PlaneteCasio
/
libc
1
0
Fork 0
Code Issues 6 Pull Requests Releases Wiki Activity
libc/winsup/cygwin/security.cc

745 lines
22 KiB
C++
Raw Blame History

/* security.cc: NT file access control functions
Originaly written by Gunther Ebert, gunther.ebert@ixos-leipzig.de
Completely rewritten by Corinna Vinschen <corinna@vinschen.de>
This file is part of Cygwin.
This software is a copyrighted work licensed under the terms of the
Cygwin license. Please consult the file "CYGWIN_LICENSE" for
details. */
#include "winsup.h"
#include <unistd.h>
#include <stdlib.h>
#include <cygwin/acl.h>
#include "cygerrno.h"
#include "security.h"
#include "path.h"
#include "fhandler.h"
#include "dtable.h"
#include "pinfo.h"
#include "cygheap.h"
#include "ntdll.h"
#include "tls_pbuf.h"
#include <aclapi.h>
#define ALL_SECURITY_INFORMATION (DACL_SECURITY_INFORMATION \
| GROUP_SECURITY_INFORMATION \
| OWNER_SECURITY_INFORMATION)
static GENERIC_MAPPING NO_COPY_RO file_mapping = { FILE_GENERIC_READ,
FILE_GENERIC_WRITE,
FILE_GENERIC_EXECUTE,
FILE_ALL_ACCESS };
LONG
get_file_sd (HANDLE fh, path_conv &pc, security_descriptor &sd,
bool justcreated)
{
NTSTATUS status = STATUS_SUCCESS;
OBJECT_ATTRIBUTES attr;
IO_STATUS_BLOCK io;
ULONG len = SD_MAXIMUM_SIZE, rlen;
/* Allocate space for the security descriptor. */
if (!sd.malloc (len))
{
set_errno (ENOMEM);
return -1;
}
/* Try to fetch the security descriptor if the handle is valid. */
if (fh)
{
status = NtQuerySecurityObject (fh, ALL_SECURITY_INFORMATION,
sd, len, &rlen);
if (!NT_SUCCESS (status))
debug_printf ("NtQuerySecurityObject (%S), status %y",
pc.get_nt_native_path (), status);
}
/* If the handle was NULL, or fetching with the original handle didn't work,
try to reopen the file with READ_CONTROL and fetch the security descriptor
using that handle. */
if (!fh || !NT_SUCCESS (status))
{
status = NtOpenFile (&fh, READ_CONTROL,
fh ? pc.init_reopen_attr (attr, fh)
: pc.get_object_attr (attr, sec_none_nih),
&io, FILE_SHARE_VALID_FLAGS,
FILE_OPEN_FOR_BACKUP_INTENT);
if (!NT_SUCCESS (status))
{
sd.free ();
__seterrno_from_nt_status (status);
return -1;
}
status = NtQuerySecurityObject (fh, ALL_SECURITY_INFORMATION,
sd, len, &rlen);
NtClose (fh);
if (!NT_SUCCESS (status))
{
sd.free ();
__seterrno_from_nt_status (status);
return -1;
}
}
/* We have a security descriptor now. Unfortunately, if you want to know
if an ACE is inherited from the parent object, this isn't sufficient.
In the simple case, the SDs control word contains one of the
SE_DACL_AUTO_INHERITED or SE_DACL_PROTECTED flags, or at least one of
the ACEs has the INHERITED_ACE flag set. In all of these cases we
know the DACL has been inherited.
If none of these flags is set in the SD, the information whether
or not an ACE has been inherited is not available in the DACL of the
object. In this case GetSecurityInfo fetches the SD from the parent
directory and tests if the object's SD contains inherited ACEs from the
parent.
Note that we're not testing the SE_DACL_AUTO_INHERITED and
SE_DACL_PROTECTED flags here because we know the state the file's SD
is in. Since we're creating all files with a NULL descriptor, the DACL
is either inherited from the parent, or it's the default DACL. In
neither case, one of these flags is set.
For speed, we're not calling RtlConvertToAutoInheritSecurityObject
anymore (but keep the code here for reference). Rather we just test
if one of the parent's ACEs is inheritable. If so, we know we inherited
it and set the SE_DACL_AUTO_INHERITED flag. If not, we may assume our
object's DACL is the default DACL.
