path: root/private/utils/aclconv/acehelp.cxx

/*++

Copyright (c) 1992  Microsoft Corporation

Module Name:

    acehelp.hxx

Abstract:

    This module contains definitions for helper routines for
    manipulating ACE's.


Author:

    Bill McJohn (billmc) 09-Feb-1992

Revision History:


--*/

extern "C" {

    #include <nt.h>
    #include <ntrtl.h>
    #include <nturtl.h>
    #include <ntseapi.h>
    #include <windows.h>
}


#include "lmconst.hxx"
#include "acehelp.hxx"

VOID
ConvertAccessMasks(
    IN  USHORT          LanmanAccess,
    OUT PACCESS_MASK    DirMask,
    OUT PACCESS_MASK    FileMask
    )
/*++

Routine Description:

    This method constructs NT Access Masks that correspond to a
    Lanman 2.x access mask.

Arguments:

    LanmanAccess    --  Supplies the Lanman 2.x access mask.
    DirMask         --  Receives the corresponding access mask for
                        a directory object.
    FileMask        --  Receives the corresponding access mask for
                        a file object.

Return Value:

    None.

--*/
{
    register ACCESS_MASK DirResult, FileResult;

    if( (LanmanAccess & ~LM_ACCESS_GROUP) == LM_ACCESS_ALL ) {

        // This access mask grants all possible permissions.

        DirResult = GENERIC_ALL;
        FileResult = GENERIC_ALL;

    } else {

        // Check each of the possible bits.

        DirResult = 0;
        FileResult = 0;


        if( LanmanAccess & LM_ACCESS_READ ) {

            DirResult |= GENERIC_READ;
            FileResult |= GENERIC_READ;
        }

        if( LanmanAccess & LM_ACCESS_WRITE ) {

            DirResult |= GENERIC_WRITE;
            FileResult |= GENERIC_WRITE;
        }

        if( LanmanAccess & LM_ACCESS_CREATE ) {

            DirResult |= (GENERIC_WRITE | GENERIC_EXECUTE);
        }

        if( LanmanAccess & LM_ACCESS_EXEC ) {

            DirResult |= GENERIC_EXECUTE;
            FileResult |= GENERIC_EXECUTE;
        }

        if( LanmanAccess & LM_ACCESS_DELETE ) {

            DirResult |= DELETE;
            FileResult |= DELETE;
        }

        if( LanmanAccess & LM_ACCESS_ATRIB ) {

            DirResult |= FILE_WRITE_ATTRIBUTES;
            FileResult |= FILE_WRITE_ATTRIBUTES;
        }

        if( LanmanAccess & LM_ACCESS_PERM ) {

            DirResult |= (WRITE_DAC | WRITE_OWNER);
            FileResult |= (WRITE_DAC | WRITE_OWNER);
        }
    }

    *DirMask = DirResult;
    *FileMask = FileResult;
}

VOID
ConvertAuditBits(
    IN  USHORT          LmAuditBits,
    OUT PACCESS_MASK    DirSuccessfulMask,
    OUT PACCESS_MASK    DirFailedMask,
    OUT PACCESS_MASK    FileSuccessfulMask,
    OUT PACCESS_MASK    FileFailedMask
    )
/*++

Routine Description:

    This function constructs NT access masks that correspond to
    Lanman 2.x Audit bitmasks.

Arguments:

    LmAuditBits         --  Supplies the Lanman 2.x audit bitmask
    DirSuccessfulMask   --  Receives the corresponding NT access mask
                            for auditing successful directory accesses.
    DirFailedMask       --  Receives the corresponding NT access mask
                            for auditing failed directory accesses.
    FileSuccessfulMask  --  Receives the corresponding NT access mask
                            for auditing successful file accesses.
    FileFailedMask      --  Receives the corresponding NT access mask
                            for auditing failed file accesses.
Return Value:

    None.

