tor-browser

ntsec.c (7794B)

---

/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "primpl.h"

/*
* ntsec.c
*
* Implement the POSIX-style mode bits (access permissions) for
* files and other securable objects in Windows NT using Windows
* NT's security descriptors with appropriate discretionary
* access-control lists.
*/

/*
* The security identifiers (SIDs) for owner, primary group,
* and the Everyone (World) group.
*
* These SIDs are looked up during NSPR initialization and
* saved in this global structure (see _PR_NT_InitSids) so
* that _PR_NT_MakeSecurityDescriptorACL doesn't need to
* look them up every time.
*/
static struct {
 PSID owner;
 PSID group;
 PSID everyone;
} _pr_nt_sids;

/*
* Initialize the SIDs for owner, primary group, and the Everyone
* group in the _pr_nt_sids structure.
*
* This function needs to be called by NSPR initialization.
*/
void _PR_NT_InitSids(void) {
#ifdef WINCE /* not supported */
 return;
#else
 SID_IDENTIFIER_AUTHORITY SIDAuthWorld = SECURITY_WORLD_SID_AUTHORITY;
 HANDLE hToken = NULL;                 /* initialized to an arbitrary value to
                                        * silence a Purify UMR warning */
 PSID infoBuffer[1024 / sizeof(PSID)]; /* defined as an array of PSIDs
                                        * to force proper alignment */
 PTOKEN_OWNER pTokenOwner = (PTOKEN_OWNER)infoBuffer;
 PTOKEN_PRIMARY_GROUP pTokenPrimaryGroup = (PTOKEN_PRIMARY_GROUP)infoBuffer;
 DWORD dwLength;
 BOOL rv;

 /*
  * Look up and make a copy of the owner and primary group
  * SIDs in the access token of the calling process.
  */
 rv = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken);
 if (rv == 0) {
   /*
    * On non-NT systems, this function is not implemented
    * (error code ERROR_CALL_NOT_IMPLEMENTED), and neither are
    * the other security functions.  There is no point in
    * going further.
    *
    * A process with insufficient access permissions may fail
    * with the error code ERROR_ACCESS_DENIED.
    */
   PR_LOG(_pr_io_lm, PR_LOG_DEBUG,
          ("_PR_NT_InitSids: OpenProcessToken() failed. Error: %d",
           GetLastError()));
   return;
 }

 rv = GetTokenInformation(hToken, TokenOwner, infoBuffer, sizeof(infoBuffer),
                          &dwLength);
 PR_ASSERT(rv != 0);
 dwLength = GetLengthSid(pTokenOwner->Owner);
 _pr_nt_sids.owner = (PSID)PR_Malloc(dwLength);
 PR_ASSERT(_pr_nt_sids.owner != NULL);
 rv = CopySid(dwLength, _pr_nt_sids.owner, pTokenOwner->Owner);
 PR_ASSERT(rv != 0);

 rv = GetTokenInformation(hToken, TokenPrimaryGroup, infoBuffer,
                          sizeof(infoBuffer), &dwLength);
 PR_ASSERT(rv != 0);
 dwLength = GetLengthSid(pTokenPrimaryGroup->PrimaryGroup);
 _pr_nt_sids.group = (PSID)PR_Malloc(dwLength);
 PR_ASSERT(_pr_nt_sids.group != NULL);
 rv = CopySid(dwLength, _pr_nt_sids.group, pTokenPrimaryGroup->PrimaryGroup);
 PR_ASSERT(rv != 0);

 rv = CloseHandle(hToken);
 PR_ASSERT(rv != 0);

 /* Create a well-known SID for the Everyone group. */
 rv = AllocateAndInitializeSid(&SIDAuthWorld, 1, SECURITY_WORLD_RID, 0, 0, 0,
                               0, 0, 0, 0, &_pr_nt_sids.everyone);
 PR_ASSERT(rv != 0);
#endif
}

/*
* Free the SIDs for owner, primary group, and the Everyone group
* in the _pr_nt_sids structure.
*
* This function needs to be called by NSPR cleanup.
*/
void _PR_NT_FreeSids(void) {
#ifdef WINCE
 return;
#else
 if (_pr_nt_sids.owner) {
   PR_Free(_pr_nt_sids.owner);
 }
 if (_pr_nt_sids.group) {
   PR_Free(_pr_nt_sids.group);
 }
 if (_pr_nt_sids.everyone) {
   FreeSid(_pr_nt_sids.everyone);
 }
#endif
}

