April 2019 - Wine-Devel - list.winehq.org

[PATCH] server: Create primary group using DOMAIN_GROUP_RID_USERS.
by Vijay Kiran Kamuju April 27, 2019

April 27, 2019

From: Qian Hong <qhong(a)codeweavers.com> From: Qian Hong <qhong(a)codeweavers.com> Signed-off-by: Vijay Kiran Kamuju <infyquest(a)gmail.com> --- dlls/advapi32/tests/security.c | 2 +- server/token.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c index a22014793ff..aee45874257 100644 --- a/dlls/advapi32/tests/security.c +++ b/dlls/advapi32/tests/security.c @@ -3016,7 +3016,7 @@ static void test_process_security(void) ok(res, "GetTokenInformation failed with error %d\n", GetLastError()); UserSid = user->User.Sid; test_sid_str(UserSid); - todo_wine ok(EqualPrefixSid(UsersSid, UserSid), "TokenPrimaryGroup Sid and TokenUser Sid don't match.\n"); + ok(EqualPrefixSid(UsersSid, UserSid), "TokenPrimaryGroup Sid and TokenUser Sid don't match.\n"); CloseHandle( token ); if (!res) diff --git a/server/token.c b/server/token.c index 895809e7252..e0f28c6da6e 100644 --- a/server/token.c +++ b/server/token.c @@ -839,6 +839,7 @@ struct token *token_create_admin( void ) { security_local_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY }, { security_interactive_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY }, { security_authenticated_user_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY }, + { security_domain_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER }, { alias_admins_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_OWNER }, { alias_users_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY }, { logon_sid, SE_GROUP_ENABLED|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_MANDATORY|SE_GROUP_LOGON_ID }, -- 2.17.0

1 0

[PATCH] winecfg: Correct Windows Server version names.
by Isira Seneviratne April 27, 2019

April 27, 2019

1 0

[PATCH v2 2/2] po: Update French translation.
by Isira Seneviratne April 27, 2019

April 27, 2019

1 0

[PATCH v2 1/2] po: Update Sinhala translation.
by Isira Seneviratne April 27, 2019

April 27, 2019

1 0

[PATCH] advapi32/tests: Extend security label / token integrity tests.
by Vijay Kiran Kamuju April 27, 2019