This functionality is slow and the extra information is only required
when the file has been created and the permissions are about to be set
to POSIX permissions. Therefore we only use it in case the file just
got created. */
if (justcreated)
{
PACL dacl;
BOOLEAN exists, def;
ACCESS_ALLOWED_ACE *ace;
UNICODE_STRING dirname;
PSECURITY_DESCRIPTOR psd;
tmp_pathbuf tp;
/* Open the parent directory with READ_CONTROL... */
RtlSplitUnicodePath (pc.get_nt_native_path (), &dirname, NULL);
InitializeObjectAttributes (&attr, &dirname, pc.objcaseinsensitive (),
NULL, NULL);
status = NtOpenFile (&fh, READ_CONTROL, &attr, &io,
FILE_SHARE_VALID_FLAGS,
FILE_OPEN_FOR_BACKUP_INTENT
| FILE_OPEN_REPARSE_POINT);
if (!NT_SUCCESS (status))
{
debug_printf ("NtOpenFile (%S), status %y", &dirname, status);
return 0;
}
/* ... fetch the parent's security descriptor ... */
psd = (PSECURITY_DESCRIPTOR) tp.w_get ();
status = NtQuerySecurityObject (fh, ALL_SECURITY_INFORMATION,
psd, len, &rlen);
NtClose (fh);
if (!NT_SUCCESS (status))
{
debug_printf ("NtQuerySecurityObject (%S), status %y",
&dirname, status);
return 0;
}
#if 0
/* ... and create a new security descriptor in which all inherited ACEs
are marked with the INHERITED_ACE flag. For a description of the
undocumented RtlConvertToAutoInheritSecurityObject function from
ntdll.dll see the MSDN man page for the advapi32 function
ConvertToAutoInheritPrivateObjectSecurity. Fortunately the latter
is just a shim. */
PSECURITY_DESCRIPTOR nsd;
status = RtlConvertToAutoInheritSecurityObject (psd, sd, &nsd, NULL,
pc.isdir (),
&file_mapping);
if (!NT_SUCCESS (status))
{
debug_printf ("RtlConvertToAutoInheritSecurityObject (%S), status %y",
&dirname, status);
return 0;
}
/* Eventually copy the new security descriptor into sd and delete the
original one created by RtlConvertToAutoInheritSecurityObject from
the heap. */
len = RtlLengthSecurityDescriptor (nsd);
memcpy ((PSECURITY_DESCRIPTOR) sd, nsd, len);
RtlDeleteSecurityObject (&nsd);
#else
/* ... and check the parent descriptor for inheritable ACEs matching
our current object type (file/dir). The simple truth in our case
is, either the parent dir had inheritable ACEs and all our ACEs are
inherited, or the parent dir didn't have inheritable ACEs and all
our ACEs are taken from the default DACL. */
bool inherited = false;
BYTE search_flags = pc.isdir () ? SUB_CONTAINERS_AND_OBJECTS_INHERIT
: SUB_OBJECTS_ONLY_INHERIT;
if (NT_SUCCESS (RtlGetDaclSecurityDescriptor (psd, &exists, &dacl, &def))
&& exists && dacl)
for (ULONG idx = 0; idx < dacl->AceCount; ++idx)
if (NT_SUCCESS (RtlGetAce (dacl, idx, (PVOID *) &ace))
&& (ace->Header.AceFlags & search_flags))
{
inherited = true;
break;
}
/* Then, if the parent descriptor contained inheritable ACEs, we mark
the SD as SE_DACL_AUTO_INHERITED. Note that this requires the
matching check in get_posix_access. If we ever revert to
RtlConvertToAutoInheritSecurityObject, the check in get_posix_access
has to test every single ACE for the INHERITED_ACE flag again. */
if (inherited
&& NT_SUCCESS (RtlGetDaclSecurityDescriptor (sd, &exists, &dacl,
&def))
&& exists && dacl)
RtlSetControlSecurityDescriptor (sd, SE_DACL_AUTO_INHERITED,
