00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
#include "tokenp.h"
00029
#include "adt.h"
00030
#include "adtp.h"
00031
#include <sertlp.h>
00032
00033
VOID
00034
SepProbeAndCaptureString_U (
00035 IN PUNICODE_STRING SourceString,
00036 OUT PUNICODE_STRING *DestString
00037 );
00038
00039
VOID
00040
SepFreeCapturedString(
00041 IN PUNICODE_STRING CapturedString
00042 );
00043
00044
VOID
00045
SepAuditTypeList (
00046 IN
PIOBJECT_TYPE_LIST ObjectTypeList,
00047 IN ULONG ObjectTypeListLength,
00048 IN PNTSTATUS AccessStatus,
00049 IN ULONG StartIndex,
00050 OUT PBOOLEAN GenerateSuccessAudit,
00051 OUT PBOOLEAN GenerateFailureAudit
00052 );
00053
00054
VOID
00055
SepExamineSaclEx(
00056 IN PACL Sacl,
00057 IN PACCESS_TOKEN Token,
00058 IN ACCESS_MASK DesiredAccess,
00059 IN
PIOBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
00060 IN ULONG ObjectTypeListLength,
00061 IN BOOLEAN ReturnResultList,
00062 IN PNTSTATUS AccessStatus,
00063 IN PACCESS_MASK GrantedAccess,
00064 OUT PBOOLEAN GenerateSuccessAudit,
00065 OUT PBOOLEAN GenerateFailureAudit
00066 );
00067
00068
NTSTATUS
00069
SepAccessCheckAndAuditAlarm (
00070 IN PUNICODE_STRING SubsystemName,
00071 IN PVOID HandleId,
00072 IN PHANDLE ClientToken OPTIONAL,
00073 IN PUNICODE_STRING ObjectTypeName,
00074 IN PUNICODE_STRING ObjectName,
00075 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
00076 IN PSID PrincipalSelfSid,
00077 IN ACCESS_MASK DesiredAccess,
00078 IN AUDIT_EVENT_TYPE AuditType,
00079 IN ULONG Flags,
00080 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
00081 IN ULONG ObjectTypeListLength,
00082 IN PGENERIC_MAPPING GenericMapping,
00083 IN BOOLEAN ObjectCreation,
00084 OUT PACCESS_MASK GrantedAccess,
00085 OUT PNTSTATUS AccessStatus,
00086 OUT PBOOLEAN GenerateOnClose,
00087 IN BOOLEAN ReturnResultList
00088 );
00089
00090
#ifdef ALLOC_PRAGMA
00091
#pragma alloc_text(PAGE,NtAccessCheckAndAuditAlarm)
00092
#pragma alloc_text(PAGE,NtAccessCheckByTypeAndAuditAlarm)
00093
#pragma alloc_text(PAGE,NtAccessCheckByTypeResultListAndAuditAlarm)
00094
#pragma alloc_text(PAGE,NtAccessCheckByTypeResultListAndAuditAlarmByHandle)
00095
#pragma alloc_text(PAGE,NtCloseObjectAuditAlarm)
00096
#pragma alloc_text(PAGE,NtDeleteObjectAuditAlarm)
00097
#pragma alloc_text(PAGE,NtOpenObjectAuditAlarm)
00098
#pragma alloc_text(PAGE,NtPrivilegeObjectAuditAlarm)
00099
#pragma alloc_text(PAGE,NtPrivilegedServiceAuditAlarm)
00100
#pragma alloc_text(PAGE,SeAuditHandleCreation)
00101
#pragma alloc_text(PAGE,SeAuditingFileEvents)
00102
#pragma alloc_text(PAGE,SeCheckAuditPrivilege)
00103
#pragma alloc_text(PAGE,SeCloseObjectAuditAlarm)
00104
#pragma alloc_text(PAGE,SeDeleteObjectAuditAlarm)
00105
#pragma alloc_text(PAGE,SeCreateObjectAuditAlarm)
00106
#pragma alloc_text(PAGE,SeObjectReferenceAuditAlarm)
00107
#pragma alloc_text(PAGE,SeOpenObjectAuditAlarm)
00108
#pragma alloc_text(PAGE,SePrivilegeObjectAuditAlarm)
00109
#pragma alloc_text(PAGE,SePrivilegedServiceAuditAlarm)
00110
#pragma alloc_text(PAGE,SeTraverseAuditAlarm)
00111
#pragma alloc_text(PAGE,SepAccessCheckAndAuditAlarm)
00112
#pragma alloc_text(PAGE,SepExamineSacl)
00113
#pragma alloc_text(PAGE,SepExamineSaclEx)
00114
#pragma alloc_text(PAGE,SepAuditTypeList)
00115
#pragma alloc_text(PAGE,SepFilterPrivilegeAudits)
00116
#pragma alloc_text(PAGE,SepFreeCapturedString)
00117
#pragma alloc_text(PAGE,SepProbeAndCaptureString_U)
00118
#pragma alloc_text(PAGE,SepSinglePrivilegeCheck)
00119
#endif
00120
00121
00122
00123
00124
00125
00126
00127 BOOLEAN
SepAuditShutdownEvents =
FALSE;
00128
00129
00130
00131
00132
00133
00134
00135
00136
00137
00138
00139
00140
00141
00142 BOOLEAN
00143 SepSinglePrivilegeCheck (
00144 LUID DesiredPrivilege,
00145 IN PACCESS_TOKEN Token,
00146 IN KPROCESSOR_MODE PreviousMode
00147 )
00148
00149
00150
00151
00152
00153
00154
00155
00156
00157
00158
00159
00160
00161
00162
00163
00164
00165
00166
00167
00168
00169 {
00170
00171 LUID_AND_ATTRIBUTES Privilege;
00172 BOOLEAN Result;
00173
00174
PAGED_CODE();
00175
00176
00177
00178
00179
00180
ASSERT(!((DesiredPrivilege.LowPart ==
SeTcbPrivilege.LowPart) &&
00181 (DesiredPrivilege.HighPart ==
SeTcbPrivilege.HighPart)));
00182
00183 Privilege.Luid = DesiredPrivilege;
00184 Privilege.Attributes = 0;
00185
00186 Result =
SepPrivilegeCheck(
00187
Token,
00188 &Privilege,
00189 1,
00190 PRIVILEGE_SET_ALL_NECESSARY,
00191 PreviousMode
00192 );
00193
00194
return(Result);
00195 }
00196
00197
00198 BOOLEAN
00199 SeCheckAuditPrivilege (
00200 IN
PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
00201 IN KPROCESSOR_MODE PreviousMode
00202 )
00203
00204
00205
00206
00207
00208
00209
00210
00211
00212
00213
00214
00215
00216
00217
00218
00219
00220
00221
00222
00223
00224 {
00225
00226 PRIVILEGE_SET RequiredPrivileges;
00227 BOOLEAN AccessGranted;
00228
00229
PAGED_CODE();
00230
00231 RequiredPrivileges.PrivilegeCount = 1;
00232 RequiredPrivileges.Control = PRIVILEGE_SET_ALL_NECESSARY;
00233 RequiredPrivileges.Privilege[0].Luid =
SeAuditPrivilege;
00234 RequiredPrivileges.Privilege[0].Attributes = 0;
00235
00236 AccessGranted =
SepPrivilegeCheck(
00237 SubjectSecurityContext->PrimaryToken,
00238 RequiredPrivileges.Privilege,
00239 RequiredPrivileges.PrivilegeCount,
00240 PRIVILEGE_SET_ALL_NECESSARY,
00241 PreviousMode
00242 );
00243
00244
if ( PreviousMode !=
KernelMode ) {
00245
00246
SePrivilegedServiceAuditAlarm (
00247
NULL,
00248 SubjectSecurityContext,
00249 &RequiredPrivileges,
00250 AccessGranted
00251 );
00252 }
00253
00254
return( AccessGranted );
00255 }
00256
00257
00258
VOID
00259 SepProbeAndCaptureString_U (
00260 IN PUNICODE_STRING SourceString,
00261 OUT PUNICODE_STRING *DestString
00262 )
00263
00264
00265
00266
00267
00268
00269
00270
00271
00272
00273
00274
00275
00276
00277
00278
00279
00280
00281
00282
00283
00284
00285 {
00286
00287 UNICODE_STRING InputString;
00288 ULONG Length;
00289
NTSTATUS Status;
00290
00291
PAGED_CODE();
00292
00293
00294
00295
00296
00297
00298 *
DestString =
NULL;
00299
00300
Status = STATUS_SUCCESS;
00301
try {
00302
00303
00304
00305
00306
00307
00308 InputString =
ProbeAndReadUnicodeString(
SourceString);
00309
ProbeForRead(InputString.Buffer,
00310 InputString.Length,
00311
sizeof(WCHAR));
00312
00313
00314
00315
00316
00317
00318
00319
00320
00321 Length = InputString.Length;
00322
if (((Length & (
sizeof(WCHAR) - 1)) != 0) ||
00323 (Length == (MAXUSHORT -
sizeof(WCHAR) + 1))) {
00324
Status = STATUS_INVALID_PARAMETER;
00325
00326 }
else {
00327
00328
00329
00330
00331
00332 *
DestString =
ExAllocatePoolWithTag(
00333
PagedPool,
00334 InputString.Length +
sizeof(UNICODE_STRING),
00335 'sUeS');
00336
00337
if (*
DestString ==
NULL) {
00338
Status = STATUS_INSUFFICIENT_RESOURCES;
00339
00340 }
else {
00341 (*DestString)->Length = InputString.Length;
00342 (*DestString)->MaximumLength = InputString.Length;
00343 (*DestString)->Buffer = (PWSTR) ((*DestString) + 1);
00344
00345
if (InputString.Length != 0) {
00346
00347 RtlCopyMemory(
00348 (*DestString)->Buffer,
00349 InputString.Buffer,
00350 InputString.Length);
00351 }
00352
00353 }
00354 }
00355
00356 } except(
ExSystemExceptionFilter()) {
00357
Status = GetExceptionCode();
00358
if (*
DestString !=
NULL) {
00359
ExFreePool(*
DestString);
00360 *
DestString =
NULL;
00361 }
00362 }
00363
00364
return;
00365
00366 }
00367
00368
00369
VOID
00370 SepFreeCapturedString(
00371 IN PUNICODE_STRING CapturedString
00372 )
00373
00374
00375
00376
00377
00378
00379
00380
00381
00382
00383
00384
00385
00386
00387
00388
00389
00390
00391 {
00392
PAGED_CODE();
00393
00394
ExFreePool( CapturedString );
00395
return;
00396 }
00397
00399
00400
00401
00403
00404
00405
NTSTATUS
00406 NtPrivilegeObjectAuditAlarm (
00407 IN PUNICODE_STRING SubsystemName,
00408 IN PVOID HandleId,
00409 IN HANDLE ClientToken,
00410 IN ACCESS_MASK DesiredAccess,
00411 IN PPRIVILEGE_SET Privileges,
00412 IN BOOLEAN AccessGranted
00413 )
00414
00415
00416
00417
00418
00419
00420
00421
00422
00423
00424
00425
00426
00427
00428
00429
00430
00431
00432
00433
00434
00435
00436
00437
00438
00439
00440
00441
00442
00443
00444
00445
00446
00447
00448
00449
00450
00451
00452
00453
00454
00455
00456
00457
00458
00459
00460 {
00461
00462
KPROCESSOR_MODE PreviousMode;
00463 PUNICODE_STRING CapturedSubsystemName =
NULL;
00464 PPRIVILEGE_SET CapturedPrivileges =
NULL;
00465 ULONG PrivilegeParameterLength;
00466 ULONG PrivilegeCount;
00467
SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
00468 BOOLEAN Result;
00469
PTOKEN Token;
00470
NTSTATUS Status;
00471 BOOLEAN AuditPerformed;
00472
00473
PAGED_CODE();
00474
00475 PreviousMode = KeGetPreviousMode();
00476
00477
ASSERT(PreviousMode !=
KernelMode);
00478
00479
Status =
ObReferenceObjectByHandle(
00480
ClientToken,
00481 TOKEN_QUERY,
00482
SepTokenObjectType,
00483 PreviousMode,
00484 (PVOID *)&
Token,
00485
NULL
00486 );
00487
00488
if (!
NT_SUCCESS(
Status )) {
00489
return(
Status );
00490 }
00491
00492
00493
00494
00495
00496
00497
if (
Token->TokenType == TokenImpersonation) {
00498
00499
if (
Token->ImpersonationLevel < SecurityIdentification) {
00500
00501
ObDereferenceObject( (PVOID)
Token );
00502
00503
return( STATUS_BAD_IMPERSONATION_LEVEL );
00504
00505 }
00506 }
00507
00508
00509
00510
00511
00512
00513
00514
00515
00516
00517
00518
00519
00520
00521
00522
00523
00524
00525
00526
00527
00528
00529
00530
00531
00532
00533
00534
00535
00536
SeCaptureSubjectContext ( &SubjectSecurityContext );
00537
00538 Result =
SeCheckAuditPrivilege (
00539 &SubjectSecurityContext,
00540 PreviousMode
00541 );
00542
00543
if (!Result) {
00544
00545
ObDereferenceObject( (PVOID)
Token );
00546
SeReleaseSubjectContext ( &SubjectSecurityContext );
00547
return(STATUS_PRIVILEGE_NOT_HELD);
00548
00549 }
00550
00551
try {
00552
00553
SepProbeAndCaptureString_U ( SubsystemName,
00554 &CapturedSubsystemName );
00555
00556
ProbeForRead(
00557 Privileges,
00558
sizeof(PRIVILEGE_SET),
00559
sizeof(ULONG)
00560 );
00561 PrivilegeCount = Privileges->PrivilegeCount;
00562
00563
if (!
IsValidElementCount(PrivilegeCount, LUID_AND_ATTRIBUTES)) {
00564
Status= STATUS_INVALID_PARAMETER;
00565 leave ;
00566 }
00567 PrivilegeParameterLength = (ULONG)
sizeof(PRIVILEGE_SET) +
00568 ((PrivilegeCount -
ANYSIZE_ARRAY) *
00569 (ULONG)
sizeof(LUID_AND_ATTRIBUTES) );
00570
00571
ProbeForRead(
00572 Privileges,
00573 PrivilegeParameterLength,
00574
sizeof(ULONG)
00575 );
00576
00577 CapturedPrivileges =
ExAllocatePoolWithTag(
PagedPool,
00578 PrivilegeParameterLength,
00579 'rPeS'
00580 );
00581
00582
if (CapturedPrivileges !=
NULL) {
00583
00584 RtlCopyMemory ( CapturedPrivileges,
00585 Privileges,
00586 PrivilegeParameterLength );
00587 CapturedPrivileges->PrivilegeCount = PrivilegeCount;
00588 }
00589
00590 } except (
EXCEPTION_EXECUTE_HANDLER) {
00591
00592
Status = GetExceptionCode();
00593 }
00594
if (!