April 27, 2019

From: Michael Müller <michael(a)fds-team.de> Fix tests for Win2008 and make the variables global. From: Michael Müller <michael(a)fds-team.de> Signed-off-by: Vijay Kiran Kamuju <infyquest(a)gmail.com> --- dlls/advapi32/tests/Makefile.in | 2 +- dlls/advapi32/tests/security.c | 402 ++++++++++++++++++++++++++++++-- 2 files changed, 390 insertions(+), 14 deletions(-) diff --git a/dlls/advapi32/tests/Makefile.in b/dlls/advapi32/tests/Makefile.in index 36ce031ef62..4437e6e5de7 100644 --- a/dlls/advapi32/tests/Makefile.in +++ b/dlls/advapi32/tests/Makefile.in @@ -1,5 +1,5 @@ TESTDLL = advapi32.dll -IMPORTS = ole32 advapi32 +IMPORTS = ole32 user32 advapi32 C_SRCS = \ cred.c \ diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c index a22014793ff..51d462d687b 100644 --- a/dlls/advapi32/tests/security.c +++ b/dlls/advapi32/tests/security.c @@ -139,6 +139,13 @@ static HMODULE hmod; static int myARGC; static char** myARGV; +static SID low_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, + {SECURITY_MANDATORY_LOW_RID}}; +static SID medium_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, + {SECURITY_MANDATORY_MEDIUM_RID}}; +static SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, + {SECURITY_MANDATORY_HIGH_RID}}; + #define SID_SLOTS 4 static char debugsid_str[SID_SLOTS][256]; static int debugsid_index = 0; @@ -6292,10 +6299,6 @@ static void test_TokenIntegrityLevel(void) HANDLE token; DWORD size; DWORD res; - static SID medium_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, - {SECURITY_MANDATORY_HIGH_RID}}; - static SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, - {SECURITY_MANDATORY_MEDIUM_RID}}; SetLastError(0xdeadbeef); res = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token); @@ -6471,10 +6474,6 @@ static void test_AddAce(void) static void test_AddMandatoryAce(void) { - static SID low_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, - {SECURITY_MANDATORY_LOW_RID}}; - static SID medium_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, - {SECURITY_MANDATORY_MEDIUM_RID}}; static SID_IDENTIFIER_AUTHORITY sia_world = {SECURITY_WORLD_SID_AUTHORITY}; char buffer_sd[SECURITY_DESCRIPTOR_MIN_LENGTH]; SECURITY_DESCRIPTOR *sd2, *sd = (SECURITY_DESCRIPTOR *)&buffer_sd; @@ -7112,15 +7111,15 @@ static void test_token_label(void) static void test_token_security_descriptor(void) { - static SID low_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, - {SECURITY_MANDATORY_LOW_RID}}; char buffer_sd[SECURITY_DESCRIPTOR_MIN_LENGTH]; - SECURITY_DESCRIPTOR *sd = (SECURITY_DESCRIPTOR *)&buffer_sd, *sd2; + SECURITY_DESCRIPTOR *sd = (SECURITY_DESCRIPTOR *)&buffer_sd, *sd2, *sd3; char buffer_acl[256], buffer[MAX_PATH]; - ACL *acl = (ACL *)&buffer_acl, *acl2, *acl_child; + ACL *acl = (ACL *)&buffer_acl, *acl2, *acl_child, *sacl; BOOL defaulted, present, ret, found; - HANDLE token, token2, token3; + HANDLE token, token2, token3, token4, token5, token6; EXPLICIT_ACCESSW exp_access; + TOKEN_MANDATORY_LABEL *tml; + BYTE buffer_integrity[64]; PROCESS_INFORMATION info; DWORD size, index, retd; ACCESS_ALLOWED_ACE *ace; @@ -7271,6 +7270,186 @@ static void test_token_security_descriptor(void) /* The security label is also not inherited */ if (pAddMandatoryAce) { + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level), + "Expected medium or high integrity level\n"); + + if (EqualSid(tml->Label.Sid, &high_level)) + { + DWORD process_id; + HANDLE process; + HWND shell; + + /* This test tries to get a medium token and then impersonates this token. The + * idea is to check whether the sd label of a newly created token depends on the + * current active token or the integrity level of the newly created token. */ + + /* Steal process token of the explorer.exe process */ + shell = GetShellWindow(); + todo_wine ok(shell != NULL, "Failed to get shell window\n"); + if (!shell) shell = GetDesktopWindow(); /* FIXME: Workaround for Wine */ + ok(GetWindowThreadProcessId(shell, &process_id), + "Failed to get process id of shell window: %u\n", GetLastError()); + process = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, process_id); + ok(process != NULL, "Failed to open process: %u\n", GetLastError()); + ok(OpenProcessToken(process, TOKEN_ALL_ACCESS, &token4), + "Failed to open process token: %u\n", GetLastError()); + CloseHandle(process); + + /* Check TokenIntegrityLevel and LABEL_SECURITY_INFORMATION of explorer.exe token */ + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token4, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + todo_wine ok(EqualSid(tml->Label.Sid, &medium_level)||EqualSid(tml->Label.Sid,&high_level), + "Expected medium or high (Win2008) integrity level\n"); + + size = 0; + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); + + sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, sd3, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + sacl = NULL; + ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "No SACL in the security descriptor\n"); + ok(sacl != NULL, "NULL SACL in the security descriptor\n"); + + if (sacl) + { + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + todo_wine ok(EqualSid(&ace->SidStart, &medium_level)||EqualSid(&ace->SidStart,&high_level), + "Expected medium or high (Win2008) integrity level\n"); + } + + HeapFree(GetProcessHeap(), 0, sd3); + + /* Start child process with the explorer.exe token */ + memset(&startup, 0, sizeof(startup)); + startup.cb = sizeof(startup); + startup.dwFlags = STARTF_USESHOWWINDOW; + startup.wShowWindow = SW_SHOWNORMAL; + + sprintf(buffer, "%s tests/security.c test_token_sd_medium", myARGV[0]); + ret = CreateProcessAsUserA(token4, NULL, buffer, NULL, NULL, FALSE, 0, NULL, NULL, &startup, &info); + ok(ret || GetLastError() == ERROR_PRIVILEGE_NOT_HELD, + "CreateProcess failed with error %u\n", GetLastError()); + if (ret) + { + winetest_wait_child_process(info.hProcess); + CloseHandle(info.hProcess); + CloseHandle(info.hThread); + } + else + win_skip("Skipping test for creating process with medium level token\n"); + + ret = DuplicateTokenEx(token4, 0, NULL, SecurityImpersonation, TokenImpersonation, &token5); + ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError()); + ret = SetThreadToken(NULL, token5); + todo_wine ok(ret, "SetThreadToken failed with error %u\n", GetLastError()); + CloseHandle(token4); + + /* Restrict current process token while impersonating a medium integrity token */ + ret = CreateRestrictedToken(token, 0, 0, NULL, 0, NULL, 0, NULL, &token6); + ok(ret, "CreateRestrictedToken failed with error %u\n", GetLastError()); + + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token6, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &high_level), "Expected high integrity level\n"); + + size = 0; + ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); + + sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); + ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, sd3, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + sacl = NULL; + ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + todo_wine ok(present, "No SACL in the security descriptor\n"); + todo_wine ok(sacl != NULL, "NULL SACL in the security descriptor\n"); + + if (sacl) + { + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(EqualSid(&ace->SidStart, &medium_level)||EqualSid(&ace->SidStart,&high_level), + "Expected medium or high (Win2008) integrity level\n"); + } + + HeapFree(GetProcessHeap(), 0, sd3); + RevertToSelf(); + CloseHandle(token5); + + /* Start child process with the restricted token */ + sprintf(buffer, "%s tests/security.c test_token_sd_restricted", myARGV[0]); + ret = CreateProcessAsUserA(token6, NULL, buffer, NULL, NULL, FALSE, 0, NULL, NULL, &startup, &info); + ok(ret, "CreateProcess failed with error %u\n", GetLastError()); + winetest_wait_child_process(info.hProcess); + CloseHandle(info.hProcess); + CloseHandle(info.hThread); + CloseHandle(token6); + + /* DuplicateTokenEx should assign security label even when SA points to empty SD */ + memset(sd, 0, sizeof(buffer_sd)); + ret = InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION); + ok(ret, "InitializeSecurityDescriptor failed with error %u\n", GetLastError()); + + sa.nLength = sizeof(SECURITY_ATTRIBUTES); + sa.lpSecurityDescriptor = sd; + sa.bInheritHandle = FALSE; + + ret = DuplicateTokenEx(token, 0, &sa, 0, TokenPrimary, &token6); + ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError()); + + size = 0; + ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + todo_wine ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); + + sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); + ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, sd3, size, &size); + todo_wine ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + sacl = NULL; + ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted); + todo_wine ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + todo_wine ok(present, "No SACL in the security descriptor\n"); + todo_wine ok(sacl != NULL, "NULL SACL in the security descriptor\n"); + + if (sacl) + { + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(EqualSid(&ace->SidStart, &high_level), + "Expected high integrity level\n"); + } + + HeapFree(GetProcessHeap(), 0, sd3); + CloseHandle(token6); + } + else + skip("Skipping test, running without admin rights\n"); + ret = InitializeAcl(acl, 256, ACL_REVISION); ok(ret, "InitializeAcl failed with error %u\n", GetLastError()); @@ -7286,6 +7465,90 @@ static void test_token_security_descriptor(void) ret = SetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd); ok(ret, "SetKernelObjectSecurity failed with error %u\n", GetLastError()); + + /* changing the label of the security descriptor does not change the integrity level of the token itself */ + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level), + "Expected medium or high integrity level\n"); + + /* restricting / duplicating a token resets the mandatory sd label */ + ret = CreateRestrictedToken(token, 0, 0, NULL, 0, NULL, 0, NULL, &token4); + ok(ret, "CreateRestrictedToken failed with error %u\n", GetLastError()); + + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token4, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level), + "Expected medium or high integrity level\n"); + + size = 0; + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); + + sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, sd3, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + todo_wine ok(present, "No SACL in the security descriptor\n"); + todo_wine ok(sacl != NULL, "NULL SACL in the security descriptor\n"); + + if (sacl) + { + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(EqualSid(&ace->SidStart, &medium_level) || EqualSid(&ace->SidStart, &high_level), + "Low integrity level should not have been inherited\n"); + } + + HeapFree(GetProcessHeap(), 0, sd3); + CloseHandle(token4); + + ret = DuplicateTokenEx(token, 0, NULL, 0, TokenPrimary, &token4); + ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError()); + + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token4, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL*) buffer_integrity; + ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level), + "Expected medium or high integrity level\n"); + + size = 0; + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + todo_wine ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError()); + + sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); + ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, sd3, size, &size); + todo_wine ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + sacl = NULL; + ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted); + todo_wine ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + todo_wine ok(present, "No SACL in the security descriptor\n"); + todo_wine ok(sacl != NULL, "NULL SACL in the security descriptor\n"); + + if (sacl) + { + ret = pGetAce(sacl, 0, (void **)&ace); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace->Header.AceType); + ok(EqualSid(&ace->SidStart, &medium_level) || EqualSid(&ace->SidStart, &high_level), + "Low integrity level should not have been inherited\n"); + } + + HeapFree(GetProcessHeap(), 0, sd3); + CloseHandle(token4); } else win_skip("SYSTEM_MANDATORY_LABEL not supported\n"); @@ -7392,6 +7655,115 @@ static void test_child_token_sd(void) HeapFree(GetProcessHeap(), 0, sd); } +static void test_child_token_sd_restricted(void) +{ + static SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY}, + {SECURITY_MANDATORY_HIGH_RID}}; + SYSTEM_MANDATORY_LABEL_ACE *ace_label; + BOOL ret, present, defaulted; + TOKEN_MANDATORY_LABEL *tml; + BYTE buffer_integrity[64]; + SECURITY_DESCRIPTOR *sd; + HANDLE token; + DWORD size; + ACL *acl; + + if (!pAddMandatoryAce) + { + win_skip("SYSTEM_MANDATORY_LABEL not supported\n"); + return; + } + + ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &token); + ok(ret, "OpenProcessToken failed with error %u\n", GetLastError()); + + ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); + + sd = HeapAlloc(GetProcessHeap(), 0, size); + ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + acl = NULL; + present = FALSE; + defaulted = TRUE; + ret = GetSecurityDescriptorSacl(sd, &present, &acl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "SACL not present\n"); + ok(acl && acl != (void *)0xdeadbeef, "Got invalid SACL\n"); + ok(!defaulted, "SACL defaulted\n"); + ok(acl->AceCount == 1, "Expected exactly one ACE\n"); + ret = pGetAce(acl, 0, (void **)&ace_label); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace_label->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace_label->Header.AceType); + ok(EqualSid(&ace_label->SidStart, &high_level), + "Expected high integrity level\n"); + + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + ok(EqualSid(tml->Label.Sid, &high_level), "Expected high integrity level\n"); + + HeapFree(GetProcessHeap(), 0, sd); +} + +static void test_child_token_sd_medium(void) +{ + SYSTEM_MANDATORY_LABEL_ACE *ace_label; + BOOL ret, present, defaulted; + TOKEN_MANDATORY_LABEL *tml; + BYTE buffer_integrity[64]; + SECURITY_DESCRIPTOR *sd; + HANDLE token; + DWORD size; + ACL *acl; + + if (!pAddMandatoryAce) + { + win_skip("SYSTEM_MANDATORY_LABEL not supported\n"); + return; + } + + ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &token); + ok(ret, "OpenProcessToken failed with error %u\n", GetLastError()); + + ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, NULL, 0, &size); + ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, + "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError()); + + sd = HeapAlloc(GetProcessHeap(), 0, size); + ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd, size, &size); + ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError()); + + acl = NULL; + present = FALSE; + defaulted = TRUE; + ret = GetSecurityDescriptorSacl(sd, &present, &acl, &defaulted); + ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError()); + ok(present, "SACL not present\n"); + ok(acl && acl != (void *)0xdeadbeef, "Got invalid SACL\n"); + ok(!defaulted, "SACL defaulted\n"); + ok(acl->AceCount == 1, "Expected exactly one ACE\n"); + ret = pGetAce(acl, 0, (void **)&ace_label); + ok(ret, "GetAce failed with error %u\n", GetLastError()); + ok(ace_label->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE, + "Unexpected ACE type %#x\n", ace_label->Header.AceType); + todo_wine ok(EqualSid(&ace_label->SidStart, &medium_level)||EqualSid(&ace_label->SidStart,&high_level), + "Expected medium or high (Win2008) integrity level\n"); + + memset(buffer_integrity, 0, sizeof(buffer_integrity)); + ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size); + ok(ret, "GetTokenInformation failed with error %u\n", GetLastError()); + tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity; + todo_wine ok(EqualSid(tml->Label.Sid, &medium_level)||EqualSid(tml->Label.Sid,&high_level), + "Expected medium or high (Win2008) integrity level\n"); + + HeapFree(GetProcessHeap(), 0, sd); +} + static void test_GetExplicitEntriesFromAclW(void) { static const WCHAR wszCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'}; @@ -7576,6 +7948,10 @@ START_TEST(security) { if (!strcmp(myARGV[2], "test_token_sd")) test_child_token_sd(); + else if (!strcmp(myARGV[2], "test_token_sd_restricted")) + test_child_token_sd_restricted(); + else if (!strcmp(myARGV[2], "test_token_sd_medium")) + test_child_token_sd_medium(); else test_process_security_child(); return; -- 2.17.0

