NTSTATUS
NtSetInformationToken (
IN HANDLE TokenHandle,
IN TOKEN_INFORMATION_CLASS TokenInformationClass,
IN PVOID TokenInformation,
IN ULONG TokenInformationLength
)
/*++
Routine Description:
Modify information in a specified token.
Arguments:
TokenHandle - Provides a handle to the token to operate on.
TokenInformationClass - The token information class being set.
TokenInformation - The buffer containing the new values for the
specified class of information. The buffer must be aligned
on at least a longword boundary. The actual structures
provided are dependent upon the information class specified,
as defined in the TokenInformationClass parameter
description.
TokenInformation Format By Information Class:
TokenUser => This value is not a valid value for this API.
The User ID may not be replaced.
TokenGroups => This value is not a valid value for this
API. The Group IDs may not be replaced. However, groups
may be enabled and disabled using NtAdjustGroupsToken().
TokenPrivileges => This value is not a valid value for
this API. Privilege information may not be replaced.
However, privileges may be explicitly enabled and disabled
using the NtAdjustPrivilegesToken API.
TokenOwner => TOKEN_OWNER data structure.
TOKEN_ADJUST_DEFAULT access is needed to replace this
information in a token. The owner values that may be
specified are restricted to the user and group IDs with an
attribute indicating they may be assigned as the owner of
objects.
TokenPrimaryGroup => TOKEN_PRIMARY_GROUP data structure.
TOKEN_ADJUST_DEFAULT access is needed to replace this
information in a token. The primary group values that may
be specified are restricted to be one of the group IDs
already in the token.
TokenDefaultDacl => TOKEN_DEFAULT_DACL data structure.
TOKEN_ADJUST_DEFAULT access is needed to replace this
information in a token. The ACL provided as a new default
discretionary ACL is not validated for structural
correctness or consistency.
TokenSource => This value is not a valid value for this
API. The source name and context handle may not be
replaced.
TokenStatistics => This value is not a valid value for this
API. The statistics of a token are read-only.
TokenInformationLength - Indicates the length, in bytes, of the
TokenInformation buffer. This is only the length of the primary
buffer. All extensions of the primary buffer are self describing.
Return Value:
STATUS_SUCCESS - The operation was successful.
STATUS_INVALID_OWNER - The ID specified to be an owner (or
default owner) is not one the caller may assign as the owner
of an object.
STATUS_INVALID_INFO_CLASS - The specified information class is
not one that may be specified in this API.
STATUS_ALLOTTED_SPACE_EXCEEDED - The space allotted for storage
of the default discretionary access control and the primary
group ID is not large enough to accept the new value of one
of these fields.
--*/
{
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status;
PTOKEN Token;
ULONG Index;
BOOLEAN Found;
BOOLEAN TokenModified = FALSE;
ULONG NewLength;
ULONG CurrentLength;
PSID CapturedOwner;
PSID CapturedPrimaryGroup;
PACL CapturedDefaultDacl;
PAGED_CODE();
//
// Get previous processor mode and probe input buffer if necessary.
//
PreviousMode = KeGetPreviousMode();
if (PreviousMode != KernelMode) {
try {
//
// This just probes the main part of the information buffer.
// Any information class-specific data hung off the primary
// buffer are self describing and must be probed separately
// below.
//
ProbeForRead(
TokenInformation,
TokenInformationLength,
sizeof(ULONG)
);
} except(EXCEPTION_EXECUTE_HANDLER) {
return GetExceptionCode();
}
}
//
// Return error if not legal class
//
if ( (TokenInformationClass != TokenOwner) &&
(TokenInformationClass != TokenPrimaryGroup) &&
(TokenInformationClass != TokenDefaultDacl) ) {
return STATUS_INVALID_INFO_CLASS;
}
//
// Check access rights and reference token
//
Status = ObReferenceObjectByHandle(
TokenHandle, // Handle
TOKEN_ADJUST_DEFAULT, // DesiredAccess
SepTokenObjectType, // ObjectType
PreviousMode, // AccessMode
(PVOID *)&Token, // Object
NULL // GrantedAccess
);
if ( !NT_SUCCESS(Status) ) {
return Status;
}
//
// Case on information class.
//
switch ( TokenInformationClass ) {
case TokenOwner:
//
// Make sure the buffer is large enough to hold the
// necessary information class data structure.
//
if (TokenInformationLength < (ULONG)sizeof(TOKEN_OWNER)) {
ObDereferenceObject( Token );
return STATUS_INFO_LENGTH_MISMATCH;
}
//
// Capture and copy
try {
//
// Capture Owner SID
//
CapturedOwner = ((PTOKEN_OWNER)TokenInformation)->Owner;
Status = SeCaptureSid(
CapturedOwner,
PreviousMode,
NULL, 0,
PagedPool,
TRUE,
&CapturedOwner
);
} except(EXCEPTION_EXECUTE_HANDLER) {
ObDereferenceObject( Token );
return GetExceptionCode();
}
if (!NT_SUCCESS(Status)) {
ObDereferenceObject( Token );
return Status;
}
//
// Gain write access to the token.