NT_SUCCESS(
Status)) {
00595
00596
if (CapturedPrivileges !=
NULL) {
00597
ExFreePool( CapturedPrivileges );
00598 }
00599
00600
if (CapturedSubsystemName !=
NULL) {
00601
SepFreeCapturedString ( CapturedSubsystemName );
00602 }
00603
00604
SeReleaseSubjectContext ( &SubjectSecurityContext );
00605
00606
ObDereferenceObject( (PVOID)
Token );
00607
00608
return Status;
00609
00610 }
00611
00612
00613
00614
00615
00616
00617
00618
00619
00620
00621
00622 AuditPerformed =
SepAdtPrivilegeObjectAuditAlarm (
00623 CapturedSubsystemName,
00624 HandleId,
00625
Token,
00626 SubjectSecurityContext.
PrimaryToken,
00627 SubjectSecurityContext.
ProcessAuditId,
00628 DesiredAccess,
00629 CapturedPrivileges,
00630 AccessGranted
00631 );
00632
00633
if (CapturedPrivileges !=
NULL) {
00634
ExFreePool( CapturedPrivileges );
00635 }
00636
00637
if (CapturedSubsystemName !=
NULL) {
00638
SepFreeCapturedString ( CapturedSubsystemName );
00639 }
00640
00641
SeReleaseSubjectContext ( &SubjectSecurityContext );
00642
00643
ObDereferenceObject( (PVOID)
Token );
00644
00645
return(STATUS_SUCCESS);
00646 }
00647
00648
00649
VOID
00650 SePrivilegeObjectAuditAlarm(
00651 IN HANDLE Handle,
00652 IN
PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
00653 IN ACCESS_MASK DesiredAccess,
00654 IN PPRIVILEGE_SET Privileges,
00655 IN BOOLEAN AccessGranted,
00656 IN KPROCESSOR_MODE AccessMode
00657 )
00658
00659
00660
00661
00662
00663
00664
00665
00666
00667
00668
00669
00670
00671
00672
00673
00674
00675
00676
00677
00678
00679
00680
00681
00682
00683
00684
00685
00686
00687
00688
00689
00690
00691
00692
00693
00694
00695
00696
00697
00698
00699
00700
00701
00702 {
00703 BOOLEAN AuditPerformed;
00704
00705
PAGED_CODE();
00706
00707
if (AccessMode !=
KernelMode) {
00708
00709 AuditPerformed =
SepAdtPrivilegeObjectAuditAlarm (
00710 &
SeSubsystemName,
00711
Handle,
00712 SubjectSecurityContext->ClientToken,
00713 SubjectSecurityContext->PrimaryToken,
00714 SubjectSecurityContext->ProcessAuditId,
00715 DesiredAccess,
00716 Privileges,
00717 AccessGranted
00718 );
00719 }
00720 }
00721
00722
00724
00725
00726
00728
00729
00730
NTSTATUS
00731 NtPrivilegedServiceAuditAlarm (
00732 IN PUNICODE_STRING SubsystemName,
00733 IN PUNICODE_STRING ServiceName,
00734 IN HANDLE ClientToken,
00735 IN PPRIVILEGE_SET Privileges,
00736 IN BOOLEAN AccessGranted
00737 )
00738
00739
00740
00741
00742
00743
00744
00745
00746
00747
00748
00749
00750
00751
00752
00753
00754
00755
00756
00757
00758
00759
00760
00761
00762
00763
00764
00765
00766
00767
00768
00769
00770
00771
00772
00773
00774
00775
00776
00777
00778
00779
00780
00781
00782
00783
00784 {
00785
00786 PPRIVILEGE_SET CapturedPrivileges =
NULL;
00787 ULONG PrivilegeParameterLength = 0;
00788 BOOLEAN Result;
00789
SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
00790
KPROCESSOR_MODE PreviousMode;
00791 PUNICODE_STRING CapturedSubsystemName =
NULL;
00792 PUNICODE_STRING CapturedServiceName =
NULL;
00793
NTSTATUS Status;
00794
PTOKEN Token;
00795 ULONG PrivilegeCount;
00796
00797
PAGED_CODE();
00798
00799 PreviousMode = KeGetPreviousMode();
00800
00801
ASSERT(PreviousMode !=
KernelMode);
00802
00803
Status =
ObReferenceObjectByHandle(
00804
ClientToken,
00805 TOKEN_QUERY,
00806
SepTokenObjectType,
00807 PreviousMode,
00808 (PVOID *)&
Token,
00809
NULL
00810 );
00811
00812
if ( !
NT_SUCCESS(
Status )) {
00813
return(
Status );
00814 }
00815
00816
00817
00818
00819
00820
00821
if (
Token->TokenType == TokenImpersonation) {
00822
00823
if (
Token->ImpersonationLevel < SecurityIdentification) {
00824
00825
ObDereferenceObject( (PVOID)
Token );
00826
00827
return( STATUS_BAD_IMPERSONATION_LEVEL );
00828
00829 }
00830 }
00831
00832
00833
00834
00835
00836
00837
00838
00839
00840
00841
00842
00843
00844
00845
00846
00847
00848
00849
00850
00851
00852
00853
00854
00855
00856
00857
00858
00859
00860
SeCaptureSubjectContext ( &SubjectSecurityContext );
00861
00862 Result =
SeCheckAuditPrivilege (
00863 &SubjectSecurityContext,
00864 PreviousMode
00865 );
00866
00867
if (!Result) {
00868
00869
ObDereferenceObject( (PVOID)
Token );
00870
00871
SeReleaseSubjectContext ( &SubjectSecurityContext );
00872
00873
return(STATUS_PRIVILEGE_NOT_HELD);
00874 }
00875
00876
try {
00877
00878
if ( ARGUMENT_PRESENT( SubsystemName )) {
00879
SepProbeAndCaptureString_U ( SubsystemName,
00880 &CapturedSubsystemName );
00881 }
00882
00883
if ( ARGUMENT_PRESENT( ServiceName )) {
00884
SepProbeAndCaptureString_U ( ServiceName,
00885 &CapturedServiceName );
00886
00887 }
00888
00889
ProbeForRead(
00890 Privileges,
00891
sizeof(PRIVILEGE_SET),
00892
sizeof(ULONG)
00893 );
00894
00895 PrivilegeCount = Privileges->PrivilegeCount;
00896
00897
if (!
IsValidElementCount( PrivilegeCount, LUID_AND_ATTRIBUTES ) ) {
00898
Status = STATUS_INVALID_PARAMETER;
00899 leave ;
00900 }
00901 PrivilegeParameterLength = (ULONG)
sizeof(PRIVILEGE_SET) +
00902 ((PrivilegeCount -
ANYSIZE_ARRAY) *
00903 (ULONG)
sizeof(LUID_AND_ATTRIBUTES) );
00904
00905
ProbeForRead(
00906 Privileges,
00907 PrivilegeParameterLength,
00908
sizeof(ULONG)
00909 );
00910
00911 CapturedPrivileges =
ExAllocatePoolWithTag(
PagedPool,
00912 PrivilegeParameterLength,
00913 'rPeS'
00914 );
00915
00916
00917
00918
00919
00920
00921
if (CapturedPrivileges !=
NULL) {
00922
00923 RtlCopyMemory ( CapturedPrivileges,
00924 Privileges,
00925 PrivilegeParameterLength );
00926 CapturedPrivileges->PrivilegeCount = PrivilegeCount;
00927
00928 }
00929
00930 } except (
EXCEPTION_EXECUTE_HANDLER) {
00931
Status = GetExceptionCode();
00932 }
00933
00934
if (!
NT_SUCCESS(
Status)) {
00935
00936
if (CapturedSubsystemName !=
NULL) {
00937
SepFreeCapturedString ( CapturedSubsystemName );
00938 }
00939
00940
if (CapturedServiceName !=
NULL) {
00941
SepFreeCapturedString ( CapturedServiceName );
00942 }
00943
00944
if (CapturedPrivileges !=
NULL) {
00945
ExFreePool ( CapturedPrivileges );
00946 }
00947
00948
SeReleaseSubjectContext ( &SubjectSecurityContext );
00949
00950
ObDereferenceObject( (PVOID)
Token );
00951
00952
return Status;
00953
00954 }
00955
00956
00957
00958
00959
00960
00961
SepAdtPrivilegedServiceAuditAlarm ( CapturedSubsystemName,
00962 CapturedServiceName,
00963
Token,
00964 SubjectSecurityContext.
PrimaryToken,
00965 CapturedPrivileges,
00966 AccessGranted );
00967
00968
if (CapturedSubsystemName !=
NULL) {
00969
SepFreeCapturedString ( CapturedSubsystemName );
00970 }
00971
00972
if (CapturedServiceName !=
NULL) {
00973
SepFreeCapturedString ( CapturedServiceName );
00974 }
00975
00976
if (CapturedPrivileges !=
NULL) {
00977
ExFreePool ( CapturedPrivileges );
00978 }
00979
00980
ObDereferenceObject( (PVOID)
Token );
00981
00982
SeReleaseSubjectContext ( &SubjectSecurityContext );
00983
00984
return(STATUS_SUCCESS);
00985 }
00986
00987
00988
VOID
00989 SePrivilegedServiceAuditAlarm (
00990 IN PUNICODE_STRING ServiceName,
00991 IN
PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
00992 IN PPRIVILEGE_SET Privileges,
00993 IN BOOLEAN AccessGranted
00994 )
00995
00996
00997
00998
00999
01000
01001
01002
01003
01004
01005
01006
01007
01008
01009
01010
01011
01012
01013
01014
01015
01016
01017
01018
01019
01020
01021 {
01022
PTOKEN Token;
01023
01024
PAGED_CODE();
01025
01026
if (
SepAdtAuditThisEvent( AuditCategoryPrivilegeUse, &AccessGranted ) &&
01027
SepFilterPrivilegeAudits( Privileges )) {
01028
01029
Token = (
PTOKEN)
EffectiveToken( SubjectSecurityContext );
01030
01031
if (
RtlEqualSid(
SeLocalSystemSid,
SepTokenUserSid(
Token ))) {
01032
return;
01033 }
01034
01035
SepAdtPrivilegedServiceAuditAlarm (
01036 &
SeSubsystemName,
01037 ServiceName,
01038 SubjectSecurityContext->ClientToken,
01039 SubjectSecurityContext->PrimaryToken,
01040 Privileges,
01041 AccessGranted
01042 );
01043 }
01044
01045
return;
01046 }
01047
01048
01049
NTSTATUS
01050 SepAccessCheckAndAuditAlarm (
01051 IN PUNICODE_STRING SubsystemName,
01052 IN PVOID HandleId,
01053 IN PHANDLE ClientToken OPTIONAL,
01054 IN PUNICODE_STRING ObjectTypeName,
01055 IN PUNICODE_STRING ObjectName,
01056 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
01057 IN PSID PrincipalSelfSid,
01058 IN ACCESS_MASK DesiredAccess,
01059 IN AUDIT_EVENT_TYPE AuditType,
01060 IN ULONG Flags,
01061 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
01062 IN ULONG ObjectTypeListLength,
01063 IN PGENERIC_MAPPING GenericMapping,
01064 IN BOOLEAN ObjectCreation,
01065 OUT PACCESS_MASK GrantedAccess,
01066 OUT PNTSTATUS AccessStatus,
01067 OUT PBOOLEAN GenerateOnClose,
01068 IN BOOLEAN ReturnResultList
01069 )
01070
01071
01072
01073
01074
01075
01076
01077
01078
01079
01080
01081
01082
01083
01084
01085
01086
01087
01088
01089
01090
01091
01092
01093
01094
01095
01096
01097
01098
01099
01100
01101
01102
01103
01104
01105
01106
01107
01108
01109
01110
01111
01112
01113
01114
01115
01116
01117
01118
01119
01120
01121
01122
01123
01124
01125
01126
01127
01128
01129
01130
01131
01132
01133
01134
01135
01136
01137
01138
01139
01140
01141
01142
01143
01144
01145
01146
01147
01148
01149
01150
01151 {
01152
01153
SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
01154
01155
NTSTATUS Status = STATUS_SUCCESS;
01156
01157 ACCESS_MASK LocalGrantedAccess = (ACCESS_MASK)0;
01158 PACCESS_MASK LocalGrantedAccessPointer =
NULL;
01159 BOOLEAN LocalGrantedAccessAllocated =
FALSE;
01160
NTSTATUS LocalAccessStatus;
01161 PNTSTATUS LocalAccessStatusPointer =
NULL;
01162 BOOLEAN LocalGenerateOnClose =
FALSE;
01163 POLICY_AUDIT_EVENT_TYPE NtAuditType;
01164
01165
KPROCESSOR_MODE PreviousMode;
01166
01167 PUNICODE_STRING CapturedSubsystemName = (PUNICODE_STRING)
NULL;
01168 PUNICODE_STRING CapturedObjectTypeName = (PUNICODE_STRING)
NULL;
01169 PUNICODE_STRING CapturedObjectName = (PUNICODE_STRING)
NULL;
01170 PSECURITY_DESCRIPTOR CapturedSecurityDescriptor = (PSECURITY_DESCRIPTOR)
NULL;
01171 PSID CapturedPrincipalSelfSid =
NULL;
01172
PIOBJECT_TYPE_LIST LocalObjectTypeList =
NULL;
01173
01174 ACCESS_MASK PreviouslyGrantedAccess = (ACCESS_MASK)0;
01175 GENERIC_MAPPING LocalGenericMapping;
01176
01177 PPRIVILEGE_SET PrivilegeSet =
NULL;
01178
01179 BOOLEAN Result;
01180
01181 BOOLEAN AccessGranted;
01182 BOOLEAN AccessDenied;
01183 BOOLEAN GenerateSuccessAudit =
FALSE;
01184 BOOLEAN GenerateFailureAudit =
FALSE;
01185 LUID OperationId;
01186 BOOLEAN AuditPerformed;
01187 BOOLEAN AvoidAudit =
FALSE;
01188
01189
PTOKEN NewToken =
NULL;
01190
PTOKEN OldToken =
NULL;
01191 BOOLEAN TokenSwapped =
FALSE;
01192
01193
PAGED_CODE();
01194
01195 PreviousMode = KeGetPreviousMode();
01196
01197
ASSERT( PreviousMode !=
KernelMode );
01198
01199
01200
01201
01202
01203
SeCaptureSubjectContext ( &SubjectSecurityContext );
01204
01205
01206
01207
01208
01209
if ( AuditType == AuditEventObjectAccess ) {
01210 NtAuditType = AuditCategoryObjectAccess;
01211 }
else if ( AuditType == AuditEventDirectoryServiceAccess ) {
01212 NtAuditType = AuditCategoryDirectoryServiceAccess;
01213 }
else {
01214
Status = STATUS_INVALID_PARAMETER;
01215
goto Cleanup;
01216 }
01217
01218
01219
01220
01221
01222
if ( !ARGUMENT_PRESENT(
ClientToken ) ) {
01223
01224
01225
01226
01227
01228
if ( (SubjectSecurityContext.
ClientToken ==
NULL) ) {
01229
Status = STATUS_NO_IMPERSONATION_TOKEN;
01230
goto Cleanup;
01231 }
01232
01233
01234
01235
01236
01237
01238
if (SubjectSecurityContext.
ImpersonationLevel < SecurityIdentification) {
01239
Status = STATUS_BAD_IMPERSONATION_LEVEL;
01240
goto Cleanup;
01241 }
01242 }
01243
01244
try {
01245
01246
if ( ReturnResultList ) {
01247
01248
if ( ObjectTypeListLength == 0 ) {
01249
Status = STATUS_INVALID_PARAMETER;
01250 leave;
01251 }
01252
01253
if (!