2 1

[PATCH] netprofm: Implement and consolidate INetworkListManager::GetConnectivity
by Soeren Grunewald April 26, 2019

April 26, 2019

Origin is constantly checking the connections status, which produces a lot of fixme's. To get rid of this, improve the existing implementation and lower the log-level from fixme to trace. For now we announce only IPV4 connection status, since we have to extend the structures for IPV6. Since we actually have used a similar functionality at three different places. To get rid of this we introduce a new helper function which returns us the status of a network object. This is then used at all occurrences. We also drop the status flags from the connection structure, since the status of a connection is equal to the status of the attached network object. This way we avoid code/data duplication. Instead we query the info directly from the attached network using the newly added function mentioned above. Finally we rework the code, which loops over all network objects to determine the best available connection. Signed-off-by: Soeren Grunewald <soeren.grunewald(a)gmx.net> --- dlls/netprofm/list.c | 60 +++++++++++++++++++++++++++++++++----------- 1 file changed, 46 insertions(+), 14 deletions(-) diff --git a/dlls/netprofm/list.c b/dlls/netprofm/list.c index f6823f09cf..40a3710365 100644 --- a/dlls/netprofm/list.c +++ b/dlls/netprofm/list.c @@ -62,8 +62,6 @@ struct connection struct list entry; GUID id; INetwork *network; - VARIANT_BOOL connected_to_internet; - VARIANT_BOOL connected; }; struct connection_point @@ -477,13 +475,26 @@ static HRESULT WINAPI network_get_IsConnected( return S_OK; } +static NLM_CONNECTIVITY connectivitystate_from_network( struct network *network ) +{ + if ( network->connected_to_internet ) + return NLM_CONNECTIVITY_IPV4_INTERNET; + + if ( network->connected ) + return NLM_CONNECTIVITY_IPV4_SUBNET; + + return NLM_CONNECTIVITY_DISCONNECTED; +} + static HRESULT WINAPI network_GetConnectivity( INetwork *iface, NLM_CONNECTIVITY *pConnectivity ) { - FIXME( "%p, %p\n", iface, pConnectivity ); + struct network *network = impl_from_INetwork( iface ); + + TRACE( "%p, %p\n", iface, pConnectivity ); - *pConnectivity = NLM_CONNECTIVITY_IPV4_INTERNET; + *pConnectivity = connectivitystate_from_network( network ); return S_OK; } @@ -1328,9 +1339,29 @@ static HRESULT WINAPI list_manager_GetConnectivity( INetworkListManager *iface, NLM_CONNECTIVITY *pConnectivity ) { - FIXME( "%p, %p\n", iface, pConnectivity ); + struct list_manager *mgr = impl_from_INetworkListManager( iface ); + struct network *network; + + NLM_CONNECTIVITY best = NLM_CONNECTIVITY_DISCONNECTED; + NLM_CONNECTIVITY state; - *pConnectivity = NLM_CONNECTIVITY_IPV4_INTERNET; + TRACE( "%p, %p\n", iface, pConnectivity ); + + LIST_FOR_EACH_ENTRY( network, &mgr->networks, struct network, entry ) + { + state = connectivitystate_from_network( network ); + if ( state == NLM_CONNECTIVITY_IPV4_INTERNET ) + { + best = state; + break; + } + if ( state == NLM_CONNECTIVITY_IPV4_SUBNET ) + { + best = state; + } + } + + *pConnectivity = best; return S_OK; } @@ -1538,10 +1569,11 @@ static HRESULT WINAPI connection_get_IsConnectedToInternet( VARIANT_BOOL *pbIsConnected ) { struct connection *connection = impl_from_INetworkConnection( iface ); + struct network *network = impl_from_INetwork( connection->network ); TRACE( "%p, %p\n", iface, pbIsConnected ); - *pbIsConnected = connection->connected_to_internet; + *pbIsConnected = network->connected_to_internet; return S_OK; } @@ -1550,10 +1582,11 @@ static HRESULT WINAPI connection_get_IsConnected( VARIANT_BOOL *pbIsConnected ) { struct connection *connection = impl_from_INetworkConnection( iface ); + struct network *network = impl_from_INetwork( connection->network ); TRACE( "%p, %p\n", iface, pbIsConnected ); - *pbIsConnected = connection->connected; + *pbIsConnected = network->connected; return S_OK; } @@ -1561,9 +1594,12 @@ static HRESULT WINAPI connection_GetConnectivity( INetworkConnection *iface, NLM_CONNECTIVITY *pConnectivity ) { - FIXME( "%p, %p\n", iface, pConnectivity ); + struct connection *connection = impl_from_INetworkConnection( iface ); + struct network *network = impl_from_INetwork( connection->network ); - *pConnectivity = NLM_CONNECTIVITY_IPV4_INTERNET; + TRACE( "%p, %p\n", iface, pConnectivity ); + + *pConnectivity = connectivitystate_from_network( network ); return S_OK; } @@ -1701,8 +1737,6 @@ static struct connection *create_connection( const GUID *id ) ret->refs = 1; ret->id = *id; ret->network = NULL; - ret->connected = VARIANT_FALSE; - ret->connected_to_internet = VARIANT_FALSE; list_init( &ret->entry ); return ret; @@ -1748,12 +1782,10 @@ static void init_networks( struct list_manager *mgr ) if (aa->FirstUnicastAddress) { network->connected = VARIANT_TRUE; - connection->connected = VARIANT_TRUE; } if (aa->FirstGatewayAddress) { network->connected_to_internet = VARIANT_TRUE; - connection->connected_to_internet = VARIANT_TRUE; } connection->network = &network->INetwork_iface; -- 2.20.1