//
SepAcquireTokenWriteLock( Token );
//
// Walk through the list of user and group IDs looking
// for a match to the specified SID. If one is found,
// make sure it may be assigned as an owner. If it can,
// then set the index in the token's OwnerIndex field.
// Otherwise, return invalid owner error.
//
Index = 0;
while (Index < Token->UserAndGroupCount) {
try {
Found = RtlEqualSid(
CapturedOwner,
Token->UserAndGroups[Index].Sid
);
if ( Found ) {
if ( SepIdAssignableAsOwner(Token,Index) ){
Token->DefaultOwnerIndex = Index;
TokenModified = TRUE;
Status = STATUS_SUCCESS;
} else {
Status = STATUS_INVALID_OWNER;
} //endif assignable
SepReleaseTokenWriteLock( Token, TokenModified );
ObDereferenceObject( Token );
SeReleaseSid( CapturedOwner, PreviousMode, TRUE);
return Status;
} //endif Found
} except(EXCEPTION_EXECUTE_HANDLER) {
SepReleaseTokenWriteLock( Token, TokenModified );
ObDereferenceObject( Token );
SeReleaseSid( CapturedOwner, PreviousMode, TRUE);
return GetExceptionCode();
} //endtry
Index += 1;
} //endwhile
SepReleaseTokenWriteLock( Token, TokenModified );
ObDereferenceObject( Token );
SeReleaseSid( CapturedOwner, PreviousMode, TRUE);
return STATUS_INVALID_OWNER;
case TokenPrimaryGroup:
//
// Assuming everything works out, the strategy is to move everything
// in the Dynamic part of the token (exept the primary group) to
// the beginning of the dynamic part, freeing up the entire end of
// the dynamic part for the new primary group.
//
//
// Make sure the buffer is large enough to hold the
// necessary information class data structure.
//
if (TokenInformationLength < (ULONG)sizeof(TOKEN_PRIMARY_GROUP)) {
ObDereferenceObject( Token );
return STATUS_INFO_LENGTH_MISMATCH;
}
//
// Capture And Validate TOKEN_PRIMARY_GROUP and corresponding SID.
//
try {
CapturedPrimaryGroup =
((PTOKEN_PRIMARY_GROUP)TokenInformation)->PrimaryGroup;
Status = SeCaptureSid(
CapturedPrimaryGroup,
PreviousMode,
NULL, 0,
PagedPool,
TRUE,
&CapturedPrimaryGroup
);
} except(EXCEPTION_EXECUTE_HANDLER) {
ObDereferenceObject( Token );
return GetExceptionCode();
}
if (!NT_SUCCESS(Status)) {
ObDereferenceObject( Token );
return Status;
}
//
// Gain write access to the token.
//
SepAcquireTokenWriteLock( Token );
//
// See if there is enough room in the dynamic part of the token
// to replace the current Primary Group with the one specified.
//
NewLength = SeLengthSid( CapturedPrimaryGroup );
CurrentLength = SeLengthSid( Token->PrimaryGroup );
if (NewLength > (CurrentLength + Token->DynamicAvailable) ) {
SepReleaseTokenWriteLock( Token, TokenModified );
ObDereferenceObject( Token );
SeReleaseSid( CapturedPrimaryGroup, PreviousMode, TRUE);
return STATUS_ALLOTTED_SPACE_EXCEEDED;
}
//
// Free up the existing primary group
//
SepFreePrimaryGroup( Token );
//
// And put the new SID in its place
//
SepAppendPrimaryGroup( Token, CapturedPrimaryGroup );
TokenModified = TRUE;
//
// All done.
//
SepReleaseTokenWriteLock( Token, TokenModified );
ObDereferenceObject( Token );
SeReleaseSid( CapturedPrimaryGroup, PreviousMode, TRUE);
return STATUS_SUCCESS;
case TokenDefaultDacl:
//
// Assuming everything works out, the strategy is to move everything
// in the Dynamic part of the token (exept the default Dacl) to
// the beginning of the dynamic part, freeing up the entire end of
// the dynamic part for the new default Dacl.
//
//
// Make sure the buffer is large enough to hold the
// necessary information class data structure.
//
if (TokenInformationLength < (ULONG)sizeof(TOKEN_DEFAULT_DACL)) {
ObDereferenceObject( Token );
return STATUS_INFO_LENGTH_MISMATCH;
}
//
// Capture And Validate TOKEN_DEFAULT_DACL and corresponding ACL.