--*/
{
    ACCESS_MASK DirFailedResult, DirSuccessfulResult,
                FileFailedResult, FileSuccessfulResult;

    // If the 'all' bit is set, this conversion is easy:

    if( LmAuditBits & LM_AUDIT_ALL ) {

        *DirSuccessfulMask = GENERIC_ALL;
        *DirFailedMask = GENERIC_ALL;
        *FileSuccessfulMask = GENERIC_ALL;
        *FileFailedMask = GENERIC_ALL;

        return;
    }


    // Compute the audit mask for successful directory access:
    //
    DirSuccessfulResult = 0;
    if( LmAuditBits & LM_AUDIT_S_CREATE ) DirSuccessfulResult |= (FILE_ADD_SUBDIRECTORY | FILE_ADD_FILE);
    if( LmAuditBits & LM_AUDIT_S_DELETE ) DirSuccessfulResult |= DELETE;
    if( LmAuditBits & LM_AUDIT_S_ACL ) DirSuccessfulResult |= (WRITE_DAC | WRITE_OWNER);

    // Compute the audit mask for failed directory access:
    //
    DirFailedResult = 0;
    if( LmAuditBits & LM_AUDIT_F_CREATE ) DirFailedResult |= (FILE_ADD_SUBDIRECTORY | FILE_ADD_FILE);
    if( LmAuditBits & LM_AUDIT_F_DELETE ) DirFailedResult |= DELETE;
    if( LmAuditBits & LM_AUDIT_F_ACL ) DirFailedResult |= (WRITE_DAC | WRITE_OWNER);

    // Compute the audit mask for successful file access:
    //
    FileSuccessfulResult = 0;
    if( LmAuditBits & LM_AUDIT_S_OPEN ) FileSuccessfulResult |= GENERIC_READ;
    if( LmAuditBits & LM_AUDIT_S_WRITE ) FileSuccessfulResult |= GENERIC_WRITE;
    if( LmAuditBits & LM_AUDIT_S_DELETE ) FileSuccessfulResult |= DELETE;
    if( LmAuditBits & LM_AUDIT_S_ACL ) FileSuccessfulResult |= (WRITE_DAC | WRITE_OWNER);

    // Compute the audit mask for failed file access:
    //
    FileFailedResult = 0;
    if( LmAuditBits & LM_AUDIT_F_OPEN ) FileFailedResult |= GENERIC_READ;
    if( LmAuditBits & LM_AUDIT_F_WRITE ) FileFailedResult |= GENERIC_WRITE;
    if( LmAuditBits & LM_AUDIT_F_DELETE ) FileFailedResult |= DELETE;
    if( LmAuditBits & LM_AUDIT_F_ACL ) FileFailedResult |= (WRITE_DAC | WRITE_OWNER);


    // Fill in the return values:

    *DirSuccessfulMask = DirSuccessfulResult;
    *DirFailedMask = DirFailedResult;
    *FileSuccessfulMask = FileSuccessfulResult;
    *FileFailedMask = FileFailedResult;

    return;
}




BOOLEAN
CreateAccessAllowedAce(
    IN OUT PVOID        Buffer,
    IN     ULONG        BufferLength,
    IN     ACCESS_MASK  Access,
    IN     UCHAR        InheritFlags,
    IN     PSID         Sid,
    OUT    PULONG       AceLength
    )
/*++

Routine Description:

    This method creates an access-allowed ACE in the supplied buffer.

Arguments:

    Buffer          --  Supplies the buffer in which the ACE should be
                        created.
    BufferLength    --  Supplies the length of the buffer.
    Access          --  Supplies the desired Access Mask.
    InheritFlags    --  Supplies the ACE's inherit flags.
    Sid             --  Supplies the ACE's SID.
    AceLength       --  Receives the length of the created ACE.

Return Value:

    TRUE upon successful completion.

--*/
{
    PACCESS_ALLOWED_ACE NewAce;
    ULONG SidLength;

    SidLength =  GetLengthSid( Sid );

    *AceLength = sizeof( ACE_HEADER ) +
                 sizeof( ACCESS_MASK ) +
                 SidLength;

    if( *AceLength > BufferLength ) {

        return FALSE;
    }


    NewAce = (PACCESS_ALLOWED_ACE)Buffer;

    NewAce->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
    NewAce->Header.AceSize = (USHORT)*AceLength;
    NewAce->Header.AceFlags = InheritFlags;

    NewAce->Mask = Access;

    return( CopySid( SidLength,
                     (PSID)((PBYTE)Buffer + sizeof( ACE_HEADER ) +
                                            sizeof( ACCESS_MASK )),
                     Sid ) );
}




BOOLEAN
CreateAccessDeniedAce(
    IN OUT PVOID        Buffer,
    IN     ULONG        BufferLength,
    IN     ACCESS_MASK  Access,
    IN     UCHAR        InheritFlags,
    IN     PSID         Sid,
    OUT    PULONG       AceLength
    )
/*++

Routine Description:

    This method creates an access-denied ACE in the supplied buffer.
    Note that the only sort of access-denied ACE that ACLCONV creates
    is one which denies all access.

