Erich Hoover : server: Report administrator ownership by default for registry objects.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 56c1a8b06293cfef2cb39e1f04e9e725d81982e2
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=56c1a8b06293cfef2cb39e1f04...

Author: Erich Hoover <ehoover(a)mines.edu>
Date:   Tue Mar  5 09:52:38 2013 -0700

server: Report administrator ownership by default for registry objects.

---

 dlls/advapi32/tests/security.c |   31 +++++++++++++++++++++++++++----
 server/registry.c              |   25 ++++++++++++++++++++++++-
 server/security.h              |    1 +
 server/token.c                 |    8 ++++++++
 4 files changed, 60 insertions(+), 5 deletions(-)

diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c
index e4adab1..7dd0501 100644
--- a/dlls/advapi32/tests/security.c
+++ b/dlls/advapi32/tests/security.c
@@ -3005,10 +3005,12 @@ static void test_SetEntriesInAclA(void)
 
 static void test_GetNamedSecurityInfoA(void)
 {
-    char admin_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES], dacl[100], *user;
+    char admin_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES], *user;
+    char system_ptr[sizeof(SID)+sizeof(ULONG)*SID_MAX_SUB_AUTHORITIES];
+    PSID admin_sid = (PSID) admin_ptr, system_sid = (PSID) system_ptr, user_sid;
     DWORD sid_size = sizeof(admin_ptr), user_size;
     char invalid_path[] = "/an invalid file path";
-    PSID admin_sid = (PSID) admin_ptr, user_sid;
+    char software_key[] = "MACHINE\\Software";
     char sd[SECURITY_DESCRIPTOR_MIN_LENGTH];
     SECURITY_DESCRIPTOR_CONTROL control;
     ACL_SIZE_INFORMATION acl_size;
@@ -3113,10 +3115,10 @@ static void test_GetNamedSecurityInfoA(void)
 
     /* Create security descriptor information and test that it comes back the same */
     pSD = &sd;
-    pDacl = (PACL)&dacl;
+    pDacl = HeapAlloc(GetProcessHeap(), 0, 100);
     InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION);
     pCreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, admin_sid, &sid_size);
-    bret = InitializeAcl(pDacl, sizeof(dacl), ACL_REVISION);
+    bret = InitializeAcl(pDacl, 100, ACL_REVISION);
     ok(bret, "Failed to initialize ACL.\n");
     bret = pAddAccessAllowedAceEx(pDacl, ACL_REVISION, 0, GENERIC_ALL, user_sid);
     ok(bret, "Failed to add Current User to ACL.\n");
@@ -3130,6 +3132,7 @@ static void test_GetNamedSecurityInfoA(void)
     SetLastError(0xdeadbeef);
     error = pSetNamedSecurityInfoA(tmpfile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL,
                                    NULL, pDacl, NULL);
+    HeapFree(GetProcessHeap(), 0, pDacl);
     if (error != ERROR_SUCCESS && (GetLastError() == ERROR_CALL_NOT_IMPLEMENTED))
     {
         win_skip("SetNamedSecurityInfoA is not implemented\n");
@@ -3178,6 +3181,26 @@ static void test_GetNamedSecurityInfoA(void)
     LocalFree(pSD);
     HeapFree(GetProcessHeap(), 0, user);
     CloseHandle(hTemp);
+
+    /* Test querying the ownership of a built-in registry key */
+    sid_size = sizeof(system_ptr);
+    pCreateWellKnownSid(WinLocalSystemSid, NULL, system_sid, &sid_size);
+    error = pGetNamedSecurityInfoA(software_key, SE_REGISTRY_KEY,
+                                   OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION,
+                                   NULL, NULL, NULL, NULL, &pSD);
+    ok(!error, "GetNamedSecurityInfo failed with error %d\n", error);
+
+    bret = GetSecurityDescriptorOwner(pSD, &owner, &owner_defaulted);
+    ok(bret, "GetSecurityDescriptorOwner failed with error %d\n", GetLastError());
+    ok(owner != NULL, "owner should not be NULL\n");
+    ok(EqualSid(owner, admin_sid), "MACHINE\\Software owner SID != Administrators SID.\n");
+
+    bret = GetSecurityDescriptorGroup(pSD, &group, &group_defaulted);
+    ok(bret, "GetSecurityDescriptorGroup failed with error %d\n", GetLastError());
+    ok(group != NULL, "group should not be NULL\n");
+    ok(EqualSid(group, admin_sid) || broken(EqualSid(group, system_sid)) /* before Win7 */,
+       "MACHINE\\Software group SID != Local System SID.\n");
+    LocalFree(pSD);
 }
 