IsValidElementCount(ObjectTypeListLength, ULONG)) {
01254
Status = STATUS_INVALID_PARAMETER;
01255 leave;
01256 }
01257
ProbeForWrite(
01258 AccessStatus,
01259
sizeof(
NTSTATUS) * ObjectTypeListLength,
01260
sizeof(ULONG)
01261 );
01262
01263
ProbeForWrite(
01264 GrantedAccess,
01265
sizeof(ACCESS_MASK) * ObjectTypeListLength,
01266
sizeof(ULONG)
01267 );
01268
01269 }
else {
01270
ProbeForWriteUlong((PULONG)AccessStatus);
01271
ProbeForWriteUlong((PULONG)GrantedAccess);
01272 }
01273
01274
ProbeForRead(
01275 GenericMapping,
01276
sizeof(GENERIC_MAPPING),
01277
sizeof(ULONG)
01278 );
01279
01280 LocalGenericMapping = *GenericMapping;
01281
01282 } except (
EXCEPTION_EXECUTE_HANDLER) {
01283
01284
Status = GetExceptionCode();
01285 }
01286
01287
if (!
NT_SUCCESS(
Status)) {
01288
goto Cleanup;
01289 }
01290
01291
if ( ARGUMENT_PRESENT(
ClientToken ) ) {
01292
01293
Status =
ObReferenceObjectByHandle(
01294 *
ClientToken,
01295 (ACCESS_MASK)TOKEN_QUERY,
01296
SepTokenObjectType,
01297 PreviousMode,
01298 (PVOID *)&NewToken,
01299
NULL
01300 );
01301
01302
if (!
NT_SUCCESS(
Status)) {
01303 NewToken =
NULL;
01304
goto Cleanup;
01305 }
01306
01307
01308
01309
01310
01311
01312 OldToken = SubjectSecurityContext.
ClientToken;
01313
01314
01315
01316
01317
01318
01319 SubjectSecurityContext.
ClientToken = NewToken;
01320
01321 TokenSwapped =
TRUE;
01322 }
01323
01324
01325
01326
01327
01328 Result =
SeCheckAuditPrivilege (
01329 &SubjectSecurityContext,
01330 PreviousMode
01331 );
01332
01333
if (!Result) {
01334
if ( Flags & AUDIT_ALLOW_NO_PRIVILEGE ) {
01335 AvoidAudit =
TRUE;
01336 }
else {
01337
Status = STATUS_PRIVILEGE_NOT_HELD;
01338
goto Cleanup;
01339 }
01340 }
01341
01342
if (DesiredAccess &
01343 ( GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE | GENERIC_ALL )) {
01344
01345
Status = STATUS_GENERIC_NOT_MAPPED;
01346
goto Cleanup;
01347 }
01348
01349
01350
01351
01352
01353
01354
01355
01356
Status =
SeCaptureSecurityDescriptor (
01357 SecurityDescriptor,
01358 PreviousMode,
01359
PagedPool,
01360
FALSE,
01361 &CapturedSecurityDescriptor
01362 );
01363
01364
if (!
NT_SUCCESS(
Status) ) {
01365 CapturedSecurityDescriptor =
NULL;
01366
goto Cleanup;
01367 }
01368
01369
if ( CapturedSecurityDescriptor ==
NULL ) {
01370
Status = STATUS_INVALID_SECURITY_DESCR;
01371
goto Cleanup;
01372 }
01373
01374
01375
01376
01377
01378
if ( RtlpOwnerAddrSecurityDescriptor(
01379 (PISECURITY_DESCRIPTOR)CapturedSecurityDescriptor
01380 ) ==
NULL ||
01381 RtlpGroupAddrSecurityDescriptor(
01382 (PISECURITY_DESCRIPTOR)CapturedSecurityDescriptor
01383 ) ==
NULL ) {
01384
01385
Status = STATUS_INVALID_SECURITY_DESCR;
01386
goto Cleanup;
01387 }
01388
01389
01390
01391
01392
01393
try {
01394
01395
ProbeForWriteBoolean(GenerateOnClose);
01396
01397
SepProbeAndCaptureString_U ( SubsystemName, &CapturedSubsystemName );
01398
01399
SepProbeAndCaptureString_U ( ObjectTypeName, &CapturedObjectTypeName );
01400
01401
SepProbeAndCaptureString_U ( ObjectName, &CapturedObjectName );
01402
01403 } except (
EXCEPTION_EXECUTE_HANDLER) {
01404
01405
Status = GetExceptionCode();
01406
goto Cleanup;
01407
01408 }
01409
01410
01411
01412
01413
01414
if ( PrincipalSelfSid !=
NULL ) {
01415
Status =
SeCaptureSid(
01416 PrincipalSelfSid,
01417 PreviousMode,
01418
NULL, 0,
01419
PagedPool,
01420
TRUE,
01421 &CapturedPrincipalSelfSid );
01422
01423
if (!
NT_SUCCESS(
Status)) {
01424 CapturedPrincipalSelfSid =
NULL;
01425
goto Cleanup;
01426 }
01427 }
01428
01429
01430
01431
01432
01433
Status =
SeCaptureObjectTypeList( ObjectTypeList,
01434 ObjectTypeListLength,
01435 PreviousMode,
01436 &LocalObjectTypeList );
01437
01438
if (!
NT_SUCCESS(
Status)) {
01439
goto Cleanup;
01440 }
01441
01442
01443
01444
01445
01446
01447
Status =
SePrivilegePolicyCheck(
01448 &DesiredAccess,
01449 &PreviouslyGrantedAccess,
01450 &SubjectSecurityContext,
01451
NULL,
01452 &PrivilegeSet,
01453 PreviousMode
01454 );
01455
01456
SeLockSubjectContext( &SubjectSecurityContext );
01457
01458
if (!
NT_SUCCESS(
Status )) {
01459 AccessGranted =
FALSE;
01460 AccessDenied =
TRUE;
01461 LocalAccessStatus =
Status;
01462
01463
if ( ReturnResultList ) {
01464 ULONG ResultListIndex;
01465 LocalGrantedAccessPointer =
01466
ExAllocatePoolWithTag(
PagedPool, (
sizeof(ACCESS_MASK)+
sizeof(
NTSTATUS)) * ObjectTypeListLength, 'aGeS' );
01467
01468
if (LocalGrantedAccessPointer ==
NULL) {
01469
SeUnlockSubjectContext( &SubjectSecurityContext );
01470
Status = STATUS_INSUFFICIENT_RESOURCES;
01471
goto Cleanup;
01472 }
01473 LocalGrantedAccessAllocated =
TRUE;
01474 LocalAccessStatusPointer = (PNTSTATUS)(LocalGrantedAccessPointer + ObjectTypeListLength);
01475
01476
for ( ResultListIndex=0; ResultListIndex<ObjectTypeListLength; ResultListIndex++ ) {
01477 LocalGrantedAccessPointer[ResultListIndex] = LocalGrantedAccess;
01478 LocalAccessStatusPointer[ResultListIndex] = LocalAccessStatus;
01479 }
01480
01481 }
else {
01482 LocalGrantedAccessPointer = &LocalGrantedAccess;
01483 LocalAccessStatusPointer = &LocalAccessStatus;
01484 }
01485
01486 }
else {
01487
01488
01489
01490
01491
01492
01493
01494
01495
01496
if ( DesiredAccess & (WRITE_DAC | READ_CONTROL | MAXIMUM_ALLOWED) ) {
01497
01498
if (
SepTokenIsOwner( SubjectSecurityContext.
ClientToken, CapturedSecurityDescriptor,
TRUE )) {
01499
01500
if ( DesiredAccess & MAXIMUM_ALLOWED ) {
01501
01502 PreviouslyGrantedAccess |= ( WRITE_DAC | READ_CONTROL );
01503
01504 }
else {
01505
01506 PreviouslyGrantedAccess |= (DesiredAccess & (WRITE_DAC | READ_CONTROL));
01507 }
01508
01509 DesiredAccess &= ~(WRITE_DAC | READ_CONTROL);
01510 }
01511
01512 }
01513
01514
if (DesiredAccess == 0) {
01515
01516 LocalGrantedAccess = PreviouslyGrantedAccess;
01517 AccessGranted =
TRUE;
01518 AccessDenied =
FALSE;
01519 LocalAccessStatus = STATUS_SUCCESS;
01520
01521
if ( ReturnResultList ) {
01522 ULONG ResultListIndex;
01523 LocalGrantedAccessPointer =
01524
ExAllocatePoolWithTag(
PagedPool, (
sizeof(ACCESS_MASK)+
sizeof(
NTSTATUS)) * ObjectTypeListLength, 'aGeS' );
01525
01526
if (LocalGrantedAccessPointer ==
NULL) {
01527
Status = STATUS_INSUFFICIENT_RESOURCES;
01528
SeUnlockSubjectContext( &SubjectSecurityContext );
01529
goto Cleanup;
01530 }
01531 LocalGrantedAccessAllocated =
TRUE;
01532 LocalAccessStatusPointer = (PNTSTATUS)(LocalGrantedAccessPointer + ObjectTypeListLength);
01533
01534
for ( ResultListIndex=0; ResultListIndex<ObjectTypeListLength; ResultListIndex++ ) {
01535 LocalGrantedAccessPointer[ResultListIndex] = LocalGrantedAccess;
01536 LocalAccessStatusPointer[ResultListIndex] = LocalAccessStatus;
01537 }
01538
01539 }
else {
01540 LocalGrantedAccessPointer = &LocalGrantedAccess;
01541 LocalAccessStatusPointer = &LocalAccessStatus;
01542 }
01543
01544 }
else {
01545
01546
01547
01548
01549
01550
if ( ReturnResultList ) {
01551 LocalGrantedAccessPointer =
01552
ExAllocatePoolWithTag(
PagedPool, (
sizeof(ACCESS_MASK)+
sizeof(
NTSTATUS)) * ObjectTypeListLength, 'aGeS' );
01553
01554
if (LocalGrantedAccessPointer ==
NULL) {
01555
Status = STATUS_INSUFFICIENT_RESOURCES;
01556
SeUnlockSubjectContext( &SubjectSecurityContext );
01557
goto Cleanup;
01558 }
01559 LocalGrantedAccessAllocated =
TRUE;
01560 LocalAccessStatusPointer = (PNTSTATUS)(LocalGrantedAccessPointer + ObjectTypeListLength);
01561
01562 }
else {
01563 LocalGrantedAccessPointer = &LocalGrantedAccess;
01564 LocalAccessStatusPointer = &LocalAccessStatus;
01565 }
01566
01567
SepAccessCheck (
01568 CapturedSecurityDescriptor,
01569 CapturedPrincipalSelfSid,
01570 SubjectSecurityContext.
PrimaryToken,
01571 SubjectSecurityContext.
ClientToken,
01572 DesiredAccess,
01573 LocalObjectTypeList,
01574 ObjectTypeListLength,
01575 &LocalGenericMapping,
01576 PreviouslyGrantedAccess,
01577 PreviousMode,
01578 LocalGrantedAccessPointer,
01579
NULL,
01580 LocalAccessStatusPointer,
01581 ReturnResultList,
01582 &AccessGranted,
01583 &AccessDenied
01584 );
01585
01586 }
01587 }
01588
01589
01590
01591
01592
01593
if ( !AvoidAudit ) {
01594
if (
SepAdtAuditThisEventEx( NtAuditType, AccessGranted, AccessDenied )) {
01595
01596
SepExamineSaclEx(
01597 RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)CapturedSecurityDescriptor ),
01598
EffectiveToken( &SubjectSecurityContext ),
01599 DesiredAccess | PreviouslyGrantedAccess,
01600 LocalObjectTypeList,
01601 ObjectTypeListLength,
01602 ReturnResultList,
01603 LocalAccessStatusPointer,
01604 LocalGrantedAccessPointer,
01605 &GenerateSuccessAudit,
01606 &GenerateFailureAudit
01607 );
01608
01609 }
01610
01611
if ( GenerateSuccessAudit ||
01612 GenerateFailureAudit ) {
01613
01614
01615
01616
01617
01618
01619
01620
if ( AccessGranted ) {
01621
01622
01623
01624
01625
01626
01627
01628
01629 LocalGenerateOnClose =
TRUE;
01630 }
01631
01632
01633
01634
01635
if ( GenerateSuccessAudit ) {
01636
ExAllocateLocallyUniqueId( &OperationId );
01637
01638
01639
ASSERT( AccessGranted );
01640 AuditPerformed =
SepAdtOpenObjectAuditAlarm (
01641 CapturedSubsystemName,
01642 AccessGranted ? &HandleId :
NULL,
01643 CapturedObjectTypeName,
01644 0,
01645 CapturedObjectName,
01646 SubjectSecurityContext.
ClientToken,
01647 SubjectSecurityContext.
PrimaryToken,
01648 *LocalGrantedAccessPointer,
01649 *LocalGrantedAccessPointer,
01650 &OperationId,
01651 PrivilegeSet,
01652 ObjectCreation,
01653
TRUE,
01654
TRUE,
01655
FALSE,
01656
PsProcessAuditId(
PsGetCurrentProcess() ),
01657 NtAuditType,
01658 LocalObjectTypeList,
01659 ObjectTypeListLength,
01660 ReturnResultList ? LocalGrantedAccessPointer :
NULL
01661 );
01662 }
01663
01664
01665
01666
01667
if ( GenerateFailureAudit ) {
01668
ExAllocateLocallyUniqueId( &OperationId );
01669
01670
01671
ASSERT( AccessDenied );
01672 AuditPerformed =
SepAdtOpenObjectAuditAlarm (
01673 CapturedSubsystemName,
01674 AccessGranted ? &HandleId :
NULL,
01675 CapturedObjectTypeName,
01676 0,
01677 CapturedObjectName,
01678 SubjectSecurityContext.
ClientToken,
01679 SubjectSecurityContext.
PrimaryToken,
01680 DesiredAccess,
01681 DesiredAccess,
01682 &OperationId,
01683 PrivilegeSet,
01684 ObjectCreation,
01685
FALSE,
01686
TRUE,
01687
FALSE,
01688
PsProcessAuditId(
PsGetCurrentProcess() ),
01689 NtAuditType,
01690 LocalObjectTypeList,
01691 ObjectTypeListLength,
01692 ReturnResultList ? LocalGrantedAccessPointer :
NULL
01693 );