/*
* Construct a security descriptor whose discretionary access-control
* list implements the specified mode bits.  The SIDs for owner, group,
* and everyone are obtained from the global _pr_nt_sids structure.
* Both the security descriptor and access-control list are returned
* and should be freed by a _PR_NT_FreeSecurityDescriptorACL call.
*
* The accessTable array maps NSPR's read, write, and execute access
* rights to the corresponding NT access rights for the securable
* object.
*/
PRStatus _PR_NT_MakeSecurityDescriptorACL(PRIntn mode, DWORD accessTable[],
                                         PSECURITY_DESCRIPTOR* resultSD,
                                         PACL* resultACL) {
#ifdef WINCE
 PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0);
 return PR_FAILURE;
#else
 PSECURITY_DESCRIPTOR pSD = NULL;
 PACL pACL = NULL;
 DWORD cbACL; /* size of ACL */
 DWORD accessMask;

 if (_pr_nt_sids.owner == NULL) {
   PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0);
   return PR_FAILURE;
 }

 pSD = (PSECURITY_DESCRIPTOR)PR_Malloc(SECURITY_DESCRIPTOR_MIN_LENGTH);
 if (pSD == NULL) {
   _PR_MD_MAP_DEFAULT_ERROR(GetLastError());
   goto failed;
 }
 if (!InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION)) {
   _PR_MD_MAP_DEFAULT_ERROR(GetLastError());
   goto failed;
 }
 if (!SetSecurityDescriptorOwner(pSD, _pr_nt_sids.owner, FALSE)) {
   _PR_MD_MAP_DEFAULT_ERROR(GetLastError());
   goto failed;
 }
 if (!SetSecurityDescriptorGroup(pSD, _pr_nt_sids.group, FALSE)) {
   _PR_MD_MAP_DEFAULT_ERROR(GetLastError());
   goto failed;
 }

 /*
  * Construct a discretionary access-control list with three
  * access-control entries, one each for owner, primary group,
  * and Everyone.
  */

 cbACL = sizeof(ACL) + 3 * (sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD)) +
         GetLengthSid(_pr_nt_sids.owner) + GetLengthSid(_pr_nt_sids.group) +
         GetLengthSid(_pr_nt_sids.everyone);
 pACL = (PACL)PR_Malloc(cbACL);
 if (pACL == NULL) {
   _PR_MD_MAP_DEFAULT_ERROR(GetLastError());
   goto failed;
 }
 if (!InitializeAcl(pACL, cbACL, ACL_REVISION)) {
   _PR_MD_MAP_DEFAULT_ERROR(GetLastError());
   goto failed;
 }
 accessMask = 0;
 if (mode & 00400) {
   accessMask |= accessTable[0];
 }
 if (mode & 00200) {
   accessMask |= accessTable[1];
 }
 if (mode & 00100) {
   accessMask |= accessTable[2];
 }
 if (accessMask &&
     !AddAccessAllowedAce(pACL, ACL_REVISION, accessMask, _pr_nt_sids.owner)) {
   _PR_MD_MAP_DEFAULT_ERROR(GetLastError());
   goto failed;
 }
 accessMask = 0;
 if (mode & 00040) {
   accessMask |= accessTable[0];
 }
 if (mode & 00020) {
   accessMask |= accessTable[1];
 }
 if (mode & 00010) {
   accessMask |= accessTable[2];
 }
 if (accessMask &&
     !AddAccessAllowedAce(pACL, ACL_REVISION, accessMask, _pr_nt_sids.group)) {
   _PR_MD_MAP_DEFAULT_ERROR(GetLastError());
   goto failed;
 }
 accessMask = 0;
 if (mode & 00004) {
   accessMask |= accessTable[0];
 }
 if (mode & 00002) {
   accessMask |= accessTable[1];
 }
 if (mode & 00001) {
   accessMask |= accessTable[2];
 }
 if (accessMask && !AddAccessAllowedAce(pACL, ACL_REVISION, accessMask,
                                        _pr_nt_sids.everyone)) {
   _PR_MD_MAP_DEFAULT_ERROR(GetLastError());
   goto failed;
 }

 if (!SetSecurityDescriptorDacl(pSD, TRUE, pACL, FALSE)) {
   _PR_MD_MAP_DEFAULT_ERROR(GetLastError());
   goto failed;
 }

 *resultSD = pSD;
 *resultACL = pACL;
 return PR_SUCCESS;

failed:
 if (pSD) {
   PR_Free(pSD);
 }
 if (pACL) {
   PR_Free(pACL);
 }
 return PR_FAILURE;
#endif
}

/*
* Free the specified security descriptor and access-control list
* previously created by _PR_NT_MakeSecurityDescriptorACL.
*/
void _PR_NT_FreeSecurityDescriptorACL(PSECURITY_DESCRIPTOR pSD, PACL pACL) {
 if (pSD) {
   PR_Free(pSD);
 }
 if (pACL) {
   PR_Free(pACL);
 }
}