Arguments:

    Buffer          --  Supplies the buffer in which the ACE should be
                        created.
    BufferLength    --  Supplies the length of the buffer.
    Access          --  Supplies the desired Access Mask.
    InheritFlags    --  Supplies the ACE's inherit flags.
    Sid             --  Supplies the ACE's SID.
    AceLength       --  Receives the length of the created ACE.

Return Value:

    TRUE upon successful completion.

--*/
{
    PACCESS_DENIED_ACE NewAce;
    ULONG SidLength;

    UNREFERENCED_PARAMETER( Access );

    SidLength =  GetLengthSid( Sid );

    *AceLength = sizeof( ACE_HEADER ) +
                 sizeof( ACCESS_MASK ) +
                 SidLength;

    if( *AceLength > BufferLength ) {

        return FALSE;
    }


    NewAce = (PACCESS_DENIED_ACE)Buffer;

    NewAce->Header.AceType = ACCESS_DENIED_ACE_TYPE;
    NewAce->Header.AceSize = (USHORT)*AceLength;
    NewAce->Header.AceFlags = InheritFlags;

    NewAce->Mask = GENERIC_ALL;

    return( CopySid( SidLength,
                     (PSID)((PBYTE)Buffer + sizeof( ACE_HEADER ) +
                                            sizeof( ACCESS_MASK )),
                     Sid ) );
}


SID_IDENTIFIER_AUTHORITY World = SECURITY_WORLD_SID_AUTHORITY;

BOOLEAN
CreateSystemAuditAce(
    IN OUT PVOID        Buffer,
    IN     ULONG        BufferLength,
    IN     ACCESS_MASK  Access,
    IN     UCHAR        InheritFlags,
    IN     BOOLEAN      AuditFailures,
    OUT    PULONG       AceLength
    )
/*++

Routine Description:

    This method creates a System Audit ACE in the supplied buffer.

Arguments:

    Buffer          --  Supplies the buffer in which the ACE should
                        be created.
    BufferLength    --  Supplies the length of the buffer.
    Access          --  Supplies the access mask that should be audited.
    InheritFlags    --  Supplies the inheritance flags for the ACE.
    AuditFailures   --  Supplies a flag which, if TRUE, indicates that
                        the ACE should be set to audit failed access,
                        rather than successful access.
    AceLength       --  Receives the length of the ACE.



Return Value:

    TRUE upon successful completion.

Notes:

    ACLCONV always creates System Audit Aces with the well-known SID WORLD.
    It has the SID Identifier Authority SECURITY_WORLD_SID_AUTHORITY and
    no subauthorities.

--*/
{
    PSYSTEM_AUDIT_ACE NewAce;
    ULONG NewAceLength, SidOffset, SidLength;
    PSID WorldSid;


    // See if the supplied buffer is big enough to hold a System
    // Audit Ace that has an SID with one subauthority.  This kind
    // of ACE consists of an ACE_HEADER followed by an ACCESS_MASK
    // followed by the SID.

    SidLength = GetSidLengthRequired( 1 );

    SidOffset = sizeof( ACE_HEADER ) + sizeof( ACCESS_MASK );

    NewAceLength = SidOffset + SidLength;

    if( NewAceLength > BufferLength ) {

        return FALSE;
    }

    // Create the ACE.

    NewAce = (PSYSTEM_AUDIT_ACE)Buffer;

    NewAce->Header.AceType = SYSTEM_AUDIT_ACE_TYPE;
    NewAce->Header.AceSize = (USHORT)NewAceLength;
    NewAce->Header.AceFlags = InheritFlags;
    NewAce->Header.AceFlags |= AuditFailures ? SUCCESSFUL_ACCESS_ACE_FLAG :
                                              FAILED_ACCESS_ACE_FLAG;

    NewAce->Mask = Access;

    // WORLD is a well-known SID with one subauthority.
    //
    WorldSid = (PSID)((PBYTE)Buffer + SidOffset);
    InitializeSid( WorldSid, &World, 1 );
    *GetSidSubAuthority( WorldSid, 0 ) = SECURITY_WORLD_RID;

    *AceLength = NewAceLength;
    return TRUE;
}