01694 }
01695 }
else {
01696
01697
01698
01699
01700
01701
01702
if ( PrivilegeSet !=
NULL ) {
01703
01704
if (
SepAdtAuditThisEvent( AuditCategoryPrivilegeUse, &AccessGranted) ) {
01705
01706 AuditPerformed =
SepAdtPrivilegeObjectAuditAlarm ( CapturedSubsystemName,
01707 &HandleId,
01708 SubjectSecurityContext.
ClientToken,
01709 SubjectSecurityContext.
PrimaryToken,
01710
PsProcessAuditId(
PsGetCurrentProcess() ),
01711 DesiredAccess,
01712 PrivilegeSet,
01713 AccessGranted
01714 );
01715
01716
01717
01718
01719
01720 LocalGenerateOnClose =
FALSE;
01721 }
01722 }
01723 }
01724 }
01725
01726
SeUnlockSubjectContext( &SubjectSecurityContext );
01727
01728
try {
01729
if ( ReturnResultList ) {
01730 ULONG ResultListIndex;
01731
if ( LocalAccessStatusPointer ==
NULL ) {
01732
for ( ResultListIndex=0; ResultListIndex<ObjectTypeListLength; ResultListIndex++ ) {
01733 AccessStatus[ResultListIndex] = LocalAccessStatus;
01734 GrantedAccess[ResultListIndex] = LocalGrantedAccess;
01735 }
01736 }
else {
01737
for ( ResultListIndex=0; ResultListIndex<ObjectTypeListLength; ResultListIndex++ ) {
01738 AccessStatus[ResultListIndex] = LocalAccessStatusPointer[ResultListIndex];
01739 GrantedAccess[ResultListIndex] = LocalGrantedAccessPointer[ResultListIndex];
01740 }
01741 }
01742
01743 }
else {
01744 *AccessStatus = LocalAccessStatus;
01745 *GrantedAccess = LocalGrantedAccess;
01746 }
01747 *GenerateOnClose = LocalGenerateOnClose;
01748
Status = STATUS_SUCCESS;
01749
01750 } except (
EXCEPTION_EXECUTE_HANDLER) {
01751
01752
Status = GetExceptionCode();
01753 }
01754
01755
01756
01757
01758 Cleanup:
01759
01760
if ( TokenSwapped ) {
01761
01762
01763
01764
01765
01766
ObDereferenceObject( (PVOID)NewToken );
01767
01768
01769
01770
01771
01772 SubjectSecurityContext.
ClientToken = OldToken;
01773 }
01774
01775
01776
01777
01778
01779
if (PrivilegeSet !=
NULL) {
01780
ExFreePool( PrivilegeSet );
01781 }
01782
01783
SeReleaseSubjectContext ( &SubjectSecurityContext );
01784
01785
SeReleaseSecurityDescriptor ( CapturedSecurityDescriptor,
01786 PreviousMode,
01787
FALSE );
01788
01789
if (CapturedSubsystemName !=
NULL) {
01790
SepFreeCapturedString( CapturedSubsystemName );
01791 }
01792
01793
if (CapturedObjectTypeName !=
NULL) {
01794
SepFreeCapturedString( CapturedObjectTypeName );
01795 }
01796
01797
if (CapturedObjectName !=
NULL) {
01798
SepFreeCapturedString( CapturedObjectName );
01799 }
01800
01801
if (CapturedPrincipalSelfSid !=
NULL) {
01802
SeReleaseSid( CapturedPrincipalSelfSid, PreviousMode,
TRUE);
01803 }
01804
01805
if ( LocalObjectTypeList !=
NULL ) {
01806
SeFreeCapturedObjectTypeList( LocalObjectTypeList );
01807 }
01808
01809
if ( LocalGrantedAccessAllocated ) {
01810
if ( LocalGrantedAccessPointer !=
NULL ) {
01811
ExFreePool( LocalGrantedAccessPointer );
01812 }
01813 }
01814
01815
return Status;
01816 }
01817
01818
01819
NTSTATUS
01820 NtAccessCheckAndAuditAlarm (
01821 IN PUNICODE_STRING SubsystemName,
01822 IN PVOID HandleId,
01823 IN PUNICODE_STRING ObjectTypeName,
01824 IN PUNICODE_STRING ObjectName,
01825 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
01826 IN ACCESS_MASK DesiredAccess,
01827 IN PGENERIC_MAPPING GenericMapping,
01828 IN BOOLEAN ObjectCreation,
01829 OUT PACCESS_MASK GrantedAccess,
01830 OUT PNTSTATUS AccessStatus,
01831 OUT PBOOLEAN GenerateOnClose
01832 )
01833
01834
01835
01836
01837
01838
01839
01840
01841
01842
01843
01844
01845
01846
01847
01848
01849
01850
01851
01852
01853 {
01854
PAGED_CODE();
01855
return SepAccessCheckAndAuditAlarm(
01856 SubsystemName,
01857 HandleId,
01858
NULL,
01859 ObjectTypeName,
01860 ObjectName,
01861 SecurityDescriptor,
01862
NULL,
01863 DesiredAccess,
01864 AuditEventObjectAccess,
01865 0,
01866
NULL,
01867 0,
01868 GenericMapping,
01869 ObjectCreation,
01870 GrantedAccess,
01871 AccessStatus,
01872 GenerateOnClose,
01873
FALSE );
01874
01875 }
01876
01877
01878
NTSTATUS
01879 NtAccessCheckByTypeAndAuditAlarm (
01880 IN PUNICODE_STRING SubsystemName,
01881 IN PVOID HandleId,
01882 IN PUNICODE_STRING ObjectTypeName,
01883 IN PUNICODE_STRING ObjectName,
01884 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
01885 IN PSID PrincipalSelfSid,
01886 IN ACCESS_MASK DesiredAccess,
01887 IN AUDIT_EVENT_TYPE AuditType,
01888 IN ULONG Flags,
01889 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
01890 IN ULONG ObjectTypeListLength,
01891 IN PGENERIC_MAPPING GenericMapping,
01892 IN BOOLEAN ObjectCreation,
01893 OUT PACCESS_MASK GrantedAccess,
01894 OUT PNTSTATUS AccessStatus,
01895 OUT PBOOLEAN GenerateOnClose
01896 )
01897
01898
01899
01900
01901
01902
01903
01904
01905
01906
01907
01908
01909
01910
01911
01912
01913
01914
01915
01916
01917 {
01918
PAGED_CODE();
01919
return SepAccessCheckAndAuditAlarm(
01920 SubsystemName,
01921 HandleId,
01922
NULL,
01923 ObjectTypeName,
01924 ObjectName,
01925 SecurityDescriptor,
01926 PrincipalSelfSid,
01927 DesiredAccess,
01928 AuditType,
01929 Flags,
01930 ObjectTypeList,
01931 ObjectTypeListLength,
01932 GenericMapping,
01933 ObjectCreation,
01934 GrantedAccess,
01935 AccessStatus,
01936 GenerateOnClose,
01937
FALSE );
01938
01939 }
01940
01941
01942
NTSTATUS
01943 NtAccessCheckByTypeResultListAndAuditAlarm (
01944 IN PUNICODE_STRING SubsystemName,
01945 IN PVOID HandleId,
01946 IN PUNICODE_STRING ObjectTypeName,
01947 IN PUNICODE_STRING ObjectName,
01948 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
01949 IN PSID PrincipalSelfSid,
01950 IN ACCESS_MASK DesiredAccess,
01951 IN AUDIT_EVENT_TYPE AuditType,
01952 IN ULONG Flags,
01953 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
01954 IN ULONG ObjectTypeListLength,
01955 IN PGENERIC_MAPPING GenericMapping,
01956 IN BOOLEAN ObjectCreation,
01957 OUT PACCESS_MASK GrantedAccess,
01958 OUT PNTSTATUS AccessStatus,
01959 OUT PBOOLEAN GenerateOnClose
01960 )
01961
01962
01963
01964
01965
01966
01967
01968
01969
01970
01971
01972
01973
01974
01975
01976
01977
01978
01979
01980
01981 {
01982
PAGED_CODE();
01983
return SepAccessCheckAndAuditAlarm(
01984 SubsystemName,
01985 HandleId,
01986
NULL,
01987 ObjectTypeName,
01988 ObjectName,
01989 SecurityDescriptor,
01990 PrincipalSelfSid,
01991 DesiredAccess,
01992 AuditType,
01993 Flags,
01994 ObjectTypeList,
01995 ObjectTypeListLength,
01996 GenericMapping,
01997 ObjectCreation,
01998 GrantedAccess,
01999 AccessStatus,
02000 GenerateOnClose,
02001
TRUE );
02002
02003 }
02004
02005
02006
NTSTATUS
02007 NtAccessCheckByTypeResultListAndAuditAlarmByHandle (
02008 IN PUNICODE_STRING SubsystemName,
02009 IN PVOID HandleId,
02010 IN HANDLE ClientToken,
02011 IN PUNICODE_STRING ObjectTypeName,
02012 IN PUNICODE_STRING ObjectName,
02013 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
02014 IN PSID PrincipalSelfSid,
02015 IN ACCESS_MASK DesiredAccess,
02016 IN AUDIT_EVENT_TYPE AuditType,
02017 IN ULONG Flags,
02018 IN POBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
02019 IN ULONG ObjectTypeListLength,
02020 IN PGENERIC_MAPPING GenericMapping,
02021 IN BOOLEAN ObjectCreation,
02022 OUT PACCESS_MASK GrantedAccess,
02023 OUT PNTSTATUS AccessStatus,
02024 OUT PBOOLEAN GenerateOnClose
02025 )
02026
02027
02028
02029
02030
02031
02032
02033
02034
02035
02036
02037
02038
02039
02040
02041
02042
02043
02044
02045
02046 {
02047
PAGED_CODE();
02048
return SepAccessCheckAndAuditAlarm(
02049 SubsystemName,
02050 HandleId,
02051 &
ClientToken,
02052 ObjectTypeName,
02053 ObjectName,
02054 SecurityDescriptor,
02055 PrincipalSelfSid,
02056 DesiredAccess,
02057 AuditType,
02058 Flags,
02059 ObjectTypeList,
02060 ObjectTypeListLength,
02061 GenericMapping,
02062 ObjectCreation,
02063 GrantedAccess,
02064 AccessStatus,
02065 GenerateOnClose,
02066
TRUE );
02067
02068 }
02069
02070
02071
NTSTATUS
02072 NtOpenObjectAuditAlarm (
02073 IN PUNICODE_STRING SubsystemName,
02074 IN PVOID HandleId OPTIONAL,
02075 IN PUNICODE_STRING ObjectTypeName,
02076 IN PUNICODE_STRING ObjectName,
02077 IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL,
02078 IN HANDLE ClientToken,
02079 IN ACCESS_MASK DesiredAccess,
02080 IN ACCESS_MASK GrantedAccess,
02081 IN PPRIVILEGE_SET Privileges OPTIONAL,
02082 IN BOOLEAN ObjectCreation,
02083 IN BOOLEAN AccessGranted,
02084 OUT PBOOLEAN GenerateOnClose
02085 )
02086
02087
02088
02089
02090
02091
02092
02093
02094
02095
02096
02097
02098
02099
02100
02101
02102
02103
02104
02105
02106
02107
02108
02109
02110
02111
02112
02113
02114
02115
02116
02117
02118
02119
02120
02121
02122
02123
02124
02125
02126
02127
02128
02129
02130
02131
02132
02133
02134
02135
02136
02137
02138
02139
02140
02141
02142
02143
02144
02145
02146
02147
02148
02149
02150
02151
02152
02153
02154
02155 {
02156
02157
KPROCESSOR_MODE PreviousMode;
02158 ULONG PrivilegeParameterLength;
02159 PUNICODE_STRING CapturedSubsystemName = (PUNICODE_STRING)
NULL;
02160 PUNICODE_STRING CapturedObjectTypeName = (PUNICODE_STRING)
NULL;
02161 PUNICODE_STRING CapturedObjectName = (PUNICODE_STRING)
NULL;
02162 PSECURITY_DESCRIPTOR CapturedSecurityDescriptor = (PSECURITY_DESCRIPTOR)
NULL;
02163 PPRIVILEGE_SET CapturedPrivileges =
NULL;
02164 BOOLEAN LocalGenerateOnClose =
FALSE;
02165
SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
02166 BOOLEAN Result;
02167
NTSTATUS Status;
02168 BOOLEAN GenerateAudit =
FALSE;
02169 BOOLEAN GenerateAlarm =
FALSE;
02170 PLUID ClientAuthenticationId =
NULL;
02171 HANDLE CapturedHandleId =
NULL;
02172 BOOLEAN AuditPerformed;
02173 ULONG PrivilegeCount;
02174
02175
PTOKEN Token;
02176
02177
PAGED_CODE();
02178
02179 PreviousMode = KeGetPreviousMode();
02180
02181
ASSERT( PreviousMode !=
KernelMode );
02182
02183
Status =
ObReferenceObjectByHandle(
ClientToken,
02184 TOKEN_QUERY,
02185
SepTokenObjectType,
02186 PreviousMode,
02187 (PVOID *)&
Token,
02188
NULL
02189 );
02190
02191
if (!
NT_SUCCESS(
Status)) {
02192
return(
Status );
02193 }
02194
02195
02196
02197
02198
02199
02200
if (
Token->TokenType == TokenImpersonation) {
02201
02202
if (
Token->ImpersonationLevel < SecurityIdentification) {
02203
02204
ObDereferenceObject( (PVOID)
Token );
02205
02206
return( STATUS_BAD_IMPERSONATION_LEVEL );
02207
02208 }
02209 }
02210
02211
02212
02213
02214
02215
02216
SeCaptureSubjectContext ( &SubjectSecurityContext );
02217
02218 Result =
SeCheckAuditPrivilege (
02219 &SubjectSecurityContext,
02220 PreviousMode
02221 );
02222
02223
if (!Result) {
02224
02225
ObDereferenceObject( (PVOID)
Token );
02226
02227
SeReleaseSubjectContext ( &SubjectSecurityContext );
02228
02229
return(STATUS_PRIVILEGE_NOT_HELD);
02230 }
02231
02232
02233
02234
02235
02236
Status =
SeCaptureSecurityDescriptor ( SecurityDescriptor,
02237 PreviousMode,
02238
PagedPool,
02239
FALSE,
02240 &CapturedSecurityDescriptor
02241 );
02242
02243
02244
02245
02246
02247
02248
if (!
NT_SUCCESS(
Status ) || CapturedSecurityDescriptor ==
NULL) {
02249
02250
ObDereferenceObject( (PVOID)
Token );
02251
02252
SeReleaseSubjectContext ( &SubjectSecurityContext );
02253
02254
return(
Status );
02255 }
02256
02257
try {
02258
02259
02260
02261
02262
02263
02264
if (AccessGranted && ARGUMENT_PRESENT(Privileges)) {
02265
02266
ProbeForRead(
02267 Privileges,
02268
sizeof(PRIVILEGE_SET),
02269
sizeof(ULONG)
02270 );
02271
02272 PrivilegeCount = Privileges->PrivilegeCount;
02273
if (!
IsValidElementCount( PrivilegeCount, LUID_AND_ATTRIBUTES) ) {
02274
Status = STATUS_INVALID_PARAMETER;
02275 leave;
02276 }
02277
02278 PrivilegeParameterLength = (ULONG)
sizeof(PRIVILEGE_SET) +
02279 ((PrivilegeCount -
ANYSIZE_ARRAY) *
02280 (ULONG)
sizeof(LUID_AND_ATTRIBUTES) );
02281
02282
ProbeForRead(
02283 Privileges,
02284 PrivilegeParameterLength,
02285
sizeof(ULONG)
02286 );
02287
02288 CapturedPrivileges =
ExAllocatePoolWithTag(
PagedPool,
02289 PrivilegeParameterLength,
02290 'rPeS'
02291 );
02292
02293
if (CapturedPrivileges !=
NULL) {
02294
02295 RtlCopyMemory ( CapturedPrivileges,
02296 Privileges,
02297 PrivilegeParameterLength );
02298 CapturedPrivileges->PrivilegeCount = PrivilegeCount;
02299 }
else {
02300
02301
SeReleaseSecurityDescriptor ( CapturedSecurityDescriptor,
02302 PreviousMode,
02303
FALSE );
02304
02305
ObDereferenceObject( (PVOID)
Token );
02306
SeReleaseSubjectContext ( &SubjectSecurityContext );
02307
return( STATUS_INSUFFICIENT_RESOURCES );
02308 }
02309
02310
02311 }
02312
02313
if (ARGUMENT_PRESENT( HandleId )) {
02314
02315
ProbeForRead( (PHANDLE)HandleId,
sizeof(PVOID),
sizeof(PVOID) );
02316 CapturedHandleId = *(PHANDLE)HandleId;
02317 }
02318
02319
ProbeForWriteBoolean(GenerateOnClose);
02320
02321
02322
02323
02324
02325
02326
02327
02328
SepProbeAndCaptureString_U ( SubsystemName,
02329 &CapturedSubsystemName );
02330
02331
SepProbeAndCaptureString_U ( ObjectTypeName,
02332 &CapturedObjectTypeName );
02333
02334
SepProbeAndCaptureString_U ( ObjectName,
02335 &CapturedObjectName );
02336
02337 } except(
EXCEPTION_EXECUTE_HANDLER) {
02338
Status = GetExceptionCode();
02339 }
02340
02341
if (!