//
try {
CapturedDefaultDacl =
((PTOKEN_DEFAULT_DACL)TokenInformation)->DefaultDacl;
if (ARGUMENT_PRESENT(CapturedDefaultDacl)) {
Status = SeCaptureAcl(
CapturedDefaultDacl,
PreviousMode,
NULL, 0,
PagedPool,
TRUE,
&CapturedDefaultDacl,
&NewLength
);
} else {
NewLength = 0;
Status = STATUS_SUCCESS;
}
} except(EXCEPTION_EXECUTE_HANDLER) {
ObDereferenceObject( Token );
return GetExceptionCode();
}
if (!NT_SUCCESS(Status)) {
ObDereferenceObject( Token );
return Status;
}
//
// Gain write access to the token.
//
SepAcquireTokenWriteLock( Token );
//
// See if there is enough room in the dynamic part of the token
// to replace the current Default Dacl with the one specified.
//
if (ARGUMENT_PRESENT(Token->DefaultDacl)) {
CurrentLength = Token->DefaultDacl->AclSize;
} else {
CurrentLength = 0;
}
if (NewLength > (CurrentLength + Token->DynamicAvailable) ) {
SepReleaseTokenWriteLock( Token, TokenModified );
ObDereferenceObject( Token );
if (ARGUMENT_PRESENT(CapturedDefaultDacl)) {
SeReleaseAcl( CapturedDefaultDacl, PreviousMode, TRUE);
}
return STATUS_ALLOTTED_SPACE_EXCEEDED;
}
//
// Free up the existing Default Dacl
//
SepFreeDefaultDacl( Token );
//
// And put the new ACL in its place
//
if (ARGUMENT_PRESENT(CapturedDefaultDacl)) {
SepAppendDefaultDacl( Token, CapturedDefaultDacl );
}
TokenModified = TRUE;
//
// All done.
//
SepReleaseTokenWriteLock( Token, TokenModified );
ObDereferenceObject( Token );
if (ARGUMENT_PRESENT(CapturedDefaultDacl)) {
SeReleaseAcl( CapturedDefaultDacl, PreviousMode, TRUE);
}
return STATUS_SUCCESS;
} //endswitch
ASSERT( TRUE == FALSE ); // Should never reach here.
}
BOOLEAN
SepValidOwnerSubjectContext(
IN PSECURITY_SUBJECT_CONTEXT SubjectContext,
IN PSID Owner,
IN BOOLEAN ServerObject
)
/*++
Routine Description:
This routine checks to see whether the provided SID is one the subject
is authorized to assign as the owner of objects. It will also check to
see if the caller has SeRestorePrivilege, if so, the request is granted.
Arguments:
SubjectContext - Points to the subject's security context.
Owner - Points to the SID to be checked.
Return Value:
none.
--*/
{
ULONG Index;
BOOLEAN Found;
PTOKEN EffectiveToken;
BOOLEAN Rc = FALSE;
PAGED_CODE();
//
// It is invalid to assign a NULL owner, regardless of
// whether you have SeRestorePrivilege or not.
//
if (Owner == NULL) {
return( FALSE );
}
//
// Allowable owners come from the primary if it's a server object.
//
if (!ServerObject && ARGUMENT_PRESENT(SubjectContext->ClientToken)) {
EffectiveToken = (PTOKEN)SubjectContext->ClientToken;
} else {
EffectiveToken = (PTOKEN)SubjectContext->PrimaryToken;
}
//
// If we're impersonating, make sure we're at TokenImpersonation
// or above. This prevents someone from setting the owner of an
// object when impersonating at less Identify or Anonymous.
//
if (EffectiveToken->TokenType == TokenImpersonation) {
if (EffectiveToken->ImpersonationLevel < SecurityImpersonation) {
return( FALSE );
}
}
Index = 0;
SepAcquireTokenReadLock( EffectiveToken );
//
// Walk through the list of user and group IDs looking
// for a match to the specified SID. If one is found,
// make sure it may be assigned as an owner.
//
// This code is similar to that performed to set the default
// owner of a token (NtSetInformationToken).
//
while (Index < EffectiveToken->UserAndGroupCount) {
Found = RtlEqualSid(
Owner,
EffectiveToken->UserAndGroups[Index].Sid
);
if ( Found ) {
//
// We may return success if the Sid is one that may be assigned
// as an owner, or if the caller has SeRestorePrivilege
//
if ( SepIdAssignableAsOwner(EffectiveToken,Index) ) {
SepReleaseTokenReadLock( EffectiveToken );
Rc = TRUE;
goto exit;
} else {
//
// Rc is already set to FALSE, just exit.
//
SepReleaseTokenReadLock( EffectiveToken );
goto exit;
} //endif assignable
} //endif Found
Index += 1;
} //endwhile
SepReleaseTokenReadLock( EffectiveToken );
exit:
//
// If we are going to fail this call, check for Restore privilege,
// and succeed if he has it.
//
//
// We should really have gotten PreviousMode from the caller, but we
// didn't, so hard wire it to be user-mode here.
//
if ( Rc == FALSE ) {
Rc = SeSinglePrivilegeCheck( SeRestorePrivilege, UserMode );
}
return Rc;
}