1 0

v4l patches feedback?
by Damjan Jovanovic April 26, 2019

April 26, 2019

Hi Can I please have some feedback on: https://source.winehq.org/patches/data/163594 https://source.winehq.org/patches/data/163460 https://source.winehq.org/patches/data/163461 Thank you Damjan

2 1

[PATCH vkd3d 5/9] vkd3d-shader: Add support for specialization constants.
by Józef Kucia April 26, 2019

April 26, 2019

From: Józef Kucia <jkucia(a)codeweavers.com> Allows reusing the same SPIR-V binary with different shader parameters. Signed-off-by: Józef Kucia <jkucia(a)codeweavers.com> --- libs/vkd3d-shader/spirv.c | 35 ++++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/libs/vkd3d-shader/spirv.c b/libs/vkd3d-shader/spirv.c index 81830e383e13..1ab005f6ea74 100644 --- a/libs/vkd3d-shader/spirv.c +++ b/libs/vkd3d-shader/spirv.c @@ -1062,6 +1062,13 @@ static uint32_t vkd3d_spirv_get_op_constant_composite(struct vkd3d_spirv_builder constituents, constituent_count, vkd3d_spirv_build_op_constant_composite); } +static uint32_t vkd3d_spirv_build_op_spec_constant(struct vkd3d_spirv_builder *builder, + uint32_t result_type, uint32_t value) +{ + return vkd3d_spirv_build_op_tr1(builder, &builder->global_stream, + SpvOpSpecConstant, result_type, value); +} + static uint32_t vkd3d_spirv_build_op_variable(struct vkd3d_spirv_builder *builder, struct vkd3d_spirv_stream *stream, uint32_t type_id, uint32_t storage_class, uint32_t initializer) { @@ -2492,12 +2499,25 @@ static const struct vkd3d_shader_parameter *vkd3d_dxbc_compiler_get_shader_param return NULL; } +static uint32_t vkd3d_shader_get_default_spec_constant_value(enum vkd3d_shader_parameter_name name) +{ + switch (name) + { + case VKD3D_SHADER_PARAMETER_NAME_RASTERIZER_SAMPLE_COUNT: + return 1; + + default: + FIXME("Unhandled parameter name %#x.\n", name); + return 0; + } +} + static uint32_t vkd3d_dxbc_compiler_emit_uint_shader_parameter(struct vkd3d_dxbc_compiler *compiler, enum vkd3d_shader_parameter_name name) { struct vkd3d_spirv_builder *builder = &compiler->spirv_builder; const struct vkd3d_shader_parameter *parameter; - uint32_t id; + uint32_t type_id, id; if (!(parameter = vkd3d_dxbc_compiler_get_shader_parameter(compiler, name))) { @@ -2509,12 +2529,21 @@ static uint32_t vkd3d_dxbc_compiler_emit_uint_shader_parameter(struct vkd3d_dxbc { return vkd3d_dxbc_compiler_get_constant_uint(compiler, parameter->u.immediate_constant.u.u32); } + else if (parameter->type == VKD3D_SHADER_PARAMETER_TYPE_SPECIALIZATION_CONSTANT) + { + type_id = vkd3d_spirv_get_type_id(builder, VKD3D_TYPE_UINT, 1); + id = vkd3d_spirv_build_op_spec_constant(builder, + type_id, vkd3d_shader_get_default_spec_constant_value(name)); + vkd3d_spirv_build_op_decorate1(builder, + id, SpvDecorationSpecId, parameter->u.specialization_constant.id); + return id; + } FIXME("Unhandled parameter type %#x.\n", parameter->type); fail: - id = vkd3d_spirv_get_type_id(builder, VKD3D_TYPE_UINT, 1); - return vkd3d_spirv_build_op_undef(builder, &builder->global_stream, id); + type_id = vkd3d_spirv_get_type_id(builder, VKD3D_TYPE_UINT, 1); + return vkd3d_spirv_build_op_undef(builder, &builder->global_stream, type_id); } static uint32_t vkd3d_dxbc_compiler_emit_construct_vector(struct vkd3d_dxbc_compiler *compiler, -- 2.21.0