NT_SUCCESS(
Status)) {
02342
02343
if (CapturedSubsystemName !=
NULL) {
02344
SepFreeCapturedString( CapturedSubsystemName );
02345 }
02346
02347
if (CapturedObjectTypeName !=
NULL) {
02348
SepFreeCapturedString( CapturedObjectTypeName );
02349 }
02350
02351
if (CapturedObjectName !=
NULL) {
02352
SepFreeCapturedString( CapturedObjectName );
02353 }
02354
02355
if (CapturedPrivileges !=
NULL) {
02356
ExFreePool( CapturedPrivileges );
02357 }
02358
02359
if (CapturedSecurityDescriptor !=
NULL) {
02360
02361
SeReleaseSecurityDescriptor ( CapturedSecurityDescriptor,
02362 PreviousMode,
02363
FALSE );
02364 }
02365
02366
ObDereferenceObject( (PVOID)
Token );
02367
02368
SeReleaseSubjectContext ( &SubjectSecurityContext );
02369
02370
return Status;
02371
02372 }
02373
02374
if (
SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted) ) {
02375
02376
SepExamineSacl(
02377 RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)CapturedSecurityDescriptor ),
02378
Token,
02379 DesiredAccess | GrantedAccess,
02380 AccessGranted,
02381 &GenerateAudit,
02382 &GenerateAlarm
02383 );
02384
02385
if (GenerateAudit || GenerateAlarm) {
02386
02387
02388
02389
02390
02391
02392 LocalGenerateOnClose =
TRUE;
02393
02394 AuditPerformed =
SepAdtOpenObjectAuditAlarm ( CapturedSubsystemName,
02395 ARGUMENT_PRESENT(HandleId) ? (PVOID)&CapturedHandleId :
NULL,
02396 CapturedObjectTypeName,
02397
NULL,
02398 CapturedObjectName,
02399
Token,
02400 SubjectSecurityContext.
PrimaryToken,
02401 DesiredAccess,
02402 GrantedAccess,
02403
NULL,
02404 CapturedPrivileges,
02405 ObjectCreation,
02406 AccessGranted,
02407 GenerateAudit,
02408 GenerateAlarm,
02409
PsProcessAuditId(
PsGetCurrentProcess() ),
02410 AuditCategoryObjectAccess,
02411
NULL,
02412 0,
02413
NULL
02414 );
02415
02416 LocalGenerateOnClose = AuditPerformed;
02417 }
02418 }
02419
02420
if ( !(GenerateAudit || GenerateAlarm) ) {
02421
02422
02423
02424
02425
02426
02427
if ( ARGUMENT_PRESENT(Privileges) ) {
02428
02429
if (
SepAdtAuditThisEvent( AuditCategoryPrivilegeUse, &AccessGranted) ) {
02430
02431 AuditPerformed =
SepAdtPrivilegeObjectAuditAlarm ( CapturedSubsystemName,
02432 CapturedHandleId,
02433
Token,
02434 SubjectSecurityContext.
PrimaryToken,
02435
PsProcessAuditId(
PsGetCurrentProcess() ),
02436 DesiredAccess,
02437 CapturedPrivileges,
02438 AccessGranted
02439 );
02440
02441
02442
02443
02444
02445 LocalGenerateOnClose =
FALSE;
02446 }
02447 }
02448 }
02449
02450
if (CapturedSecurityDescriptor !=
NULL) {
02451
02452
SeReleaseSecurityDescriptor ( CapturedSecurityDescriptor,
02453 PreviousMode,
02454
FALSE );
02455 }
02456
02457
if (CapturedSubsystemName !=
NULL) {
02458
SepFreeCapturedString( CapturedSubsystemName );
02459 }
02460
02461
if (CapturedObjectTypeName !=
NULL) {
02462
SepFreeCapturedString( CapturedObjectTypeName );
02463 }
02464
02465
if (CapturedObjectName !=
NULL) {
02466
SepFreeCapturedString( CapturedObjectName );
02467 }
02468
02469
if (CapturedPrivileges !=
NULL) {
02470
ExFreePool( CapturedPrivileges );
02471 }
02472
02473
ObDereferenceObject( (PVOID)
Token );
02474
02475
SeReleaseSubjectContext ( &SubjectSecurityContext );
02476
02477
try {
02478
02479 *GenerateOnClose = LocalGenerateOnClose;
02480
02481 } except (
EXCEPTION_EXECUTE_HANDLER) {
02482
02483
return GetExceptionCode();
02484 }
02485
02486
return(STATUS_SUCCESS);
02487 }
02488
02489
02490
02491
NTSTATUS
02492 NtCloseObjectAuditAlarm (
02493 IN PUNICODE_STRING SubsystemName,
02494 IN PVOID HandleId,
02495 IN BOOLEAN GenerateOnClose
02496 )
02497
02498
02499
02500
02501
02502
02503
02504
02505
02506
02507
02508
02509
02510
02511
02512
02513
02514
02515
02516
02517
02518
02519
02520
02521
02522
02523
02524
02525
02526
02527
02528
02529
02530
02531 {
02532 BOOLEAN Result;
02533
SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
02534
KPROCESSOR_MODE PreviousMode;
02535 PUNICODE_STRING CapturedSubsystemName =
NULL;
02536 PSID UserSid;
02537 PSID CapturedUserSid =
NULL;
02538
NTSTATUS Status;
02539
02540
PAGED_CODE();
02541
02542 PreviousMode = KeGetPreviousMode();
02543
02544
ASSERT(PreviousMode !=
KernelMode);
02545
02546
if (!GenerateOnClose) {
02547
return( STATUS_SUCCESS );
02548 }
02549
02550
02551
02552
02553
02554
SeCaptureSubjectContext ( &SubjectSecurityContext );
02555
02556 Result =
SeCheckAuditPrivilege (
02557 &SubjectSecurityContext,
02558 PreviousMode
02559 );
02560
02561
if (!Result) {
02562
Status = STATUS_PRIVILEGE_NOT_HELD;
02563
goto Cleanup;
02564 }
02565
02566 UserSid =
SepTokenUserSid(
EffectiveToken (&SubjectSecurityContext));
02567
02568 CapturedUserSid =
ExAllocatePoolWithTag(
02569
PagedPool,
02570
SeLengthSid( UserSid ),
02571 'iSeS'
02572 );
02573
02574
if ( CapturedUserSid ==
NULL ) {
02575
Status = STATUS_INSUFFICIENT_RESOURCES;
02576
goto Cleanup;
02577 }
02578
02579
Status =
RtlCopySid (
02580
SeLengthSid( UserSid ),
02581 CapturedUserSid,
02582 UserSid
02583 );
02584
02585
ASSERT(
NT_SUCCESS(
Status ));
02586
02587
02588
try {
02589
02590
SepProbeAndCaptureString_U ( SubsystemName,
02591 &CapturedSubsystemName );
02592
02593 } except (
EXCEPTION_EXECUTE_HANDLER) {
02594
Status = GetExceptionCode();
02595
goto Cleanup;
02596 }
02597
02598
02599
02600
02601
02602
SepAdtCloseObjectAuditAlarm ( CapturedSubsystemName,
02603 HandleId,
02604
NULL,
02605 CapturedUserSid,
02606
SepTokenAuthenticationId(
EffectiveToken( &SubjectSecurityContext ))
02607 );
02608
02609
Status = STATUS_SUCCESS;
02610
02611 Cleanup:
02612
if ( CapturedSubsystemName !=
NULL ) {
02613
SepFreeCapturedString( CapturedSubsystemName );
02614 }
02615
02616
if ( CapturedUserSid !=
NULL ) {
02617
ExFreePool( CapturedUserSid );
02618 }
02619
02620
SeReleaseSubjectContext ( &SubjectSecurityContext );
02621
02622
return Status;
02623 }
02624
02625
02626
NTSTATUS
02627 NtDeleteObjectAuditAlarm (
02628 IN PUNICODE_STRING SubsystemName,
02629 IN PVOID HandleId,
02630 IN BOOLEAN GenerateOnClose
02631 )
02632
02633
02634
02635
02636
02637
02638
02639
02640
02641
02642
02643
02644
02645
02646
02647
02648
02649
02650
02651
02652
02653
02654
02655
02656
02657
02658
02659
02660
02661
02662
02663
02664
02665
02666 {
02667 BOOLEAN Result;
02668
SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
02669
KPROCESSOR_MODE PreviousMode;
02670 PUNICODE_STRING CapturedSubsystemName =
NULL;
02671 PSID UserSid;
02672 PSID CapturedUserSid;
02673
NTSTATUS Status;
02674
02675
PAGED_CODE();
02676
02677 PreviousMode = KeGetPreviousMode();
02678
02679
ASSERT(PreviousMode !=
KernelMode);
02680
02681
if (!GenerateOnClose) {
02682
return( STATUS_SUCCESS );
02683 }
02684
02685
02686
02687
02688
02689
SeCaptureSubjectContext ( &SubjectSecurityContext );
02690
02691 Result =
SeCheckAuditPrivilege (
02692 &SubjectSecurityContext,
02693 PreviousMode
02694 );
02695
02696
if (!Result) {
02697
02698
SeReleaseSubjectContext ( &SubjectSecurityContext );
02699
return(STATUS_PRIVILEGE_NOT_HELD);
02700 }
02701
02702 UserSid =
SepTokenUserSid(
EffectiveToken (&SubjectSecurityContext));
02703
02704 CapturedUserSid =
ExAllocatePoolWithTag(
02705
PagedPool,
02706
SeLengthSid( UserSid ),
02707 'iSeS'
02708 );
02709
02710
if ( CapturedUserSid ==
NULL ) {
02711
SeReleaseSubjectContext ( &SubjectSecurityContext );
02712
return( STATUS_INSUFFICIENT_RESOURCES );
02713 }
02714
02715
Status =
RtlCopySid (
02716
SeLengthSid( UserSid ),
02717 CapturedUserSid,
02718 UserSid
02719 );
02720
02721
ASSERT(
NT_SUCCESS(
Status ));
02722
02723
02724
try {
02725
02726
SepProbeAndCaptureString_U ( SubsystemName,
02727 &CapturedSubsystemName );
02728
02729 } except (
EXCEPTION_EXECUTE_HANDLER) {
02730
02731
if ( CapturedSubsystemName !=
NULL ) {
02732
SepFreeCapturedString( CapturedSubsystemName );
02733 }
02734
02735
ExFreePool( CapturedUserSid );
02736
SeReleaseSubjectContext ( &SubjectSecurityContext );
02737
return GetExceptionCode();
02738
02739 }
02740
02741
02742
02743
02744
02745
SepAdtDeleteObjectAuditAlarm ( CapturedSubsystemName,
02746 HandleId,
02747
NULL,
02748 CapturedUserSid,
02749
SepTokenAuthenticationId(
EffectiveToken( &SubjectSecurityContext ))
02750 );
02751
02752
SeReleaseSubjectContext ( &SubjectSecurityContext );
02753
02754
if ( CapturedSubsystemName !=
NULL ) {
02755
SepFreeCapturedString( CapturedSubsystemName );
02756 }
02757
02758
ExFreePool( CapturedUserSid );
02759
02760
return(STATUS_SUCCESS);
02761 }
02762
02763
02764
VOID
02765 SeOpenObjectAuditAlarm (
02766 IN PUNICODE_STRING ObjectTypeName,
02767 IN PVOID Object OPTIONAL,
02768 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
02769 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
02770 IN
PACCESS_STATE AccessState,
02771 IN BOOLEAN ObjectCreated,
02772 IN BOOLEAN AccessGranted,
02773 IN KPROCESSOR_MODE AccessMode,
02774 OUT PBOOLEAN GenerateOnClose
02775 )
02776
02777
02778
02779
02780
02781
02782
02783
02784
02785
02786
02787
02788
02789
02790
02791
02792
02793
02794
02795
02796
02797
02798
02799
02800
02801
02802
02803
02804
02805
02806
02807
02808
02809
02810
02811
02812
02813
02814
02815
02816
02817
02818
02819
02820
02821
02822
02823
02824
02825
02826
02827
02828
02829
02830
02831
02832
02833
02834
02835
02836
02837 {
02838 BOOLEAN GenerateAudit =
FALSE;
02839 BOOLEAN GenerateAlarm =
FALSE;
02840 ACCESS_MASK RequestedAccess;
02841 POBJECT_NAME_INFORMATION ObjectNameInfo =
NULL;
02842 PUNICODE_STRING ObjectTypeNameInfo =
NULL;
02843 PUNICODE_STRING ObjectName =
NULL;
02844 PUNICODE_STRING LocalObjectTypeName =
NULL;
02845 PLUID PrimaryAuthenticationId =
NULL;
02846 PLUID ClientAuthenticationId =
NULL;
02847 BOOLEAN AuditPrivileges =
FALSE;
02848 BOOLEAN AuditPerformed;
02849
PTOKEN Token;
02850 ACCESS_MASK MappedGrantMask = (ACCESS_MASK)0;
02851 ACCESS_MASK MappedDenyMask = (ACCESS_MASK)0;
02852
PAUX_ACCESS_DATA AuxData;
02853
02854
PAGED_CODE();
02855
02856
if ( AccessMode ==
KernelMode ) {
02857
return;
02858 }
02859
02860 AuxData = (
PAUX_ACCESS_DATA)AccessState->AuxData;
02861
02862
Token =
EffectiveToken( &AccessState->SubjectSecurityContext );
02863
02864
if (ARGUMENT_PRESENT(
Token->AuditData)) {
02865
02866 MappedGrantMask =
Token->AuditData->GrantMask;
02867
02868
RtlMapGenericMask(
02869 &MappedGrantMask,
02870 &AuxData->
GenericMapping
02871 );
02872
02873 MappedDenyMask =
Token->AuditData->DenyMask;
02874
02875
RtlMapGenericMask(
02876 &MappedDenyMask,
02877 &AuxData->
GenericMapping
02878 );
02879 }
02880
02881
if (SecurityDescriptor !=
NULL) {
02882
02883 RequestedAccess = AccessState->RemainingDesiredAccess |
02884 AccessState->PreviouslyGrantedAccess;
02885
02886
if (
SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted )) {
02887
02888
if ( RequestedAccess & (AccessGranted ? MappedGrantMask : MappedDenyMask)) {
02889
02890 GenerateAudit =
TRUE;
02891
02892 }
else {
02893
02894
SepExamineSacl(
02895 RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ),
02896
Token,
02897 RequestedAccess,
02898 AccessGranted,
02899 &GenerateAudit,
02900 &GenerateAlarm
02901 );
02902 }
02903
02904
02905
02906
02907
02908
02909
if (GenerateAudit) {
02910 *GenerateOnClose =
TRUE;
02911 }
02912 }
02913 }
02914
02915
02916
02917
02918
02919
02920
02921
02922
02923
02924
if (!GenerateAudit && (AccessGranted ==
TRUE)) {
02925
02926
if (
