Public/winfsp
1
0
Fork 0
mirror of https://github.com/winfsp/winfsp.git synced 2025-04-22 16:33:02 -05:00
Code Issues Packages Projects Releases Wiki Activity

sys: SecuritySubjectContextAccessCheck

Browse Source
This commit is contained in:
Bill Zissimopoulos 2015-11-22 17:49:21 -08:00
parent 9653cd2546
commit 694a39db9a
3 changed files with 31 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/sys/driver.h
View File

@ -192,6 +192,8 @@ FAST_IO_RELEASE_FOR_CCFLUSH FspReleaseForCcFlush;
/* misc */ /* misc */
NTSTATUS CreateGuid(GUID *Guid); NTSTATUS CreateGuid(GUID *Guid);
NTSTATUS SecuritySubjectContextAccessCheck(
PSECURITY_DESCRIPTOR SecurityDescriptor, ACCESS_MASK DesiredAccess, KPROCESSOR_MODE AccessMode);
/* debug */ /* debug */
#if DBG #if DBG

25
src/sys/fsctl.c
View File

@ -8,8 +8,6 @@
static NTSTATUS FspFsctlCreateVolume( static NTSTATUS FspFsctlCreateVolume(
PDEVICE_OBJECT DeviceObject, PIRP Irp, PIO_STACK_LOCATION IrpSp); PDEVICE_OBJECT DeviceObject, PIRP Irp, PIO_STACK_LOCATION IrpSp);
static NTSTATUS FspFsvrtAccessCheck(
PSECURITY_DESCRIPTOR SecurityDescriptor, ACCESS_MASK DesiredAccess, KPROCESSOR_MODE AccessMode);
static NTSTATUS FspFsvrtDeleteVolume( static NTSTATUS FspFsvrtDeleteVolume(
PDEVICE_OBJECT DeviceObject, PIRP Irp, PIO_STACK_LOCATION IrpSp); PDEVICE_OBJECT DeviceObject, PIRP Irp, PIO_STACK_LOCATION IrpSp);
static NTSTATUS FspFsvrtTransact( static NTSTATUS FspFsvrtTransact(
@ -24,7 +22,6 @@ DRIVER_DISPATCH FspFileSystemControl;
#ifdef ALLOC_PRAGMA #ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE, FspFsctlCreateVolume) #pragma alloc_text(PAGE, FspFsctlCreateVolume)
#pragma alloc_text(PAGE, FspFsvrtAccessCheck)
#pragma alloc_text(PAGE, FspFsvrtDeleteVolume) #pragma alloc_text(PAGE, FspFsvrtDeleteVolume)
#pragma alloc_text(PAGE, FspFsvrtTransact) #pragma alloc_text(PAGE, FspFsvrtTransact)
#pragma alloc_text(PAGE, FspFsctlFileSystemControl) #pragma alloc_text(PAGE, FspFsctlFileSystemControl)
@ -92,30 +89,12 @@ static NTSTATUS FspFsctlCreateVolume(
return Result; return Result;
} }
static NTSTATUS FspFsvrtAccessCheck(
PSECURITY_DESCRIPTOR SecurityDescriptor, ACCESS_MASK DesiredAccess, KPROCESSOR_MODE AccessMode)
{
NTSTATUS Result = STATUS_ACCESS_DENIED;
SECURITY_SUBJECT_CONTEXT SecuritySubjectContext;
ACCESS_MASK GrantedAccess;
SeCaptureSubjectContext(&SecuritySubjectContext);
if (SeAccessCheck(SecurityDescriptor,
&SecuritySubjectContext, FALSE,
DesiredAccess, 0, 0, IoGetFileObjectGenericMapping(), AccessMode,
&GrantedAccess, &Result))
Result = STATUS_SUCCESS;
SeReleaseSubjectContext(&SecuritySubjectContext);
return Result;
}
static NTSTATUS FspFsvrtDeleteVolume( static NTSTATUS FspFsvrtDeleteVolume(
PDEVICE_OBJECT DeviceObject, PIRP Irp, PIO_STACK_LOCATION IrpSp) PDEVICE_OBJECT DeviceObject, PIRP Irp, PIO_STACK_LOCATION IrpSp)
{ {
NTSTATUS Result; NTSTATUS Result;
Result = FspFsvrtAccessCheck( Result = SecuritySubjectContextAccessCheck(
FspFsvrtDeviceExtension(DeviceObject)->SecurityDescriptorBuf, FspFsvrtDeviceExtension(DeviceObject)->SecurityDescriptorBuf,
FILE_WRITE_DATA, Irp->RequestorMode); FILE_WRITE_DATA, Irp->RequestorMode);
if (!NT_SUCCESS(Result)) if (!NT_SUCCESS(Result))
@ -129,7 +108,7 @@ static NTSTATUS FspFsvrtTransact(
{ {
NTSTATUS Result; NTSTATUS Result;
Result = FspFsvrtAccessCheck( Result = SecuritySubjectContextAccessCheck(
FspFsvrtDeviceExtension(DeviceObject)->SecurityDescriptorBuf, FspFsvrtDeviceExtension(DeviceObject)->SecurityDescriptorBuf,
FILE_WRITE_DATA, Irp->RequestorMode); FILE_WRITE_DATA, Irp->RequestorMode);
if (!NT_SUCCESS(Result)) if (!NT_SUCCESS(Result))

27
src/sys/misc.c
View File

@ -7,18 +7,45 @@
#include <sys/driver.h> #include <sys/driver.h>
NTSTATUS CreateGuid(GUID *Guid); NTSTATUS CreateGuid(GUID *Guid);
NTSTATUS SecuritySubjectContextAccessCheck(
PSECURITY_DESCRIPTOR SecurityDescriptor, ACCESS_MASK DesiredAccess, KPROCESSOR_MODE AccessMode);
#ifdef ALLOC_PRAGMA #ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE, CreateGuid) #pragma alloc_text(PAGE, CreateGuid)
#pragma alloc_text(PAGE, SecuritySubjectContextAccessCheck)
#endif #endif
NTSTATUS CreateGuid(GUID *Guid) NTSTATUS CreateGuid(GUID *Guid)
{ {
PAGED_CODE();
NTSTATUS Result; NTSTATUS Result;
int Retries = 3; int Retries = 3;
do do
{ {
Result = ExUuidCreate(Guid); Result = ExUuidCreate(Guid);
} while (!NT_SUCCESS(Result) && 0 < --Retries); } while (!NT_SUCCESS(Result) && 0 < --Retries);
return Result;
}
NTSTATUS SecuritySubjectContextAccessCheck(
PSECURITY_DESCRIPTOR SecurityDescriptor, ACCESS_MASK DesiredAccess, KPROCESSOR_MODE AccessMode)
{
PAGED_CODE();
NTSTATUS Result = STATUS_ACCESS_DENIED;
SECURITY_SUBJECT_CONTEXT SecuritySubjectContext;
ACCESS_MASK GrantedAccess;
SeCaptureSubjectContext(&SecuritySubjectContext);
if (SeAccessCheck(SecurityDescriptor,
&SecuritySubjectContext, FALSE,
DesiredAccess, 0, 0, IoGetFileObjectGenericMapping(), AccessMode,
&GrantedAccess, &Result))
Result = STATUS_SUCCESS;
SeReleaseSubjectContext(&SecuritySubjectContext);
return Result; return Result;
} }