SE_DACL_AUTO_INHERITED);
#endif
}
return 0;
}
LONG
set_file_sd (HANDLE fh, path_conv &pc, security_descriptor &sd, bool is_chown)
{
NTSTATUS status = STATUS_SUCCESS;
int retry = 0;
int res = -1;
for (; retry < 2; ++retry)
{
if (fh)
{
status = NtSetSecurityObject (fh,
is_chown ? ALL_SECURITY_INFORMATION
: DACL_SECURITY_INFORMATION,
sd);
if (NT_SUCCESS (status))
{
res = 0;
break;
}
}
if (!retry)
{
OBJECT_ATTRIBUTES attr;
IO_STATUS_BLOCK io;
status = NtOpenFile (&fh, (is_chown ? WRITE_OWNER : 0) | WRITE_DAC,
fh ? pc.init_reopen_attr (attr, fh)
: pc.get_object_attr (attr, sec_none_nih),
&io,
FILE_SHARE_VALID_FLAGS,
FILE_OPEN_FOR_BACKUP_INTENT);
if (!NT_SUCCESS (status))
{
fh = NULL;
break;
}
}
}
if (retry && fh)
NtClose (fh);
if (!NT_SUCCESS (status))
__seterrno_from_nt_status (status);
return res;
}
static int
get_reg_sd (HANDLE handle, security_descriptor &sd_ret)
{
LONG ret;
DWORD len = 0;
ret = RegGetKeySecurity ((HKEY) handle, ALL_SECURITY_INFORMATION,
sd_ret, &len);
if (ret == ERROR_INSUFFICIENT_BUFFER)
{
if (!sd_ret.malloc (len))
set_errno (ENOMEM);
else
ret = RegGetKeySecurity ((HKEY) handle, ALL_SECURITY_INFORMATION,
sd_ret, &len);
}
if (ret != ERROR_SUCCESS)
{
__seterrno ();
return -1;
}
return 0;
}
int
get_reg_attribute (HKEY hkey, mode_t *attribute, uid_t *uidret,
gid_t *gidret)
{
security_descriptor sd;
if (!get_reg_sd (hkey, sd))
{
get_posix_access (sd, attribute, uidret, gidret, NULL, 0);
return 0;
}
/* The entries are already set to default values */
return -1;
}
int
get_file_attribute (HANDLE handle, path_conv &pc,
mode_t *attribute, uid_t *uidret, gid_t *gidret)
{
if (pc.has_acls ())
{
security_descriptor sd;
if (!get_file_sd (handle, pc, sd, false))
{
get_posix_access (sd, attribute, uidret, gidret, NULL, 0);
return 0;
}
/* ENOSYS is returned by get_file_sd if fetching the DACL from a remote
share returns STATUS_INVALID_NETWORK_RESPONSE, which in turn is
converted to ERROR_BAD_NET_RESP. This potentially occurs when trying
to fetch DACLs from a NT4 machine which is not part of the domain of
the requesting machine. */
else if (get_errno () != ENOSYS)
{
if (uidret)
*uidret = ILLEGAL_UID;
if (gidret)
*gidret = ILLEGAL_GID;
return -1;
}
}
if (uidret)
*uidret = myself->uid;
if (gidret)
*gidret = myself->gid;
return -1;
}
bool
add_access_allowed_ace (PACL acl, DWORD attributes, PSID sid, size_t &len_add,
DWORD inherit)
{
NTSTATUS status = RtlAddAccessAllowedAceEx (acl, ACL_REVISION, inherit,
attributes, sid);
if (!NT_SUCCESS (status))
{
__seterrno_from_nt_status (status);
return false;
}
len_add += sizeof (ACCESS_ALLOWED_ACE) - sizeof (DWORD) + RtlLengthSid (sid);
return true;
}
bool
add_access_denied_ace (PACL acl, DWORD attributes, PSID sid, size_t &len_add,
DWORD inherit)
{
NTSTATUS status = RtlAddAccessDeniedAceEx (acl, ACL_REVISION, inherit,
attributes, sid);
if (!NT_SUCCESS (status))
{
__seterrno_from_nt_status (status);
return false;
}
len_add += sizeof (ACCESS_DENIED_ACE) - sizeof (DWORD) + RtlLengthSid (sid);
return true;
}
void
set_security_attribute (path_conv &pc, int attribute, PSECURITY_ATTRIBUTES psa,
security_descriptor &sd)
{
