READ
|
2000-09-03 12:16:35 +08:00
|
|
|
| FILE_READ_ATTRIBUTES | FILE_READ_EA;
|
2000-02-18 03:38:33 +08:00
|
|
|
if (attribute & S_IROTH)
|
|
|
|
other_allow |= FILE_GENERIC_READ;
|
|
|
|
if (attribute & S_IWOTH)
|
2001-07-16 06:40:07 +08:00
|
|
|
other_allow |= STANDARD_RIGHTS_WRITE | FILE_GENERIC_WRITE;
|
2000-02-18 03:38:33 +08:00
|
|
|
if (attribute & S_IXOTH)
|
|
|
|
other_allow |= FILE_GENERIC_EXECUTE;
|
2001-07-16 06:40:07 +08:00
|
|
|
if ((attribute & (S_IFDIR | S_IWOTH | S_IXOTH))
|
|
|
|
== (S_IFDIR | S_IWOTH | S_IXOTH)
|
|
|
|
&& !(attribute & S_ISVTX))
|
2000-02-18 03:38:33 +08:00
|
|
|
other_allow |= FILE_DELETE_CHILD;
|
2000-10-28 13:41:44 +08:00
|
|
|
|
2001-07-16 06:40:07 +08:00
|
|
|
/* Construct SUID, SGID and VTX bits in NULL ACE. */
|
|
|
|
DWORD null_allow = 0L;
|
|
|
|
if (attribute & (S_ISUID | S_ISGID | S_ISVTX))
|
|
|
|
{
|
|
|
|
if (attribute & S_ISUID)
|
2001-09-08 05:32:07 +08:00
|
|
|
null_allow |= FILE_APPEND_DATA;
|
2001-07-16 06:40:07 +08:00
|
|
|
if (attribute & S_ISGID)
|
2001-09-08 05:32:07 +08:00
|
|
|
null_allow |= FILE_WRITE_DATA;
|
2001-07-16 06:40:07 +08:00
|
|
|
if (attribute & S_ISVTX)
|
2001-09-08 05:32:07 +08:00
|
|
|
null_allow |= FILE_READ_DATA;
|
2001-07-16 06:40:07 +08:00
|
|
|
}
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Construct deny attributes for owner and group. */
|
2000-02-18 03:38:33 +08:00
|
|
|
DWORD owner_deny = 0;
|
|
|
|
if (is_grp_member (uid, gid))
|
|
|
|
owner_deny = ~owner_allow & (group_allow | other_allow);
|
|
|
|
else
|
|
|
|
owner_deny = ~owner_allow & other_allow;
|
|
|
|
owner_deny &= ~(STANDARD_RIGHTS_READ
|
2000-09-03 12:16:35 +08:00
|
|
|
| FILE_READ_ATTRIBUTES | FILE_READ_EA
|
|
|
|
| FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA);
|
2000-02-18 03:38:33 +08:00
|
|
|
DWORD group_deny = ~group_allow & other_allow;
|
|
|
|
group_deny &= ~(STANDARD_RIGHTS_READ | FILE_READ_ATTRIBUTES | FILE_READ_EA);
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Construct appropriate inherit attribute. */
|
2000-05-25 04:09:43 +08:00
|
|
|
DWORD inherit = (attribute & S_IFDIR) ? INHERIT_ALL : DONT_INHERIT;
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Set deny ACE for owner. */
|
2000-02-18 03:38:33 +08:00
|
|
|
if (owner_deny
|
2001-01-28 13:51:15 +08:00
|
|
|
&& !add_access_denied_ace (acl, ace_off++, owner_deny,
|
2000-09-03 12:16:35 +08:00
|
|
|
owner_sid, acl_len, inherit))
|
2001-07-16 06:40:07 +08:00
|
|
|
return NULL;
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Set allow ACE for owner. */
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, owner_allow,
|
2000-09-03 12:16:35 +08:00
|
|
|
owner_sid, acl_len, inherit))
|
2000-02-18 03:38:33 +08:00
|
|
|
return NULL;
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Set deny ACE for group. */
|
2000-02-18 03:38:33 +08:00
|
|
|
if (group_deny
|
2001-01-28 13:51:15 +08:00
|
|
|
&& !add_access_denied_ace (acl, ace_off++, group_deny,
|
2000-09-03 12:16:35 +08:00
|
|
|
group_sid, acl_len, inherit))
|
2001-07-16 06:40:07 +08:00
|
|
|
return NULL;
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Set allow ACE for group. */
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, group_allow,
|
2000-09-03 12:16:35 +08:00
|
|
|
group_sid, acl_len, inherit))
|
2000-02-18 03:38:33 +08:00
|
|
|
return NULL;
|
|
|
|
|
2001-04-26 17:21:33 +08:00
|
|
|
/* Set allow ACE for everyone. */
|
|
|
|
if (!add_access_allowed_ace (acl, ace_off++, other_allow,
|
* fork.cc (fork): Eliminate superfluous call to getuid().