2 1

[PATCH vkd3d 6/9] vkd3d-shader: Use specialization constants by default for shader parameters.
by Józef Kucia April 26, 2019

April 26, 2019

From: Józef Kucia <jkucia(a)codeweavers.com> Signed-off-by: Józef Kucia <jkucia(a)codeweavers.com> --- libs/vkd3d-shader/spirv.c | 94 ++++++++++++++++++++++++++++----------- 1 file changed, 69 insertions(+), 25 deletions(-) diff --git a/libs/vkd3d-shader/spirv.c b/libs/vkd3d-shader/spirv.c index 1ab005f6ea74..aa3351b4d95f 100644 --- a/libs/vkd3d-shader/spirv.c +++ b/libs/vkd3d-shader/spirv.c @@ -2012,6 +2012,8 @@ struct vkd3d_dxbc_compiler uint32_t private_output_variable_write_mask[MAX_REG_OUTPUT + 1]; /* 1 entry for oDepth */ uint32_t epilogue_function_id; + uint32_t current_spec_constant_id; + uint32_t binding_idx; const struct vkd3d_shader_scan_info *scan_info; @@ -2499,51 +2501,93 @@ static const struct vkd3d_shader_parameter *vkd3d_dxbc_compiler_get_shader_param return NULL; } -static uint32_t vkd3d_shader_get_default_spec_constant_value(enum vkd3d_shader_parameter_name name) +static const struct vkd3d_spec_constant_info +{ + enum vkd3d_shader_parameter_name name; + uint32_t default_value; + const char *debug_name; +} +vkd3d_shader_parameters[] = +{ + {VKD3D_SHADER_PARAMETER_NAME_RASTERIZER_SAMPLE_COUNT, 1, "sample_count"}, +}; + +static const struct vkd3d_spec_constant_info *get_spec_constant_info(enum vkd3d_shader_parameter_name name) { - switch (name) + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(vkd3d_shader_parameters); ++i) { - case VKD3D_SHADER_PARAMETER_NAME_RASTERIZER_SAMPLE_COUNT: - return 1; + if (vkd3d_shader_parameters[i].name == name) + return &vkd3d_shader_parameters[i]; + } - default: - FIXME("Unhandled parameter name %#x.\n", name); - return 0; + FIXME("Unhandled parameter name %#x.\n", name); + return NULL; +} + +static uint32_t vkd3d_dxbc_compiler_alloc_spec_constant_id(struct vkd3d_dxbc_compiler *compiler) +{ + if (!compiler->current_spec_constant_id && compiler->compile_args) + { + const struct vkd3d_shader_compile_arguments *compile_args = compiler->compile_args; + unsigned int i, id; + + for (i = 0, id = 0; i < compile_args->parameter_count; ++i) + { + const struct vkd3d_shader_parameter *current = &compile_args->parameters[i]; + + if (current->type == VKD3D_SHADER_PARAMETER_TYPE_SPECIALIZATION_CONSTANT) + id = max(current->u.specialization_constant.id, id); + } + + compiler->current_spec_constant_id = id + 1; } + + return compiler->current_spec_constant_id++; +} + +static uint32_t vkd3d_dxbc_compiler_emit_spec_constant(struct vkd3d_dxbc_compiler *compiler, + enum vkd3d_shader_parameter_name name, uint32_t spec_id) +{ + struct vkd3d_spirv_builder *builder = &compiler->spirv_builder; + const struct vkd3d_spec_constant_info *info; + uint32_t type_id, id, default_value; + + info = get_spec_constant_info(name); + default_value = info ? info->default_value : 0; + + type_id = vkd3d_spirv_get_type_id(builder, VKD3D_TYPE_UINT, 1); + id = vkd3d_spirv_build_op_spec_constant(builder, type_id, default_value); + vkd3d_spirv_build_op_decorate1(builder, id, SpvDecorationSpecId, spec_id); + + if (info) + vkd3d_spirv_build_op_name(builder, id, "%s", info->debug_name); + + return id; } static uint32_t vkd3d_dxbc_compiler_emit_uint_shader_parameter(struct vkd3d_dxbc_compiler *compiler, enum vkd3d_shader_parameter_name name) { - struct vkd3d_spirv_builder *builder = &compiler->spirv_builder; const struct vkd3d_shader_parameter *parameter; - uint32_t type_id, id; if (!(parameter = vkd3d_dxbc_compiler_get_shader_parameter(compiler, name))) { - FIXME("Unresolved shader parameter %#x.\n", name); - goto fail; + WARN("Unresolved shader parameter %#x.\n", name); + goto default_parameter; } if (parameter->type == VKD3D_SHADER_PARAMETER_TYPE_IMMEDIATE_CONSTANT) - { return vkd3d_dxbc_compiler_get_constant_uint(compiler, parameter->u.immediate_constant.u.u32); - } - else if (parameter->type == VKD3D_SHADER_PARAMETER_TYPE_SPECIALIZATION_CONSTANT) - { - type_id = vkd3d_spirv_get_type_id(builder, VKD3D_TYPE_UINT, 1); - id = vkd3d_spirv_build_op_spec_constant(builder, - type_id, vkd3d_shader_get_default_spec_constant_value(name)); - vkd3d_spirv_build_op_decorate1(builder, - id, SpvDecorationSpecId, parameter->u.specialization_constant.id); - return id; - } + if (parameter->type == VKD3D_SHADER_PARAMETER_TYPE_SPECIALIZATION_CONSTANT) + return vkd3d_dxbc_compiler_emit_spec_constant(compiler, name, parameter->u.specialization_constant.id); FIXME("Unhandled parameter type %#x.\n", parameter->type); -fail: - type_id = vkd3d_spirv_get_type_id(builder, VKD3D_TYPE_UINT, 1); - return vkd3d_spirv_build_op_undef(builder, &builder->global_stream, type_id); +default_parameter: + return vkd3d_dxbc_compiler_emit_spec_constant(compiler, + name, vkd3d_dxbc_compiler_alloc_spec_constant_id(compiler)); } static uint32_t vkd3d_dxbc_compiler_emit_construct_vector(struct vkd3d_dxbc_compiler *compiler, -- 2.21.0