psa->lpSecurityDescriptor = sd.malloc (SECURITY_DESCRIPTOR_MIN_LENGTH);
RtlCreateSecurityDescriptor ((PSECURITY_DESCRIPTOR) psa->lpSecurityDescriptor,
SECURITY_DESCRIPTOR_REVISION);
psa->lpSecurityDescriptor = set_posix_access (attribute, geteuid32 (),
getegid32 (), NULL, 0,
sd, false);
}
int
get_object_sd (HANDLE handle, security_descriptor &sd)
{
ULONG len = 0;
NTSTATUS status;
status = NtQuerySecurityObject (handle, ALL_SECURITY_INFORMATION,
sd, len, &len);
if (status != STATUS_BUFFER_TOO_SMALL)
{
__seterrno_from_nt_status (status);
return -1;
}
if (!sd.malloc (len))
{
set_errno (ENOMEM);
return -1;
}
status = NtQuerySecurityObject (handle, ALL_SECURITY_INFORMATION,
sd, len, &len);
if (!NT_SUCCESS (status))
{
__seterrno_from_nt_status (status);
return -1;
}
return 0;
}
int
get_object_attribute (HANDLE handle, uid_t *uidret, gid_t *gidret,
mode_t *attribute)
{
security_descriptor sd;
if (get_object_sd (handle, sd))
return -1;
return get_posix_access (sd, attribute, uidret, gidret, NULL, 0)
>= 0 ? 0 : -1;
}
int
create_object_sd_from_attribute (uid_t uid, gid_t gid, mode_t attribute,
security_descriptor &sd)
{
return set_posix_access (attribute, uid, gid, NULL, 0, sd, false)
? 0 : -1;
}
int
set_object_sd (HANDLE handle, security_descriptor &sd, bool chown)
{
NTSTATUS status;
status = NtSetSecurityObject (handle, chown ? ALL_SECURITY_INFORMATION
: DACL_SECURITY_INFORMATION, sd);
if (!NT_SUCCESS (status))
{
__seterrno_from_nt_status (status);
return -1;
}
return 0;
}
int
set_object_attribute (HANDLE handle, uid_t uid, gid_t gid, mode_t attribute)
{
security_descriptor sd;
if (create_object_sd_from_attribute (uid, gid, attribute, sd)
|| set_object_sd (handle, sd, uid != ILLEGAL_UID || gid != ILLEGAL_GID))
return -1;
return 0;
}
int
set_created_file_access (HANDLE handle, path_conv &pc, mode_t attr)
{
int ret = -1;
security_descriptor sd, sd_ret;
mode_t attr_rd;
uid_t uid;
gid_t gid;
tmp_pathbuf tp;
aclent_t *aclp;
int nentries, idx;
bool std_acl;
if (!get_file_sd (handle, pc, sd, true))
{
attr |= S_JUSTCREATED;
if (pc.isdir ())
attr |= S_IFDIR;
attr_rd = attr;
aclp = (aclent_t *) tp.c_get ();
if ((nentries = get_posix_access (sd, &attr_rd, &uid, &gid, aclp,
MAX_ACL_ENTRIES, &std_acl)) >= 0)
{
if (S_ISLNK (attr))
{
/* Symlinks always get the request POSIX perms. */
aclp[0].a_perm = (attr >> 6) & S_IRWXO;
if ((idx = searchace (aclp, nentries, GROUP_OBJ)) >= 0)
aclp[idx].a_perm = (attr >> 3) & S_IRWXO;
if ((idx = searchace (aclp, nentries, CLASS_OBJ)) >= 0)
aclp[idx].a_perm = (attr >> 3) & S_IRWXO;
if ((idx = searchace (aclp, nentries, OTHER_OBJ)) >= 0)
aclp[idx].a_perm = attr & S_IRWXO;
}
else
{
/* Overwrite ACL permissions as required by POSIX 1003.1e
draft 17. */
aclp[0].a_perm &= (attr >> 6) & S_IRWXO;
if ((idx = searchace (aclp, nentries, CLASS_OBJ)) >= 0)
aclp[idx].a_perm &= (attr >> 3) & S_IRWXO;
if (std_acl
&& (idx = searchace (aclp, nentries, GROUP_OBJ)) >= 0)
aclp[idx].a_perm &= (attr >> 3) & S_IRWXO;
if ((idx = searchace (aclp, nentries, OTHER_OBJ)) >= 0)
aclp[idx].a_perm &= attr & S_IRWXO;
}
/* Construct appropriate inherit attribute for new directories.
Basically we do this only for the sake of non-Cygwin applications.
