BOOL ImpersonateAndCheckAccess(PCtxtHandle phContext, PSECURITY_DESCRIPTOR psdSD, PDWORD pdwAccessGranted) { HANDLE hToken = NULL; // AccessCheck() variables DWORD dwAccessDesired = MAXIMUM_ALLOWED; PRIVILEGE_SET PrivilegeSet; DWORD dwPrivSetSize = sizeof(PRIVILEGE_SET); BOOL fAccessGranted = FALSE; GENERIC_MAPPING GenericMapping = { vncGenericRead, vncGenericWrite, vncGenericExecute, vncGenericAll }; // This only does something if we want to use generic access // rights, like GENERIC_ALL, in our call to AccessCheck(). MapGenericMask(&dwAccessDesired, &GenericMapping); // AccessCheck() requires an impersonation token. if ((fn._ImpersonateSecurityContext(phContext) == SEC_E_OK) && OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &hToken) && AccessCheck(psdSD, hToken, dwAccessDesired, &GenericMapping, &PrivilegeSet, &dwPrivSetSize, pdwAccessGranted, &fAccessGranted)) { // Restrict access to relevant rights only fAccessGranted = AreAnyAccessesGranted(*pdwAccessGranted, ViewOnly | Interact); } // End impersonation fn._RevertSecurityContext(phContext); // Close handles if (hToken) CloseHandle(hToken); return fAccessGranted; }
STDMETHODIMP CObjSecurity::MapGeneric(const GUID* /*pguidObjectType*/, UCHAR * /*pAceFlags*/, ACCESS_MASK *pmask) { MapGenericMask(pmask, &ObjMap); return S_OK; }
STDMETHOD(MapGeneric) (THIS_ const GUID *pguidObjectType, UCHAR *pAceFlags, ACCESS_MASK *pMask) { GENERIC_MAPPING mapping; mapping.GenericRead = 1<<0; mapping.GenericWrite = 1<<1; mapping.GenericExecute = 1<<2; mapping.GenericAll = 7; MapGenericMask(pMask, &mapping); return S_OK; }
TSRM_API int tsrm_win32_access(const char *pathname, int mode) { time_t t; HANDLE thread_token = NULL; PSID token_sid; SECURITY_INFORMATION sec_info = OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION; GENERIC_MAPPING gen_map = { FILE_GENERIC_READ, FILE_GENERIC_WRITE, FILE_GENERIC_EXECUTE, FILE_ALL_ACCESS }; DWORD priv_set_length = sizeof(PRIVILEGE_SET); PRIVILEGE_SET privilege_set = {0}; DWORD sec_desc_length = 0, desired_access = 0, granted_access = 0; BYTE * psec_desc = NULL; BOOL fAccess = FALSE; realpath_cache_bucket * bucket = NULL; char * real_path = NULL; if (mode == 1 /*X_OK*/) { DWORD type; return GetBinaryType(pathname, &type) ? 0 : -1; } else { if(!IS_ABSOLUTE_PATH(pathname, strlen(pathname)+1)) { real_path = (char *)malloc(MAX_PATH); if(tsrm_realpath(pathname, real_path) == NULL) { goto Finished; } pathname = real_path; } if(access(pathname, mode)) { free(real_path); return errno; } /* If only existence check is made, return now */ if (mode == 0) { free(real_path); return 0; } /* Only in NTS when impersonate==1 (aka FastCGI) */ /* AccessCheck() requires an impersonation token. We first get a primary token and then create a duplicate impersonation token. The impersonation token is not actually assigned to the thread, but is used in the call to AccessCheck. Thus, this function itself never impersonates, but does use the identity of the thread. If the thread was impersonating already, this function uses that impersonation context. */ if(!OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, &thread_token)) { if (GetLastError() == ERROR_NO_TOKEN) { if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &thread_token)) { TWG(impersonation_token) = NULL; goto Finished; } } } /* token_sid will be freed in tsrmwin32_dtor */ token_sid = tsrm_win32_get_token_sid(thread_token); if (!token_sid) { if (TWG(impersonation_token_sid)) { free(TWG(impersonation_token_sid)); } TWG(impersonation_token_sid) = NULL; goto Finished; } /* Different identity, we need a new impersontated token as well */ if (!TWG(impersonation_token_sid) || !EqualSid(token_sid, TWG(impersonation_token_sid))) { if (TWG(impersonation_token_sid)) { free(TWG(impersonation_token_sid)); } TWG(impersonation_token_sid) = token_sid; /* Duplicate the token as impersonated token */ if (!DuplicateToken(thread_token, SecurityImpersonation, &TWG(impersonation_token))) { goto Finished; } } else { /* we already have it, free it then */ free(token_sid); } if (CWDG(realpath_cache_size_limit)) { t = time(0); bucket = realpath_cache_lookup(pathname, (int)strlen(pathname), t); if(bucket == NULL && real_path == NULL) { /* We used the pathname directly. Call tsrm_realpath */ /* so that entry is created in realpath cache */ real_path = (char *)malloc(MAX_PATH); if(tsrm_realpath(pathname, real_path) != NULL) { pathname = real_path; bucket = realpath_cache_lookup(pathname, (int)strlen(pathname), t); } } } /* Do a full access check because access() will only check read-only attribute */ if(mode == 0 || mode > 6) { if(bucket != NULL && bucket->is_rvalid) { fAccess = bucket->is_readable; goto Finished; } desired_access = FILE_GENERIC_READ; } else if(mode <= 2) { if(bucket != NULL && bucket->is_wvalid) { fAccess = bucket->is_writable; goto Finished; } desired_access = FILE_GENERIC_WRITE; } else if(mode <= 4) { if(bucket != NULL && bucket->is_rvalid) { fAccess = bucket->is_readable; goto Finished; } desired_access = FILE_GENERIC_READ|FILE_FLAG_BACKUP_SEMANTICS; } else { // if(mode <= 6) if(bucket != NULL && bucket->is_rvalid && bucket->is_wvalid) { fAccess = bucket->is_readable & bucket->is_writable; goto Finished; } desired_access = FILE_GENERIC_READ | FILE_GENERIC_WRITE; } if(TWG(impersonation_token) == NULL) { goto Finished; } /* Get size of security buffer. Call is expected to fail */ if(GetFileSecurity(pathname, sec_info, NULL, 0, &sec_desc_length)) { goto Finished; } psec_desc = (BYTE *)malloc(sec_desc_length); if(psec_desc == NULL || !GetFileSecurity(pathname, sec_info, (PSECURITY_DESCRIPTOR)psec_desc, sec_desc_length, &sec_desc_length)) { goto Finished; } MapGenericMask(&desired_access, &gen_map); if(!AccessCheck((PSECURITY_DESCRIPTOR)psec_desc, TWG(impersonation_token), desired_access, &gen_map, &privilege_set, &priv_set_length, &granted_access, &fAccess)) { goto Finished_Impersonate; } /* Keep the result in realpath_cache */ if(bucket != NULL) { if(desired_access == (FILE_GENERIC_READ|FILE_FLAG_BACKUP_SEMANTICS)) { bucket->is_rvalid = 1; bucket->is_readable = fAccess; } else if(desired_access == FILE_GENERIC_WRITE) { bucket->is_wvalid = 1; bucket->is_writable = fAccess; } else if (desired_access == (FILE_GENERIC_READ | FILE_GENERIC_WRITE)) { bucket->is_rvalid = 1; bucket->is_readable = fAccess; bucket->is_wvalid = 1; bucket->is_writable = fAccess; } } Finished_Impersonate: if(psec_desc != NULL) { free(psec_desc); psec_desc = NULL; } Finished: if(thread_token != NULL) { CloseHandle(thread_token); } if(real_path != NULL) { free(real_path); real_path = NULL; } if(fAccess == FALSE) { errno = EACCES; return errno; } else { return 0; } } }
STDMETHODIMP vncSecurityInfo::MapGeneric(const GUID*, UCHAR* pAceFlags, ACCESS_MASK* pMask){ // here's where we hand back the generic permissions mapping MapGenericMask(pMask, const_cast<GENERIC_MAPPING*>(&g_vncGenericMapping)); return S_OK; }