SepAdtAuditThisEvent( AuditCategoryPrivilegeUse, &AccessGranted )) {
02927
02928
if ((AuxData->
PrivilegesUsed !=
NULL) &&
02929 (AuxData->
PrivilegesUsed->PrivilegeCount > 0) ) {
02930
02931
02932
02933
02934
02935
if (
SepFilterPrivilegeAudits( AuxData->
PrivilegesUsed )) {
02936
02937 GenerateAudit =
TRUE;
02938
02939
02940
02941
02942
02943
02944
02945 AccessState->AuditPrivileges =
TRUE;
02946 }
02947 }
02948 }
02949 }
02950
02951
02952
02953
02954
02955
02956
if (GenerateAudit || GenerateAlarm) {
02957
02958 AccessState->GenerateAudit =
TRUE;
02959
02960
02961
02962
02963
02964
02965
if ( !ARGUMENT_PRESENT( AbsoluteObjectName )) {
02966
02967
if ( ARGUMENT_PRESENT( Object )) {
02968
02969 ObjectNameInfo =
SepQueryNameString( Object );
02970
02971
if ( ObjectNameInfo !=
NULL ) {
02972
02973 ObjectName = &ObjectNameInfo->Name;
02974 }
02975 }
02976
02977 }
else {
02978
02979 ObjectName = AbsoluteObjectName;
02980 }
02981
02982
if ( !ARGUMENT_PRESENT( ObjectTypeName )) {
02983
02984
if ( ARGUMENT_PRESENT( Object )) {
02985
02986 ObjectTypeNameInfo =
SepQueryTypeString( Object );
02987
02988
if ( ObjectTypeNameInfo !=
NULL ) {
02989
02990 LocalObjectTypeName = ObjectTypeNameInfo;
02991 }
02992 }
02993
02994 }
else {
02995
02996 LocalObjectTypeName = ObjectTypeName;
02997 }
02998
02999
03000
03001
03002
03003
03004
03005
if (!AccessGranted) {
03006
03007 AuditPerformed =
SepAdtOpenObjectAuditAlarm ( &
SeSubsystemName,
03008
NULL,
03009 LocalObjectTypeName,
03010
NULL,
03011 ObjectName,
03012 AccessState->SubjectSecurityContext.ClientToken,
03013 AccessState->SubjectSecurityContext.PrimaryToken,
03014 AccessState->OriginalDesiredAccess,
03015 AccessState->PreviouslyGrantedAccess,
03016 &AccessState->OperationID,
03017 AuxData->
PrivilegesUsed,
03018
FALSE,
03019
FALSE,
03020
TRUE,
03021
FALSE,
03022 AccessState->SubjectSecurityContext.ProcessAuditId,
03023 AuditCategoryObjectAccess,
03024
NULL,
03025 0,
03026
NULL );
03027 }
else {
03028
03029
03030
03031
03032
03033
03034
if ( ObjectName !=
NULL ) {
03035
03036
if ( AccessState->ObjectName.Buffer !=
NULL ) {
03037
03038
ExFreePool( AccessState->ObjectName.Buffer );
03039 AccessState->ObjectName.Length = 0;
03040 AccessState->ObjectName.MaximumLength = 0;
03041 }
03042
03043 AccessState->ObjectName.Buffer =
ExAllocatePool(
PagedPool,ObjectName->MaximumLength );
03044
if (AccessState->ObjectName.Buffer !=
NULL) {
03045
03046 AccessState->ObjectName.MaximumLength = ObjectName->MaximumLength;
03047
RtlCopyUnicodeString( &AccessState->ObjectName, ObjectName );
03048 }
03049 }
03050
03051
if ( LocalObjectTypeName !=
NULL ) {
03052
03053
if ( AccessState->ObjectTypeName.Buffer !=
NULL ) {
03054
03055
ExFreePool( AccessState->ObjectTypeName.Buffer );
03056 AccessState->ObjectTypeName.Length = 0;
03057 AccessState->ObjectTypeName.MaximumLength = 0;
03058 }
03059
03060 AccessState->ObjectTypeName.Buffer =
ExAllocatePool(
PagedPool, LocalObjectTypeName->MaximumLength );
03061
if (AccessState->ObjectTypeName.Buffer !=
NULL) {
03062
03063 AccessState->ObjectTypeName.MaximumLength = LocalObjectTypeName->MaximumLength;
03064
RtlCopyUnicodeString( &AccessState->ObjectTypeName, LocalObjectTypeName );
03065 }
03066 }
03067 }
03068
03069
if ( ObjectNameInfo !=
NULL ) {
03070
03071
ExFreePool( ObjectNameInfo );
03072 }
03073
03074
if ( ObjectTypeNameInfo !=
NULL ) {
03075
03076
ExFreePool( ObjectTypeNameInfo );
03077 }
03078 }
03079
03080
return;
03081 }
03082
03083
03084
VOID
03085 SeOpenObjectForDeleteAuditAlarm (
03086 IN PUNICODE_STRING ObjectTypeName,
03087 IN PVOID Object OPTIONAL,
03088 IN PUNICODE_STRING AbsoluteObjectName OPTIONAL,
03089 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
03090 IN
PACCESS_STATE AccessState,
03091 IN BOOLEAN ObjectCreated,
03092 IN BOOLEAN AccessGranted,
03093 IN KPROCESSOR_MODE AccessMode,
03094 OUT PBOOLEAN GenerateOnClose
03095 )
03096
03097
03098
03099
03100
03101
03102
03103
03104
03105
03106
03107
03108
03109
03110
03111
03112
03113
03114
03115
03116
03117
03118
03119
03120
03121
03122
03123
03124
03125
03126
03127
03128
03129
03130
03131
03132
03133
03134
03135
03136
03137
03138
03139
03140
03141
03142
03143
03144
03145
03146
03147
03148
03149
03150
03151
03152
03153
03154
03155
03156
03157
03158
03159 {
03160 BOOLEAN GenerateAudit =
FALSE;
03161 BOOLEAN GenerateAlarm =
FALSE;
03162 ACCESS_MASK RequestedAccess;
03163 POBJECT_NAME_INFORMATION ObjectNameInfo =
NULL;
03164 PUNICODE_STRING ObjectTypeNameInfo =
NULL;
03165 PUNICODE_STRING ObjectName =
NULL;
03166 PUNICODE_STRING LocalObjectTypeName =
NULL;
03167 PLUID PrimaryAuthenticationId =
NULL;
03168 PLUID ClientAuthenticationId =
NULL;
03169 BOOLEAN AuditPrivileges =
FALSE;
03170 BOOLEAN AuditPerformed;
03171
PTOKEN Token;
03172 ACCESS_MASK MappedGrantMask = (ACCESS_MASK)0;
03173 ACCESS_MASK MappedDenyMask = (ACCESS_MASK)0;
03174
PAUX_ACCESS_DATA AuxData;
03175
03176
PAGED_CODE();
03177
03178
if ( AccessMode ==
KernelMode ) {
03179
return;
03180 }
03181
03182 AuxData = (
PAUX_ACCESS_DATA)AccessState->AuxData;
03183
03184
Token =
EffectiveToken( &AccessState->SubjectSecurityContext );
03185
03186
if (ARGUMENT_PRESENT(
Token->AuditData)) {
03187
03188 MappedGrantMask =
Token->AuditData->GrantMask;
03189
03190
RtlMapGenericMask(
03191 &MappedGrantMask,
03192 &AuxData->
GenericMapping
03193 );
03194
03195 MappedDenyMask =
Token->AuditData->DenyMask;
03196
03197
RtlMapGenericMask(
03198 &MappedDenyMask,
03199 &AuxData->
GenericMapping
03200 );
03201 }
03202
03203
if (SecurityDescriptor !=
NULL) {
03204
03205 RequestedAccess = AccessState->RemainingDesiredAccess |
03206 AccessState->PreviouslyGrantedAccess;
03207
03208
if (
SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted )) {
03209
03210
if ( RequestedAccess & (AccessGranted ? MappedGrantMask : MappedDenyMask)) {
03211
03212 GenerateAudit =
TRUE;
03213
03214 }
else {
03215
03216
SepExamineSacl(
03217 RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ),
03218
Token,
03219 RequestedAccess,
03220 AccessGranted,
03221 &GenerateAudit,
03222 &GenerateAlarm
03223 );
03224 }
03225
03226
03227
03228
03229
03230
03231
if (GenerateAudit) {
03232 *GenerateOnClose =
TRUE;
03233 }
03234 }
03235 }
03236
03237
03238
03239
03240
03241
03242
03243
03244
03245
03246
if (!GenerateAudit && (AccessGranted ==
TRUE)) {
03247
03248
if (
SepAdtAuditThisEvent( AuditCategoryPrivilegeUse, &AccessGranted )) {
03249
03250
if ((AuxData->
PrivilegesUsed !=
NULL) &&
03251 (AuxData->
PrivilegesUsed->PrivilegeCount > 0) ) {
03252
03253
03254
03255
03256
03257
if (
SepFilterPrivilegeAudits( AuxData->
PrivilegesUsed )) {
03258
03259 GenerateAudit =
TRUE;
03260
03261
03262
03263
03264
03265
03266
03267 AccessState->AuditPrivileges =
TRUE;
03268 }
03269 }
03270 }
03271 }
03272
03273
03274
03275
03276
03277
03278
if (GenerateAudit || GenerateAlarm) {
03279
03280 AccessState->GenerateAudit =
TRUE;
03281
03282
03283
03284
03285
03286
03287
if ( !ARGUMENT_PRESENT( AbsoluteObjectName )) {
03288
03289
if ( ARGUMENT_PRESENT( Object )) {
03290
03291 ObjectNameInfo =
SepQueryNameString( Object );
03292
03293
if ( ObjectNameInfo !=
NULL ) {
03294
03295 ObjectName = &ObjectNameInfo->Name;
03296 }
03297 }
03298
03299 }
else {
03300
03301 ObjectName = AbsoluteObjectName;
03302 }
03303
03304
if ( !ARGUMENT_PRESENT( ObjectTypeName )) {
03305
03306
if ( ARGUMENT_PRESENT( Object )) {
03307
03308 ObjectTypeNameInfo =
SepQueryTypeString( Object );
03309
03310
if ( ObjectTypeNameInfo !=
NULL ) {
03311
03312 LocalObjectTypeName = ObjectTypeNameInfo;
03313 }
03314 }
03315
03316 }
else {
03317
03318 LocalObjectTypeName = ObjectTypeName;
03319 }
03320
03321
03322
03323
03324
03325
03326
03327
if (!AccessGranted) {
03328
03329 AuditPerformed =
SepAdtOpenObjectAuditAlarm ( &
SeSubsystemName,
03330
NULL,
03331 LocalObjectTypeName,
03332
NULL,
03333 ObjectName,
03334 AccessState->SubjectSecurityContext.ClientToken,
03335 AccessState->SubjectSecurityContext.PrimaryToken,
03336 AccessState->OriginalDesiredAccess,
03337 AccessState->PreviouslyGrantedAccess,
03338 &AccessState->OperationID,
03339 AuxData->
PrivilegesUsed,
03340
FALSE,
03341
FALSE,
03342
TRUE,
03343
FALSE,
03344 AccessState->SubjectSecurityContext.ProcessAuditId,
03345 AuditCategoryObjectAccess,
03346
NULL,
03347 0,
03348
NULL );
03349 }
else {
03350
03351
03352
03353
03354
03355
SepAdtOpenObjectForDeleteAuditAlarm ( &
SeSubsystemName,
03356
NULL,
03357 LocalObjectTypeName,
03358
NULL,
03359 ObjectName,
03360 AccessState->SubjectSecurityContext.ClientToken,
03361 AccessState->SubjectSecurityContext.PrimaryToken,
03362 AccessState->OriginalDesiredAccess,
03363 AccessState->PreviouslyGrantedAccess,
03364 &AccessState->OperationID,
03365 AuxData->
PrivilegesUsed,
03366
FALSE,
03367
TRUE,
03368
TRUE,
03369
FALSE,
03370 AccessState->SubjectSecurityContext.ProcessAuditId );
03371
03372
03373
03374
03375
03376
03377
if ( ObjectName !=
NULL ) {
03378
03379
if ( AccessState->ObjectName.Buffer !=
NULL ) {
03380
03381
ExFreePool( AccessState->ObjectName.Buffer );
03382 AccessState->ObjectName.Length = 0;
03383 AccessState->ObjectName.MaximumLength = 0;
03384 }
03385
03386 AccessState->ObjectName.Buffer =
ExAllocatePool(
PagedPool,ObjectName->MaximumLength );
03387
if (AccessState->ObjectName.Buffer !=
NULL) {
03388
03389 AccessState->ObjectName.MaximumLength = ObjectName->MaximumLength;
03390
RtlCopyUnicodeString( &AccessState->ObjectName, ObjectName );
03391 }
03392 }
03393
03394
if ( LocalObjectTypeName !=
NULL ) {
03395
03396
if ( AccessState->ObjectTypeName.Buffer !=
NULL ) {
03397
03398
ExFreePool( AccessState->ObjectTypeName.Buffer );
03399 AccessState->ObjectTypeName.Length = 0;
03400 AccessState->ObjectTypeName.MaximumLength = 0;
03401 }
03402
03403 AccessState->ObjectTypeName.Buffer =
ExAllocatePool(
PagedPool, LocalObjectTypeName->MaximumLength );
03404
if (AccessState->ObjectTypeName.Buffer !=
NULL) {
03405
03406 AccessState->ObjectTypeName.MaximumLength = LocalObjectTypeName->MaximumLength;
03407
RtlCopyUnicodeString( &AccessState->ObjectTypeName, LocalObjectTypeName );
03408 }
03409 }
03410 }
03411
03412
if ( ObjectNameInfo !=
NULL ) {
03413
03414
ExFreePool( ObjectNameInfo );
03415 }
03416
03417
if ( ObjectTypeNameInfo !=
NULL ) {
03418
03419
ExFreePool( ObjectTypeNameInfo );
03420 }
03421 }
03422
03423
return;
03424 }
03425
03426
03427
03428
VOID
03429 SeTraverseAuditAlarm(
03430 IN PLUID OperationID,
03431 IN PVOID DirectoryObject,
03432 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
03433 IN
PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
03434 IN BOOLEAN SubjectContextLocked,
03435 IN ACCESS_MASK TraverseAccess,
03436 IN PPRIVILEGE_SET Privileges OPTIONAL,
03437 IN BOOLEAN AccessGranted,
03438 IN KPROCESSOR_MODE AccessMode
03439 )
03440
03441
03442
03443
03444
03445
03446
03447
03448
03449
03450
03451
03452
03453
03454
03455
03456
03457
03458
03459
03460
03461
03462
03463
03464
03465
03466
03467
03468
03469
03470
03471
03472
03473
03474
03475
03476
03477
03478
03479
03480
03481 {
03482
PAGED_CODE();
03483
03484
#if 0
03485
BOOLEAN GenerateAudit =
FALSE;
03486 BOOLEAN GenerateAlarm =
FALSE;
03487
03488
if (AccessMode ==
KernelMode) {
03489
return;
03490 }
03491
03492
if ((
SeAuditingState[AuditEventTraverse].