Cygwin applications don't need these. Additionally, if the
S_ISGID bit is set, propagate it. */
if (S_ISDIR (attr))
{
if (searchace (aclp, nentries, DEF_USER_OBJ) < 0)
{
aclp[nentries].a_type = DEF_USER_OBJ;
aclp[nentries].a_id = ILLEGAL_UID;
aclp[nentries++].a_perm = (attr >> 6) & S_IRWXO;
}
if (searchace (aclp, nentries, DEF_GROUP_OBJ) < 0)
{
aclp[nentries].a_type = DEF_GROUP_OBJ;
aclp[nentries].a_id = ILLEGAL_GID;
aclp[nentries++].a_perm = (attr >> 3) & S_IRWXO;
}
if (searchace (aclp, nentries, DEF_OTHER_OBJ) < 0)
{
aclp[nentries].a_type = DEF_OTHER_OBJ;
aclp[nentries].a_id = ILLEGAL_UID;
aclp[nentries++].a_perm = attr & S_IRWXO;
}
if (attr_rd & S_ISGID)
attr |= S_ISGID;
}
if (set_posix_access (attr, uid, gid, aclp, nentries, sd_ret,
pc.fs_is_samba ()))
ret = set_file_sd (handle, pc, sd_ret, attr_rd & S_ISGID);
}
}
return ret;
}
static int
check_access (security_descriptor &sd, GENERIC_MAPPING &mapping,
ACCESS_MASK desired, int flags, bool effective)
{
int ret = -1;
NTSTATUS status, allow;
ACCESS_MASK granted;
DWORD plen = sizeof (PRIVILEGE_SET) + 3 * sizeof (LUID_AND_ATTRIBUTES);
PPRIVILEGE_SET pset = (PPRIVILEGE_SET) alloca (plen);
HANDLE tok = ((effective && cygheap->user.issetuid ())
? cygheap->user.imp_token ()
: hProcImpToken);
if (!tok)
{
if (!DuplicateTokenEx (hProcToken, MAXIMUM_ALLOWED, NULL,
SecurityImpersonation, TokenImpersonation,
&hProcImpToken))
{
__seterrno ();
return ret;
}
tok = hProcImpToken;
}
status = NtAccessCheck (sd, tok, desired, &mapping, pset, &plen, &granted,
&allow);
if (!NT_SUCCESS (status))
__seterrno ();
else if (!NT_SUCCESS (allow))
{
/* CV, 2006-10-16: Now, that's really weird. Imagine a user who has no
standard access to a file, but who has backup and restore privileges
and these privileges are enabled in the access token. One would
expect that the AccessCheck function takes this into consideration
when returning the access status. Otherwise, why bother with the
pset parameter, right?
But not so. AccessCheck actually returns a status of "false" here,
even though opening a file with backup resp. restore intent
naturally succeeds for this user. This definitely spoils the results
of access(2) for administrative users or the SYSTEM account. So, in
case the access check fails, another check against the user's
backup/restore privileges has to be made. Sigh. */
int granted_flags = 0;
BOOLEAN has_priv;
if (flags & R_OK)
{
pset->PrivilegeCount = 1;
pset->Control = 0;
pset->Privilege[0].Luid.HighPart = 0L;
pset->Privilege[0].Luid.LowPart = SE_BACKUP_PRIVILEGE;
pset->Privilege[0].Attributes = 0;
status = NtPrivilegeCheck (tok, pset, &has_priv);
if (NT_SUCCESS (status) && has_priv)
granted_flags |= R_OK;
}
if (flags & W_OK)
{
pset->PrivilegeCount = 1;
pset->Control = 0;
pset->Privilege[0].Luid.HighPart = 0L;
pset->Privilege[0].Luid.LowPart = SE_RESTORE_PRIVILEGE;
pset->Privilege[0].Attributes = 0;
status = NtPrivilegeCheck (tok, pset, &has_priv);
if (NT_SUCCESS (status) && has_priv)
granted_flags |= W_OK;
}
if (granted_flags == flags)
ret = 0;
else
set_errno (EACCES);
}
else
ret = 0;
return ret;
}
/* Samba override. Check security descriptor for Samba UNIX user and group
accounts and check if we have an RFC 2307 mapping to a Windows account.