* security.h: New define `NO_SID'. Remove declarations of functions
moved to methods into class cygsid.
(class cygsid): Declare new methods `getfromstr', `get_sid',
`getfrompw', `getfromgr', `get_rid', `get_uid', `get_gid', `string'
and new constructors and operators =, == and !=.
Declare new global cygsids `well_known_XXX_sid' substituting the
corresponding `get_XXX_sid' functions. Remove declarations of
these functions.
* sec_helper.cc (well_known_admin_sid): New global variable.
(well_known_system_sid): Ditto
(well_known_creator_owner_sid): Ditto
(well_known_world_sid): Ditto
(cygsid::string): New method, substituting `convert_sid_to_string_sid'.
(cygsid::get_sid): New method, substituting `get_sid'.
(cygsid::getfromstr): New method, substituting
`convert_string_sid_to_sid'.
(cygsid::getfrompw): New method, substituting `get_pw_sid'.
(cygsid::getfromgr): New method, substituting `get_gr_sid'.
(cygsid::get_id): New method, substituting `get_id_from_sid'.
(get_admin_sid): Eliminated.
(get_system_sid): Ditto.
(get_creator_owner_sid): Ditto.
(get_world_sid): Ditto.
* grp.cc: Use new cygsid methods and well known sids throughout.
* registry.cc: Ditto.
* sec_acl.cc: Ditto.
* security.cc: Ditto.
* shared.cc: Ditto.
* syscalls.cc (seteuid): Ditto. Eliminate redundant conditional.
* uinfo.cc (internal_getlogin): Ditto.
* spawn.cc (spawn_guts) Revert previous patch.
2001-05-16 03:23:31 +08:00
|
|
|
well_known_world_sid, acl_len, inherit))
|
2001-04-26 17:21:33 +08:00
|
|
|
return NULL;
|
2001-07-16 06:40:07 +08:00
|
|
|
/* Set null ACE for special bits. */
|
|
|
|
if (null_allow
|
|
|
|
&& !add_access_allowed_ace (acl, ace_off++, null_allow,
|
2001-08-08 18:00:35 +08:00
|
|
|
well_known_null_sid, acl_len, DONT_INHERIT))
|
2001-07-16 06:40:07 +08:00
|
|
|
return NULL;
|
2001-04-26 17:21:33 +08:00
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Get owner and group from current security descriptor. */
|
2000-02-18 03:38:33 +08:00
|
|
|
PSID cur_owner_sid = NULL;
|
|
|
|
PSID cur_group_sid = NULL;
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!GetSecurityDescriptorOwner (sd_ret, &cur_owner_sid, &dummy))
|
2000-02-18 03:38:33 +08:00
|
|
|
debug_printf ("GetSecurityDescriptorOwner %E");
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!GetSecurityDescriptorGroup (sd_ret, &cur_group_sid, &dummy))
|
2000-02-18 03:38:33 +08:00
|
|
|
debug_printf ("GetSecurityDescriptorGroup %E");
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Fill ACL with unrelated ACEs from current security descriptor. */
|
2000-02-18 03:38:33 +08:00
|
|
|
PACL oacl;
|
|
|
|
BOOL acl_exists;
|
|
|
|
ACCESS_ALLOWED_ACE *ace;
|
|
|
|
if (GetSecurityDescriptorDacl (sd_ret, &acl_exists, &oacl, &dummy)
|
|
|
|
&& acl_exists && oacl)
|
|
|
|
for (DWORD i = 0; i < oacl->AceCount; ++i)
|
|
|
|
if (GetAce (oacl, i, (PVOID *) &ace))
|
2000-09-03 12:16:35 +08:00
|
|
|
{
|
2001-04-25 17:43:25 +08:00
|
|
|
cygsid ace_sid ((PSID) &ace->SidStart);
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Check for related ACEs. */
|
2001-04-25 17:43:25 +08:00
|
|
|
if ((cur_owner_sid && ace_sid == cur_owner_sid)
|
|
|
|
|| (owner_sid && ace_sid == owner_sid)
|
|
|
|
|| (cur_group_sid && ace_sid == cur_group_sid)
|
|
|
|
|| (group_sid && ace_sid == group_sid)
|
2001-07-16 06:40:07 +08:00
|
|
|
|| (ace_sid == well_known_world_sid)
|
|
|
|
|| (ace_sid == well_known_null_sid))
|
2000-09-03 12:16:35 +08:00
|
|
|
continue;
|
2000-10-23 16:02:38 +08:00
|
|
|
/*
|
|
|
|
* Add unrelated ACCESS_DENIED_ACE to the beginning but
|
2001-04-26 17:21:33 +08:00
|
|
|
* behind the owner_deny, ACCESS_ALLOWED_ACE to the end.