AuditOnSuccess && AccessGranted) ||
03493
SeAuditingState[AuditEventTraverse].
AuditOnFailure && !AccessGranted) {
03494
03495
if ( SecurityDescriptor !=
NULL ) {
03496
03497
if ( !SubjectContextLocked ) {
03498
SeLockSubjectContext( SubjectSecurityContext );
03499 }
03500
03501
SepExamineSacl(
03502 RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ),
03503
EffectiveToken( SubjectSecurityContext ),
03504 TraverseAccess,
03505 AccessGranted,
03506 &GenerateAudit,
03507 &GenerateAlarm
03508 );
03509
03510
if (GenerateAudit || GenerateAlarm) {
03511
03512
SepAdtTraverseAuditAlarm(
03513 OperationID,
03514 DirectoryObject,
03515
SepTokenUserSid(
EffectiveToken( SubjectSecurityContext )),
03516
SepTokenAuthenticationId(
EffectiveToken( SubjectSecurityContext )),
03517 TraverseAccess,
03518 Privileges,
03519 AccessGranted,
03520 GenerateAudit,
03521 GenerateAlarm
03522 );
03523 }
03524
03525
if ( !SubjectContextLocked ) {
03526
SeUnlockSubjectContext( SubjectSecurityContext );
03527 }
03528 }
03529 }
03530
03531
#endif
03532
03533
return;
03534 }
03535
03536
03537
VOID
03538 SeCreateObjectAuditAlarm(
03539 IN PLUID OperationID OPTIONAL,
03540 IN PVOID DirectoryObject,
03541 IN PUNICODE_STRING ComponentName,
03542 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
03543 IN
PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
03544 IN ACCESS_MASK DesiredAccess,
03545 IN PPRIVILEGE_SET Privileges OPTIONAL,
03546 IN BOOLEAN AccessGranted,
03547 OUT PBOOLEAN AuditPerformed,
03548 IN KPROCESSOR_MODE AccessMode
03549 )
03550
03551
03552
03553
03554
03555
03556
03557
03558
03559
03560
03561
03562
03563
03564
03565
03566
03567
03568
03569
03570
03571
03572
03573
03574
03575
03576
03577
03578
03579
03580
03581
03582
03583
03584
03585
03586
03587
03588
03589 {
03590
PAGED_CODE();
03591
#if 0
03592
03593 BOOLEAN GenerateAudit =
FALSE;
03594 BOOLEAN GenerateAlarm =
FALSE;
03595 PUNICODE_STRING
DirectoryName;
03596 POBJECT_NAME_INFORMATION ObjectNameInformation =
NULL;
03597
03598 UNREFERENCED_PARAMETER( DirectoryObject );
03599 UNREFERENCED_PARAMETER( Privileges );
03600
03601
if (AccessMode ==
KernelMode) {
03602
return;
03603 }
03604
03605
if ( SecurityDescriptor !=
NULL ) {
03606
03607
if (
SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted )) {
03608
03609
SepExamineSacl(
03610 RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ),
03611
EffectiveToken( SubjectSecurityContext ),
03612 DesiredAccess,
03613 AccessGranted,
03614 &GenerateAudit,
03615 &GenerateAlarm
03616 );
03617
03618
if ( GenerateAudit || GenerateAlarm ) {
03619
03620
03621
03622
03623
03624 ObjectNameInformation =
SepQueryNameString( DirectoryObject );
03625
03626
if ( ObjectNameInformation !=
NULL ) {
03627
03628
DirectoryName = &ObjectNameInformation->Name;
03629 }
03630
03631
SepAdtCreateObjectAuditAlarm(
03632 OperationID,
03633
DirectoryName,
03634 ComponentName,
03635
SepTokenUserSid(
EffectiveToken( SubjectSecurityContext )),
03636
SepTokenAuthenticationId(
EffectiveToken( SubjectSecurityContext )),
03637 DesiredAccess,
03638 AccessGranted,
03639 GenerateAudit,
03640 GenerateAlarm
03641 );
03642
03643 *AuditPerformed =
TRUE;
03644
03645
if (
DirectoryName !=
NULL ) {
03646
03647
ExFreePool(
DirectoryName );
03648 }
03649 }
03650 }
03651 }
03652
03653
#endif
03654
03655
return;
03656 }
03657
03658
03659
VOID
03660 SeObjectReferenceAuditAlarm(
03661 IN PLUID OperationID OPTIONAL,
03662 IN PVOID Object,
03663 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
03664 IN
PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext,
03665 IN ACCESS_MASK DesiredAccess,
03666 IN PPRIVILEGE_SET Privileges OPTIONAL,
03667 IN BOOLEAN AccessGranted,
03668 IN KPROCESSOR_MODE AccessMode
03669 )
03670
03671
03672
03673
03674
03675
03676
03677
03678
03679
03680
03681
03682
03683
03684
03685
03686
03687
03688
03689
03690 {
03691 BOOLEAN GenerateAudit =
FALSE;
03692 BOOLEAN GenerateAlarm =
FALSE;
03693
03694
PAGED_CODE();
03695
03696
if (AccessMode ==
KernelMode) {
03697
return;
03698 }
03699
03700
if ( SecurityDescriptor !=
NULL ) {
03701
03702
if (
SepAdtAuditThisEvent( AuditCategoryDetailedTracking, &AccessGranted )) {
03703
03704
SepExamineSacl(
03705 RtlpSaclAddrSecurityDescriptor( (PISECURITY_DESCRIPTOR)SecurityDescriptor ),
03706
EffectiveToken( SubjectSecurityContext ),
03707 DesiredAccess,
03708 AccessGranted,
03709 &GenerateAudit,
03710 &GenerateAlarm
03711 );
03712
03713
if ( GenerateAudit || GenerateAlarm ) {
03714
03715
SepAdtObjectReferenceAuditAlarm(
03716 OperationID,
03717 Object,
03718 SubjectSecurityContext,
03719 DesiredAccess,
03720 Privileges,
03721 AccessGranted,
03722 GenerateAudit,
03723 GenerateAlarm
03724 );
03725 }
03726 }
03727 }
03728
03729
return;
03730
03731 }
03732
03733
03734
03735
VOID
03736 SeAuditHandleCreation(
03737 IN
PACCESS_STATE AccessState,
03738 IN HANDLE Handle
03739 )
03740
03741
03742
03743
03744
03745
03746
03747
03748
03749
03750
03751
03752
03753
03754
03755
03756
03757
03758
03759
03760
03761
03762
03763
03764
03765
03766
03767
03768 {
03769 BOOLEAN AuditPerformed =
FALSE;
03770
PAUX_ACCESS_DATA AuxData;
03771
03772
PAGED_CODE();
03773
03774 AuxData = (
PAUX_ACCESS_DATA)AccessState->AuxData;
03775
03776
if ( AccessState->GenerateAudit ) {
03777
03778
if ( AccessState->AuditPrivileges ) {
03779
03780 AuditPerformed =
SepAdtPrivilegeObjectAuditAlarm (
03781 &
SeSubsystemName,
03782
Handle,
03783 (
PTOKEN)AccessState->SubjectSecurityContext.ClientToken,
03784 (
PTOKEN)AccessState->SubjectSecurityContext.PrimaryToken,
03785 &AccessState->SubjectSecurityContext.ProcessAuditId,
03786 AccessState->PreviouslyGrantedAccess,
03787 AuxData->
PrivilegesUsed,
03788
TRUE
03789 );
03790 }
else {
03791
03792 AuditPerformed =
SepAdtOpenObjectAuditAlarm ( &
SeSubsystemName,
03793 &
Handle,
03794 &AccessState->ObjectTypeName,
03795
NULL,
03796 &AccessState->ObjectName,
03797 AccessState->SubjectSecurityContext.ClientToken,
03798 AccessState->SubjectSecurityContext.PrimaryToken,
03799 AccessState->OriginalDesiredAccess,
03800 AccessState->PreviouslyGrantedAccess,
03801 &AccessState->OperationID,
03802 AuxData->
PrivilegesUsed,
03803
FALSE,
03804
TRUE,
03805
TRUE,
03806
FALSE,
03807
PsGetCurrentProcessId(),
03808 AuditCategoryObjectAccess,
03809
NULL,
03810 0,
03811
NULL );
03812 }
03813 }
03814
03815
03816
03817
03818
03819 AccessState->GenerateOnClose = AuditPerformed;
03820
03821
return;
03822 }
03823
03824
03825
VOID
03826 SeCloseObjectAuditAlarm(
03827 IN PVOID Object,
03828 IN HANDLE Handle,
03829 IN BOOLEAN GenerateOnClose
03830 )
03831
03832
03833
03834
03835
03836
03837
03838
03839
03840
03841
03842
03843
03844
03845
03846
03847
03848
03849
03850
03851
03852
03853
03854
03855
03856
03857
03858
03859
03860
03861
03862 {
03863
SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
03864 PSID UserSid;
03865
NTSTATUS Status;
03866
03867
PAGED_CODE();
03868
03869
if (GenerateOnClose) {
03870
03871
SeCaptureSubjectContext ( &SubjectSecurityContext );
03872
03873 UserSid =
SepTokenUserSid(
EffectiveToken (&SubjectSecurityContext));
03874
03875
03876
SepAdtCloseObjectAuditAlarm (
03877 &
SeSubsystemName,
03878 (PVOID)
Handle,
03879 Object,
03880 UserSid,
03881
SepTokenAuthenticationId(
EffectiveToken (&SubjectSecurityContext))
03882 );
03883
03884
SeReleaseSubjectContext ( &SubjectSecurityContext );
03885 }
03886
03887
return;
03888 }
03889
03890
03891
VOID
03892 SeDeleteObjectAuditAlarm(
03893 IN PVOID Object,
03894 IN HANDLE Handle
03895 )
03896
03897
03898
03899
03900
03901
03902
03903
03904
03905
03906
03907
03908
03909
03910
03911
03912
03913
03914
03915
03916
03917
03918
03919
03920
03921
03922
03923
03924 {
03925
SECURITY_SUBJECT_CONTEXT SubjectSecurityContext;
03926 PSID UserSid;
03927
NTSTATUS Status;
03928
03929
PAGED_CODE();
03930
03931
SeCaptureSubjectContext ( &SubjectSecurityContext );
03932
03933 UserSid =
SepTokenUserSid(
EffectiveToken (&SubjectSecurityContext));
03934
03935
03936
03937
SepAdtDeleteObjectAuditAlarm (
03938 &
SeSubsystemName,
03939 (PVOID)
Handle,
03940 Object,
03941 UserSid,
03942
SepTokenAuthenticationId(
EffectiveToken (&SubjectSecurityContext))
03943 );
03944
03945
SeReleaseSubjectContext ( &SubjectSecurityContext );
03946
03947
return;
03948 }
03949
03950
03951
VOID
03952 SepExamineSacl(
03953 IN PACL Sacl,
03954 IN PACCESS_TOKEN Token,
03955 IN ACCESS_MASK DesiredAccess,
03956 IN BOOLEAN AccessGranted,
03957 OUT PBOOLEAN GenerateAudit,
03958 OUT PBOOLEAN GenerateAlarm
03959 )
03960
03961
03962
03963
03964
03965
03966
03967
03968
03969
03970
03971
03972
03973
03974
03975
03976
03977
03978
03979
03980
03981
03982
03983
03984
03985
03986
03987
03988
03989
03990
03991
03992
03993 {
03994
03995 ULONG i;
03996 PVOID Ace;
03997 ULONG AceCount;
03998 ACCESS_MASK AccessMask;
03999 UCHAR AceFlags;
04000 BOOLEAN FailedMaximumAllowed;
04001
04002
PAGED_CODE();
04003
04004 *GenerateAudit =
FALSE;
04005 *GenerateAlarm =
FALSE;
04006
04007
04008
04009
04010
04011
04012
04013 FailedMaximumAllowed =
FALSE;
04014
if (!AccessGranted && (DesiredAccess & MAXIMUM_ALLOWED)) {
04015 FailedMaximumAllowed =
TRUE;
04016 }
04017
04018
04019
04020
04021
04022
if (Sacl ==
NULL) {
04023
04024
return;
04025 }
04026
04027 AceCount = Sacl->AceCount;
04028
04029
if (AceCount == 0) {
04030
return;
04031 }
04032
04033
04034
04035
04036
04037
04038
04039
for ( i = 0, Ace =
FirstAce( Sacl ) ;
04040 (i < AceCount) && !(*GenerateAudit && *GenerateAlarm);
04041 i++, Ace =
NextAce( Ace ) ) {
04042
04043
if ( !(((PACE_HEADER)Ace)->AceFlags & INHERIT_ONLY_ACE)) {
04044
04045
if ( (((PACE_HEADER)Ace)->AceType == SYSTEM_AUDIT_ACE_TYPE) ) {
04046
04047
if (
SepSidInToken( (PACCESS_TOKEN)
Token,
NULL, &((PSYSTEM_AUDIT_ACE)Ace)->SidStart,
FALSE ) ) {
04048
04049 AccessMask = ((PSYSTEM_AUDIT_ACE)Ace)->Mask;
04050 AceFlags = ((PACE_HEADER)Ace)->AceFlags;
04051
04052
if ( AccessMask & DesiredAccess ) {
04053
04054
if (((AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG) && AccessGranted) ||
04055 ((AceFlags & FAILED_ACCESS_ACE_FLAG) && !AccessGranted)) {
04056
04057 *GenerateAudit =
TRUE;
04058 }
04059 }
else if ( FailedMaximumAllowed && (AceFlags & FAILED_ACCESS_ACE_FLAG) ) {
04060 *GenerateAudit =
TRUE;
04061 }
04062 }
04063
04064
continue;
04065 }
04066
04067
if ( (((PACE_HEADER)Ace)->AceType == SYSTEM_ALARM_ACE_TYPE) ) {
04068
04069
if (
SepSidInToken( (PACCESS_TOKEN)
Token,
NULL, &((PSYSTEM_ALARM_ACE)Ace)->SidStart,
FALSE ) ) {
04070
04071 AccessMask = ((PSYSTEM_ALARM_ACE)Ace)->Mask;
04072
04073
if ( AccessMask & DesiredAccess ) {
04074
04075 AceFlags = ((PACE_HEADER)Ace)->AceFlags;
04076
04077
if (((AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG) && AccessGranted) ||
04078 ((AceFlags & FAILED_ACCESS_ACE_FLAG) && !AccessGranted)) {
04079
04080 *GenerateAlarm =
TRUE;
04081 }
04082 }
04083 }
04084 }
04085 }
04086 }
04087
04088
return;
04089 }
04090
04091
04092
VOID
04093 SepAuditTypeList (
04094 IN
PIOBJECT_TYPE_LIST ObjectTypeList,
04095 IN ULONG ObjectTypeListLength,
04096 IN PNTSTATUS AccessStatus,
04097 IN ULONG StartIndex,
04098 OUT PBOOLEAN GenerateSuccessAudit,
04099 OUT PBOOLEAN GenerateFailureAudit
04100 )
04101
04102
04103
04104
04105
04106
04107
04108
04109
04110
04111
04112
04113
04114
04115
04116
04117
04118
04119
04120
04121
04122
04123
04124
04125
04126
04127
04128
04129
04130
04131 {
04132 ULONG
Index;
04133 BOOLEAN WasSuccess;
04134
04135
PAGED_CODE();
04136
04137
04138
04139
04140
04141 WasSuccess =
NT_SUCCESS( AccessStatus[StartIndex] );
04142
04143
04144
04145
04146
04147
for (
Index=StartIndex+1;
Index<ObjectTypeListLength;
Index++ ) {
04148
04149
04150
04151
04152
04153
04154
04155
04156
04157
if ( ObjectTypeList[
Index].Level <= ObjectTypeList[StartIndex].Level ) {
04158
break;
04159 }
04160
04161
04162
04163
04164
04165
04166
if ( WasSuccess && !