2 1

[PATCH vkd3d 8/9] vkd3d: Pass sample count to shader compiler.
by Józef Kucia April 26, 2019

April 26, 2019

From: Józef Kucia <jkucia(a)codeweavers.com> Signed-off-by: Józef Kucia <jkucia(a)codeweavers.com> --- libs/vkd3d/state.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libs/vkd3d/state.c b/libs/vkd3d/state.c index a6b5fdd0ede5..edf3399b1aa8 100644 --- a/libs/vkd3d/state.c +++ b/libs/vkd3d/state.c @@ -1878,6 +1878,7 @@ static HRESULT d3d12_pipeline_state_init_graphics(struct d3d12_pipeline_state *s uint32_t instance_divisors[D3D12_VS_INPUT_REGISTER_COUNT]; uint32_t aligned_offsets[D3D12_VS_INPUT_REGISTER_COUNT]; struct vkd3d_shader_compile_arguments ps_compile_args; + struct vkd3d_shader_parameter ps_shader_parameters[1]; struct vkd3d_shader_transform_feedback_info xfb_info; struct vkd3d_shader_interface_info shader_interface; const struct d3d12_root_signature *root_signature; @@ -2071,11 +2072,16 @@ static HRESULT d3d12_pipeline_state_init_graphics(struct d3d12_pipeline_state *s } graphics->attachment_count = graphics->rt_idx + rt_count; + ps_shader_parameters[0].name = VKD3D_SHADER_PARAMETER_NAME_RASTERIZER_SAMPLE_COUNT; + ps_shader_parameters[0].type = VKD3D_SHADER_PARAMETER_TYPE_IMMEDIATE_CONSTANT; + ps_shader_parameters[0].data_type = VKD3D_SHADER_PARAMETER_DATA_TYPE_UINT32; + ps_shader_parameters[0].u.immediate_constant.u.u32 = sample_count; + ps_compile_args.type = VKD3D_SHADER_STRUCTURE_TYPE_COMPILE_ARGUMENTS; ps_compile_args.next = NULL; ps_compile_args.target = VKD3D_SHADER_TARGET_SPIRV_VULKAN_1_0; - ps_compile_args.parameter_count = 0; - ps_compile_args.parameters = NULL; + ps_compile_args.parameter_count = ARRAY_SIZE(ps_shader_parameters); + ps_compile_args.parameters = ps_shader_parameters; ps_compile_args.dual_source_blending = is_dual_source_blending(&desc->BlendState.RenderTarget[0]); ps_compile_args.output_swizzles = ps_output_swizzle; ps_compile_args.output_swizzle_count = rt_count; -- 2.21.0

2 1