|
2000-10-23 16:02:38 +08:00
|
|
|
*/
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!AddAce(acl, ACL_REVISION,
|
2000-09-03 12:16:35 +08:00
|
|
|
ace->Header.AceType == ACCESS_DENIED_ACE_TYPE ?
|
|
|
|
(owner_deny ? 1 : 0) : MAXDWORD,
|
|
|
|
(LPVOID) ace, ace->Header.AceSize))
|
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
acl_len += ace->Header.AceSize;
|
|
|
|
}
|
2000-02-18 03:38:33 +08:00
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Set AclSize to computed value. */
|
2000-02-18 03:38:33 +08:00
|
|
|
acl->AclSize = acl_len;
|
|
|
|
debug_printf ("ACL-Size: %d", acl_len);
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Create DACL for local security descriptor. */
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!SetSecurityDescriptorDacl (&sd, TRUE, acl, FALSE))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2000-10-23 16:02:38 +08:00
|
|
|
/* Make self relative security descriptor. */
|
2000-02-18 03:38:33 +08:00
|
|
|
*sd_size_ret = 0;
|
|
|
|
MakeSelfRelativeSD (&sd, sd_ret, sd_size_ret);
|
|
|
|
if (*sd_size_ret <= 0)
|
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return NULL;
|
|
|
|
}
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!MakeSelfRelativeSD (&sd, sd_ret, sd_size_ret))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
|
|
|
__seterrno ();
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
psd = sd_ret;
|
|
|
|
debug_printf ("Created SD-Size: %d", *sd_size_ret);
|
|
|
|
|
|
|
|
return psd;
|
|
|
|
}
|
|
|
|
|
2001-08-07 23:09:54 +08:00
|
|
|
void
|
|
|
|
set_security_attribute (int attribute, PSECURITY_ATTRIBUTES psa,
|
|
|
|
void *sd_buf, DWORD sd_buf_size)
|
|
|
|
{
|
|
|
|
/* symlinks are anything for everyone!*/
|
|
|
|
if ((attribute & S_IFLNK) == S_IFLNK)
|
|
|
|
attribute |= S_IRWXU | S_IRWXG | S_IRWXO;
|
|
|
|
|
|
|
|
psa->lpSecurityDescriptor = sd_buf;
|
|
|
|
InitializeSecurityDescriptor ((PSECURITY_DESCRIPTOR)sd_buf,
|
2001-09-08 05:32:07 +08:00
|
|
|
SECURITY_DESCRIPTOR_REVISION);
|
2001-08-07 23:09:54 +08:00
|
|
|
psa->lpSecurityDescriptor = alloc_sd (geteuid (), getegid (),
|
|
|
|
cygheap->user.logsrv (),
|
|
|
|
attribute, (PSECURITY_DESCRIPTOR)sd_buf,
|
|
|
|
&sd_buf_size);
|
|
|
|
}
|
|
|
|
|
2000-02-18 03:38:33 +08:00
|
|
|
static int
|
|
|
|
set_nt_attribute (const char *file, uid_t uid, gid_t gid,
|
2000-09-03 12:16:35 +08:00
|
|
|
const char *logsrv, int attribute)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
* Makefile.in: Build wincap.o.