NT_SUCCESS( AccessStatus[
Index]) ) {
04167 *GenerateFailureAudit =
TRUE;
04168 ObjectTypeList[
Index].Flags |=
OBJECT_FAILURE_AUDIT;
04169 }
else if ( !WasSuccess &&
NT_SUCCESS( AccessStatus[
Index]) ) {
04170 *GenerateSuccessAudit =
TRUE;
04171 ObjectTypeList[
Index].Flags |=
OBJECT_SUCCESS_AUDIT;
04172 }
04173
04174 }
04175 }
04176
04177
04178
VOID
04179 SepSetAuditInfoForObjectType(
04180 IN UCHAR AceFlags,
04181 IN ACCESS_MASK AccessMask,
04182 IN ACCESS_MASK DesiredAccess,
04183 IN
PIOBJECT_TYPE_LIST ObjectTypeList,
04184 IN ULONG ObjectTypeListLength,
04185 IN BOOLEAN ReturnResultList,
04186 IN ULONG ObjectTypeIndex,
04187 IN PNTSTATUS AccessStatus,
04188 IN PACCESS_MASK GrantedAccess,
04189 IN BOOLEAN FailedMaximumAllowed,
04190 OUT PBOOLEAN GenerateSuccessAudit,
04191 OUT PBOOLEAN GenerateFailureAudit
04192 )
04193
04194
04195
04196
04197
04198
04199
04200
04201
04202
04203
04204
04205
04206
04207
04208
04209
04210
04211 {
04212
if ( AccessMask & (DesiredAccess|GrantedAccess[ObjectTypeIndex]) ) {
04213
04214
if ( (AceFlags & SUCCESSFUL_ACCESS_ACE_FLAG) &&
04215
NT_SUCCESS(AccessStatus[ObjectTypeIndex]) ) {
04216
04217 *GenerateSuccessAudit =
TRUE;
04218
if ( ObjectTypeListLength != 0 ) {
04219
04220 ObjectTypeList[ObjectTypeIndex].Flags |=
OBJECT_SUCCESS_AUDIT;
04221
if ( ReturnResultList ) {
04222
SepAuditTypeList( ObjectTypeList,
04223 ObjectTypeListLength,
04224 AccessStatus,
04225 ObjectTypeIndex,
04226 GenerateSuccessAudit,
04227 GenerateFailureAudit );
04228 }
04229 }
04230
04231 }
else if ((AceFlags & FAILED_ACCESS_ACE_FLAG) &&
04232 !
NT_SUCCESS(AccessStatus[ObjectTypeIndex]) ) {
04233
04234 *GenerateFailureAudit =
TRUE;
04235
if ( ObjectTypeListLength != 0 ) {
04236 ObjectTypeList[ObjectTypeIndex].Flags |=
OBJECT_FAILURE_AUDIT;
04237
if ( ReturnResultList ) {
04238
SepAuditTypeList( ObjectTypeList,
04239 ObjectTypeListLength,
04240 AccessStatus,
04241 ObjectTypeIndex,
04242 GenerateSuccessAudit,
04243 GenerateFailureAudit );
04244 }
04245 }
04246 }
04247 }
else if ( FailedMaximumAllowed && (AceFlags & FAILED_ACCESS_ACE_FLAG) ) {
04248 *GenerateFailureAudit =
TRUE;
04249
if ( ObjectTypeListLength != 0 ) {
04250 ObjectTypeList[ObjectTypeIndex].Flags |=
OBJECT_FAILURE_AUDIT;
04251 }
04252 }
04253 }
04254
04255
04256
VOID
04257 SepExamineSaclEx(
04258 IN PACL Sacl,
04259 IN PACCESS_TOKEN Token,
04260 IN ACCESS_MASK DesiredAccess,
04261 IN
PIOBJECT_TYPE_LIST ObjectTypeList OPTIONAL,
04262 IN ULONG ObjectTypeListLength,
04263 IN BOOLEAN ReturnResultList,
04264 IN PNTSTATUS AccessStatus,
04265 IN PACCESS_MASK GrantedAccess,
04266 OUT PBOOLEAN GenerateSuccessAudit,
04267 OUT PBOOLEAN GenerateFailureAudit
04268 )
04269
04270
04271
04272
04273
04274
04275
04276
04277
04278
04279
04280
04281
04282
04283
04284
04285
04286
04287
04288
04289
04290
04291
04292
04293
04294
04295
04296
04297
04298
04299
04300
04301
04302
04303
04304
04305
04306
04307
04308
04309
04310
04311
04312
04313
04314 {
04315
04316 ULONG i, j;
04317 PVOID Ace;
04318 ULONG AceCount;
04319 ACCESS_MASK AccessMask;
04320 UCHAR AceFlags;
04321 BOOLEAN FailedMaximumAllowed;
04322 ULONG
Index;
04323 ULONG SuccessIndex;
04324
#define INVALID_OBJECT_TYPE_LIST_INDEX 0xFFFFFFFF
04325
04326
PAGED_CODE();
04327
04328 *GenerateSuccessAudit =
FALSE;
04329 *GenerateFailureAudit =
FALSE;
04330
04331
04332
04333
04334
04335
04336
04337 FailedMaximumAllowed =
FALSE;
04338
if (!
NT_SUCCESS(*AccessStatus) && (DesiredAccess & MAXIMUM_ALLOWED)) {
04339 FailedMaximumAllowed =
TRUE;
04340 }
04341
04342
04343
04344
04345
04346
if (Sacl ==
NULL) {
04347
return;
04348 }
04349
04350 AceCount = Sacl->AceCount;
04351
04352
if (AceCount == 0) {
04353
return;
04354 }
04355
04356
04357
04358
04359
04360
04361
04362
04363
for ( i = 0, Ace =
FirstAce( Sacl ) ;
04364 (i < AceCount) && !((*GenerateSuccessAudit || *GenerateFailureAudit) && ObjectTypeListLength <= 1 );
04365 i++, Ace =
NextAce( Ace ) ) {
04366
04367 AceFlags = ((PACE_HEADER)Ace)->AceFlags;
04368
04369
if ( !(AceFlags & INHERIT_ONLY_ACE)) {
04370
04371
Index =
INVALID_OBJECT_TYPE_LIST_INDEX;
04372
04373
if ( (((PACE_HEADER)Ace)->AceType == SYSTEM_AUDIT_ACE_TYPE) ) {
04374
04375
if (
SepSidInToken(
Token,
NULL, &((PSYSTEM_AUDIT_ACE)Ace)->SidStart, (BOOLEAN) ((AceFlags & FAILED_ACCESS_ACE_FLAG) != 0) ) ) {
04376
04377 AccessMask = ((PSYSTEM_AUDIT_ACE)Ace)->Mask;
04378
04379
for (j=0; j < ObjectTypeListLength; j++)
04380 {
04381
SepSetAuditInfoForObjectType(AceFlags,
04382 AccessMask,
04383 DesiredAccess,
04384 ObjectTypeList,
04385 ObjectTypeListLength,
04386 ReturnResultList,
04387 j,
04388 AccessStatus,
04389 GrantedAccess,
04390 FailedMaximumAllowed,
04391 GenerateSuccessAudit,
04392 GenerateFailureAudit
04393 );
04394 }
04395
Index =
INVALID_OBJECT_TYPE_LIST_INDEX;
04396 }
04397
04398
04399
04400
04401 }
else if ( (((PACE_HEADER)Ace)->AceType == SYSTEM_AUDIT_OBJECT_ACE_TYPE) ) {
04402 GUID *ObjectTypeInAce;
04403
04404
04405
04406
04407
04408
04409 AccessMask = ((PSYSTEM_AUDIT_OBJECT_ACE)Ace)->Mask;
04410 ObjectTypeInAce = RtlObjectAceObjectType(Ace);
04411
04412
if ( ObjectTypeInAce ==
NULL ) {
04413
04414
if (
SepSidInToken(
Token,
NULL, RtlObjectAceSid(Ace), (BOOLEAN)((AceFlags & FAILED_ACCESS_ACE_FLAG) != 0) ) ) {
04415
04416
for (j=0; j < ObjectTypeListLength; j++)
04417 {
04418
SepSetAuditInfoForObjectType(AceFlags,
04419 AccessMask,
04420 DesiredAccess,
04421 ObjectTypeList,
04422 ObjectTypeListLength,
04423 ReturnResultList,
04424 j,
04425 AccessStatus,
04426 GrantedAccess,
04427 FailedMaximumAllowed,
04428 GenerateSuccessAudit,
04429 GenerateFailureAudit
04430 );
04431 }
04432
Index =
INVALID_OBJECT_TYPE_LIST_INDEX;
04433 }
04434
04435
04436
04437
04438
04439
04440 }
else if ( ObjectTypeListLength == 0 ) {
04441
04442
04443
04444
04445
04446
04447
04448 }
else {
04449
04450
if (
SepSidInToken(
Token,
NULL, RtlObjectAceSid(Ace), (BOOLEAN)((AceFlags & FAILED_ACCESS_ACE_FLAG) != 0) ) ) {
04451
04452
if ( !
SepObjectInTypeList( ObjectTypeInAce,
04453 ObjectTypeList,
04454 ObjectTypeListLength,
04455 &
Index ) ) {
04456
04457
Index =
INVALID_OBJECT_TYPE_LIST_INDEX;
04458 }
04459 }
04460 }
04461
04462 }
04463
04464
04465
04466
04467
04468
04469
if (
Index !=
INVALID_OBJECT_TYPE_LIST_INDEX ) {
04470
04471
04472
04473
04474
04475
04476
04477
04478
04479
04480
04481
SepSetAuditInfoForObjectType(AceFlags,
04482 AccessMask,
04483 DesiredAccess,
04484 ObjectTypeList,
04485 ObjectTypeListLength,
04486 ReturnResultList,
04487
Index,
04488 AccessStatus,
04489 GrantedAccess,
04490 FailedMaximumAllowed,
04491 GenerateSuccessAudit,
04492 GenerateFailureAudit
04493 );
04494 }
04495
04496 }
04497 }
04498
04499
return;
04500 }
04501
04502
04503
04504
04505
04506
04507
04508
04509
04510
04511
04512
04513
04514
04515
04516
04517
04518
04519
04520 PLUID *
SepFilterPrivileges =
NULL;
04521
04522 PLUID
SepFilterPrivilegesLong[] =
04523 {
04524 &
SeChangeNotifyPrivilege,
04525 &
SeAuditPrivilege,
04526 &
SeCreateTokenPrivilege,
04527 &
SeAssignPrimaryTokenPrivilege,
04528 &
SeBackupPrivilege,
04529 &
SeRestorePrivilege,
04530 &
SeDebugPrivilege,
04531
NULL
04532 };
04533
04534
04535
04536
04537
04538
04539
04540
04541
04542
04543
04544
04545 PLUID
SepFilterPrivilegesShort[] =
04546 {
04547 &
SeChangeNotifyPrivilege,
04548 &
SeAuditPrivilege,
04549 &
SeCreateTokenPrivilege,
04550 &
SeAssignPrimaryTokenPrivilege,
04551 &
SeDebugPrivilege,
04552
NULL
04553 };
04554
04555 BOOLEAN
04556 SepInitializePrivilegeFilter(
04557 BOOLEAN Verbose
04558 )
04559
04560
04561
04562
04563
04564
04565
04566
04567
04568
04569
04570
04571
04572
04573
04574
04575 {
04576
if (Verbose) {
04577
SepFilterPrivileges =
SepFilterPrivilegesShort;
04578 }
else {
04579
SepFilterPrivileges =
SepFilterPrivilegesLong;
04580 }
04581
04582
return(
TRUE );
04583 }
04584
04585
04586 BOOLEAN
04587 SepFilterPrivilegeAudits(
04588 IN PPRIVILEGE_SET PrivilegeSet
04589 )
04590
04591
04592
04593
04594
04595
04596
04597
04598
04599
04600
04601
04602
04603
04604
04605
04606
04607
04608
04609 {
04610 PLUID *Privilege;
04611 ULONG Match = 0;
04612 ULONG i;
04613
04614
PAGED_CODE();
04615
04616
if ( !ARGUMENT_PRESENT(PrivilegeSet) ||
04617 (PrivilegeSet->PrivilegeCount == 0) ) {
04618
return(
FALSE );
04619 }
04620
04621
for (i=0; i<PrivilegeSet->PrivilegeCount; i++) {
04622
04623 Privilege =
SepFilterPrivileges;
04624
04625
do {
04626
04627
if (
RtlEqualLuid( &PrivilegeSet->Privilege[i].Luid, *Privilege )) {
04628
04629 Match++;
04630
break;
04631 }
04632
04633 }
while ( *++Privilege !=
NULL );
04634 }
04635
04636
if ( Match == PrivilegeSet->PrivilegeCount ) {
04637
04638
return(
FALSE );
04639
04640 }
else {
04641
04642
return(
TRUE );
04643 }
04644 }
04645
04646
04647 BOOLEAN
04648 SeAuditingFileOrGlobalEvents(
04649 IN BOOLEAN AccessGranted,
04650 IN PSECURITY_DESCRIPTOR SecurityDescriptor,
04651 IN
PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext
04652 )
04653
04654
04655
04656
04657
04658
04659
04660
04661
04662
04663
04664
04665
04666
04667
04668
04669
04670
04671
04672
04673
04674 {
04675 PISECURITY_DESCRIPTOR ISecurityDescriptor = (PISECURITY_DESCRIPTOR) SecurityDescriptor;
04676
04677
PAGED_CODE();
04678
04679
if ( ((
PTOKEN)
EffectiveToken( SubjectSecurityContext ))->AuditData !=
NULL) {
04680
return(
TRUE );
04681 }
04682
04683
if ( RtlpSaclAddrSecurityDescriptor( ISecurityDescriptor ) ==
NULL ) {
04684
04685
return(
FALSE );
04686 }
04687
04688
return(
SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted ) );
04689 }
04690
04691
04692 BOOLEAN
04693 SeAuditingFileEvents(
04694 IN BOOLEAN AccessGranted,
04695 IN PSECURITY_DESCRIPTOR SecurityDescriptor
04696 )
04697
04698
04699
04700
04701
04702
04703
04704
04705
04706
04707
04708
04709
04710
04711
04712
04713
04714
04715
04716
04717
04718 {
04719
PAGED_CODE();
04720
04721 UNREFERENCED_PARAMETER( SecurityDescriptor );
04722
04723
return(
SepAdtAuditThisEvent( AuditCategoryObjectAccess, &AccessGranted ) );
04724 }
04725