 static void test_ConvertStringSecurityDescriptor(void)
diff --git a/server/registry.c b/server/registry.c
index a144c26..efc2005 100644
--- a/server/registry.c
+++ b/server/registry.c
@@ -147,6 +147,7 @@ struct file_load_info
 
 static void key_dump( struct object *obj, int verbose );
 static unsigned int key_map_access( struct object *obj, unsigned int access );
+static struct security_descriptor *key_get_sd( struct object *obj );
 static int key_close_handle( struct object *obj, struct process *process, obj_handle_t handle );
 static void key_destroy( struct object *obj );
 
@@ -162,7 +163,7 @@ static const struct object_ops key_ops =
     no_signal,               /* signal */
     no_get_fd,               /* get_fd */
     key_map_access,          /* map_access */
-    default_get_sd,          /* get_sd */
+    key_get_sd,              /* get_sd */
     default_set_sd,          /* set_sd */
     no_lookup_name,          /* lookup_name */
     no_open_file,            /* open_file */
@@ -336,6 +337,28 @@ static unsigned int key_map_access( struct object *obj, unsigned int access )
                       KEY_WOW64_64KEY | KEY_WOW64_32KEY);
 }
 
+static struct security_descriptor *key_get_sd( struct object *obj )
+{
+    static struct security_descriptor *key_default_sd;
+
+    if (obj->sd) return obj->sd;
+
+    if (!key_default_sd)
+    {
+        size_t sid_len = security_sid_len( security_builtin_admins_sid );
+
+        key_default_sd = mem_alloc( sizeof(*key_default_sd) + 2 * sid_len );
+        key_default_sd->control   = 0;
+        key_default_sd->owner_len = sid_len;
+        key_default_sd->group_len = sid_len;
+        key_default_sd->sacl_len  = 0;
+        key_default_sd->dacl_len  = 0;
+        memcpy( key_default_sd + 1, security_builtin_admins_sid, sid_len );
+        memcpy( (char *)(key_default_sd + 1) + sid_len, security_builtin_admins_sid, sid_len );
+    }
+    return key_default_sd;
+}
+
 /* close the notification associated with a handle */
 static int key_close_handle( struct object *obj, struct process *process, obj_handle_t handle )
 {
diff --git a/server/security.h b/server/security.h
index 03fd74e..9856f96 100644
--- a/server/security.h
+++ b/server/security.h
@@ -42,6 +42,7 @@ extern const LUID SeCreateGlobalPrivilege;
 extern const PSID security_world_sid;
 extern const PSID security_local_user_sid;
 extern const PSID security_local_system_sid;
+extern const PSID security_builtin_admins_sid;
 
 
 /* token functions */
diff --git a/server/token.c b/server/token.c
index 5e0493a..7d6086d 100644
--- a/server/token.c
+++ b/server/token.c
@@ -77,6 +77,13 @@ static const struct /* same fields as struct SID */
     SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
     DWORD SubAuthority[5];
 } local_user_sid = { SID_REVISION, 5, { SECURITY_NT_AUTHORITY }, { SECURITY_NT_NON_UNIQUE, 0, 0, 0, 1000 } };
+static const struct /* same fields as struct SID */
+{
+    BYTE Revision;
+    BYTE SubAuthorityCount;
+    SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
+    DWORD SubAuthority[2];
+} builtin_admins_sid = { SID_REVISION, 2, { SECURITY_NT_AUTHORITY }, { SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS } };
 
 const PSID security_world_sid = (PSID)&world_sid;
 static const PSID security_local_sid = (PSID)&local_sid;
@@ -84,6 +91,7 @@ static const PSID security_interactive_sid = (PSID)&interactive_sid;
 static const PSID security_authenticated_user_sid = (PSID)&authenticated_user_sid;
 const PSID security_local_system_sid = (PSID)&local_system_sid;
 const PSID security_local_user_sid = (PSID)&local_user_sid;
+const PSID security_builtin_admins_sid = (PSID)&builtin_admins_sid;
 
 static luid_t prev_luid_value = { 1000, 0 };