* wincap.cc: New file.
* wincap.h: Ditto.
* autoload.cc: Add dynamic load statement for `CreateHardLinkA'.
* dcrt0.cc (os_being_run): Eliminated.
(osname): Ditto.
(iswinnt): Ditto.
(set_os_type): Ditto.
(dll_crt0_1): Call wincap.init() instead of set_os_type().
(_dll_crt0): Ditto.
* environ.cc (set_chunksize): New function.
(parse_thing): `forkchunk' setting now invokes function `set_chunksize'.
* fork.cc (chunksize): Eliminated. Moved to be member of wincap.
* host_dependent.h: Removed.
* syscalls.cc (_link): Try using `CreateHardLinkA' first, if available.
* cygheap.cc, dcrt0.cc, delqueue.cc, dir.cc,
environ.cc, fhandler.cc, fhandler.h, fhandler_console.cc,
fhandler_mem.cc, fork.cc, mmap.cc, net.cc, pinfo.cc, pinfo.h,
security.cc, syscalls.cc, sysconf.cc, syslog.cc, thread.cc,
times.cc, tty.cc, uinfo.cc, uname.cc, winsup.h: Use new wincap
capability check throughout.
* winsup.h: Include wincap.h. Eliminate extern declarations of
`os_being_run' and `iswinnt'. Eliminate `os_type" definition.
* include/cygwin/version.h: Bump version to 1.3.4.
2001-09-13 01:46:37 +08:00
|
|
|
if (!wincap.has_security ())
|
2000-02-18 03:38:33 +08:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
DWORD sd_size = 4096;
|
|
|
|
char sd_buf[4096];
|
|
|
|
PSECURITY_DESCRIPTOR psd = (PSECURITY_DESCRIPTOR) sd_buf;
|
|
|
|
|
|
|
|
int ret;
|
2000-04-26 00:31:14 +08:00
|
|
|
if ((ret = read_sd (file, psd, &sd_size)) <= 0)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
2000-04-26 00:31:14 +08:00
|
|
|
debug_printf ("read_sd %E");
|
2001-08-15 18:21:39 +08:00
|
|
|
return -1;
|
2000-02-18 03:38:33 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
sd_size = 4096;
|
2001-01-28 13:51:15 +08:00
|
|
|
if (!(psd = alloc_sd (uid, gid, logsrv, attribute, psd, &sd_size)))
|
2000-02-18 03:38:33 +08:00
|
|
|
return -1;
|
|
|
|
|
2000-04-26 00:31:14 +08:00
|
|
|
return write_sd (file, psd, sd_size);
|
2000-02-18 03:38:33 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
int
|
|
|
|
set_file_attribute (int use_ntsec, const char *file,
|
2000-09-03 12:16:35 +08:00
|
|
|
uid_t uid, gid_t gid,
|
|
|
|
int attribute, const char *logsrv)
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
2001-08-03 00:01:47 +08:00
|
|
|
int ret = 0;
|
|
|
|
|
|
|
|
if (use_ntsec && allow_ntsec)
|
|
|
|
ret = set_nt_attribute (file, uid, gid, logsrv, attribute);
|
|
|
|
else if (allow_ntea && !NTWriteEA (file, ".UNIXATTR", (char *) &attribute,
|
|
|
|
sizeof (attribute)))
|
2000-02-18 03:38:33 +08:00
|
|
|
{
|
2001-08-03 00:01:47 +08:00
|
|
|
__seterrno ();
|
|
|
|
ret = -1;
|
2000-02-18 03:38:33 +08:00
|
|
|
}
|
|
|
|
syscall_printf ("%d = set_file_attribute (%s, %d, %d, %p)",
|
2000-03-17 03:35:18 +08:00
|
|
|
ret, file, uid, gid, attribute);
|
|
|
|
return ret;
|
2000-02-18 03:38:33 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
int
|
|
|
|
set_file_attribute (int use_ntsec, const char *file, int attribute)
|
|
|
|
{
|
|
|
|
return set_file_attribute (use_ntsec, file,
|
2000-09-03 12:16:35 +08:00
|
|
|
myself->uid, myself->gid,
|
2000-11-15 08:13:09 +08:00
|
|
|
attribute, cygheap->user.logsrv ());
|
2000-02-18 03:38:33 +08:00
|
|
|
}
|