Create a new security descriptor with all of the UNIX accounts with
valid mapping replaced with their Windows counterpart. */
static void
convert_samba_sd (security_descriptor &sd_ret)
{
NTSTATUS status;
BOOLEAN dummy;
PSID sid;
cygsid owner;
cygsid group;
SECURITY_DESCRIPTOR sd;
cyg_ldap cldap;
tmp_pathbuf tp;
PACL acl, oacl;
size_t acl_len;
PACCESS_ALLOWED_ACE ace;
if (!NT_SUCCESS (RtlGetOwnerSecurityDescriptor (sd_ret, &sid, &dummy)))
return;
owner = sid;
if (!NT_SUCCESS (RtlGetGroupSecurityDescriptor (sd_ret, &sid, &dummy)))
return;
group = sid;
if (sid_id_auth (owner) == 22)
{
struct passwd *pwd;
uid_t uid = owner.get_uid (&cldap);
if (uid < UNIX_POSIX_OFFSET && (pwd = internal_getpwuid (uid)))
owner.getfrompw (pwd);
}
if (sid_id_auth (group) == 22)
{
struct group *grp;
gid_t gid = group.get_gid (&cldap);
if (gid < UNIX_POSIX_OFFSET && (grp = internal_getgrgid (gid)))
group.getfromgr (grp);
}
if (!NT_SUCCESS (RtlGetDaclSecurityDescriptor (sd_ret, &dummy,
&oacl, &dummy)))
return;
acl = (PACL) tp.w_get ();
RtlCreateAcl (acl, ACL_MAXIMUM_SIZE, ACL_REVISION);
acl_len = sizeof (ACL);
for (DWORD i = 0; i < oacl->AceCount; ++i)
if (NT_SUCCESS (RtlGetAce (oacl, i, (PVOID *) &ace)))
{
cygsid ace_sid ((PSID) &ace->SidStart);
if (sid_id_auth (ace_sid) == 22)
{
if (sid_sub_auth (ace_sid, 0) == 1) /* user */
{
struct passwd *pwd;
uid_t uid = ace_sid.get_uid (&cldap);
if (uid < UNIX_POSIX_OFFSET && (pwd = internal_getpwuid (uid)))
ace_sid.getfrompw (pwd);
}
else if (sid_sub_auth (ace_sid, 0) == 2) /* group */
{
struct group *grp;
gid_t gid = ace_sid.get_gid (&cldap);
if (gid < UNIX_POSIX_OFFSET && (grp = internal_getgrgid (gid)))
ace_sid.getfromgr (grp);
}
}
if (!add_access_allowed_ace (acl, ace->Mask, ace_sid, acl_len,
ace->Header.AceFlags))
return;
}
acl->AclSize = acl_len;
RtlCreateSecurityDescriptor (&sd, SECURITY_DESCRIPTOR_REVISION);
RtlSetControlSecurityDescriptor (&sd, SE_DACL_PROTECTED, SE_DACL_PROTECTED);
RtlSetOwnerSecurityDescriptor (&sd, owner, FALSE);
RtlSetGroupSecurityDescriptor (&sd, group, FALSE);
status = RtlSetDaclSecurityDescriptor (&sd, TRUE, acl, FALSE);
if (!NT_SUCCESS (status))
return;
DWORD sd_size = 0;
status = RtlAbsoluteToSelfRelativeSD (&sd, sd_ret, &sd_size);
if (sd_size > 0 && sd_ret.malloc (sd_size))
RtlAbsoluteToSelfRelativeSD (&sd, sd_ret, &sd_size);
}
int
check_file_access (path_conv &pc, int flags, bool effective)
{
security_descriptor sd;
int ret = -1;
ACCESS_MASK desired = 0;
if (flags & R_OK)
desired |= FILE_READ_DATA;
if (flags & W_OK)
desired |= FILE_WRITE_DATA;
if (flags & X_OK)
desired |= FILE_EXECUTE;
if (!get_file_sd (pc.handle (), pc, sd, false))
{
/* Tweak Samba security descriptor as necessary. */
if (pc.fs_is_samba ())
convert_samba_sd (sd);
ret = check_access (sd, file_mapping, desired, flags, effective);
}
debug_printf ("flags %y, ret %d", flags, ret);
return ret;
}
int
check_registry_access (HANDLE hdl, int flags, bool effective)
{
security_descriptor sd;
int ret = -1;
static GENERIC_MAPPING NO_COPY_RO reg_mapping = { KEY_READ,
KEY_WRITE,
KEY_EXECUTE,
KEY_ALL_ACCESS };
ACCESS_MASK desired = 0;
if (flags & R_OK)
desired |= KEY_ENUMERATE_SUB_KEYS;
if (flags & W_OK)
desired |= KEY_SET_VALUE;
if (flags & X_OK)
desired |= KEY_QUERY_VALUE;
if ((HKEY) hdl == HKEY_PERFORMANCE_DATA)
/* RegGetKeySecurity() always fails with ERROR_INVALID_HANDLE. */
ret = 0;
else if (!get_reg_sd (hdl, sd))
ret = check_access (sd, reg_mapping, desired, flags, effective);
/* As long as we can't write the registry... */
if (flags & W_OK)
{
set_errno (EROFS);
ret = -1;
}
debug_printf ("flags %y, ret %d", flags, ret);
return ret;
}
Reference in New Issue View Git Blame Copy Permalink