Joris van der Wel : advapi32/tests: Add additional tests for passing a thread sd to CreateProcess.
Module: wine Branch: master Commit: adede14dc248b7ec1bd1420270c55e8503b331f9 URL: https://source.winehq.org/git/wine.git/?a=commit;h=adede14dc248b7ec1bd142027...
Author: Joris van der Wel joris@jorisvanderwel.com Date: Tue Sep 18 21:07:17 2018 +0200
advapi32/tests: Add additional tests for passing a thread sd to CreateProcess.
Signed-off-by: Alexandre Julliard julliard@winehq.org
---
dlls/advapi32/tests/security.c | 45 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 41 insertions(+), 4 deletions(-)
diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c index 41b1fe0..6424d4b 100644 --- a/dlls/advapi32/tests/security.c +++ b/dlls/advapi32/tests/security.c @@ -2862,12 +2862,12 @@ static void test_process_security(void) PTOKEN_OWNER owner; PTOKEN_PRIMARY_GROUP group; PSID AdminSid = NULL, UsersSid = NULL; - PACL Acl = NULL; - SECURITY_DESCRIPTOR *SecurityDescriptor = NULL; + PACL Acl = NULL, ThreadAcl = NULL; + SECURITY_DESCRIPTOR *SecurityDescriptor = NULL, *ThreadSecurityDescriptor = NULL; char buffer[MAX_PATH]; PROCESS_INFORMATION info; STARTUPINFOA startup; - SECURITY_ATTRIBUTES psa; + SECURITY_ATTRIBUTES psa, tsa; HANDLE token, event; DWORD size; SID_IDENTIFIER_AUTHORITY SIDAuthWorld = { SECURITY_WORLD_SID_AUTHORITY }; @@ -2988,11 +2988,36 @@ static void test_process_security(void) psa.lpSecurityDescriptor = SecurityDescriptor; psa.bInheritHandle = TRUE;
+ ThreadSecurityDescriptor = HeapAlloc( GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH ); + res = InitializeSecurityDescriptor( ThreadSecurityDescriptor, SECURITY_DESCRIPTOR_REVISION ); + ok(res, "InitializeSecurityDescriptor failed with error %d\n", GetLastError()); + + ThreadAcl = HeapAlloc( GetProcessHeap(), 0, 256 ); + res = InitializeAcl( ThreadAcl, 256, ACL_REVISION ); + ok(res, "InitializeAcl failed with error %d\n", GetLastError()); + res = AddAccessDeniedAce( ThreadAcl, ACL_REVISION, THREAD_SET_THREAD_TOKEN, AdminSid ); + ok(res, "AddAccessDeniedAce failed with error %d\n", GetLastError() ); + res = AddAccessAllowedAce( ThreadAcl, ACL_REVISION, THREAD_ALL_ACCESS, AdminSid ); + ok(res, "AddAccessAllowedAce failed with error %d\n", GetLastError()); + + res = SetSecurityDescriptorOwner( ThreadSecurityDescriptor, AdminSid, FALSE ); + ok(res, "SetSecurityDescriptorOwner failed with error %d\n", GetLastError()); + res = SetSecurityDescriptorGroup( ThreadSecurityDescriptor, UsersSid, FALSE ); + ok(res, "SetSecurityDescriptorGroup failed with error %d\n", GetLastError()); + res = SetSecurityDescriptorDacl( ThreadSecurityDescriptor, TRUE, ThreadAcl, FALSE ); + ok(res, "SetSecurityDescriptorDacl failed with error %d\n", GetLastError()); + + tsa.nLength = sizeof(tsa); + tsa.lpSecurityDescriptor = ThreadSecurityDescriptor; + tsa.bInheritHandle = TRUE; + /* Doesn't matter what ACL say we should get full access for ourselves */ - res = CreateProcessA( NULL, buffer, &psa, NULL, FALSE, 0, NULL, NULL, &startup, &info ); + res = CreateProcessA( NULL, buffer, &psa, &tsa, FALSE, 0, NULL, NULL, &startup, &info ); ok(res, "CreateProcess with err:%d\n", GetLastError()); TEST_GRANTED_ACCESS2( info.hProcess, PROCESS_ALL_ACCESS_NT4, STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL ); + TEST_GRANTED_ACCESS2( info.hThread, THREAD_ALL_ACCESS_NT4, + STANDARD_RIGHTS_ALL | SPECIFIC_RIGHTS_ALL ); winetest_wait_child_process( info.hProcess );
FreeSid(EveryoneSid); @@ -3003,6 +3028,8 @@ static void test_process_security(void) HeapFree(GetProcessHeap(), 0, owner); HeapFree(GetProcessHeap(), 0, Acl); HeapFree(GetProcessHeap(), 0, SecurityDescriptor); + HeapFree(GetProcessHeap(), 0, ThreadAcl); + HeapFree(GetProcessHeap(), 0, ThreadSecurityDescriptor); }
static void test_process_security_child(void) @@ -3061,6 +3088,16 @@ static void test_process_security_child(void) TEST_GRANTED_ACCESS( handle1, PROCESS_VM_READ ); CloseHandle( handle1 ); CloseHandle( handle ); + + /* Test thread security */ + handle = OpenThread( THREAD_TERMINATE, FALSE, GetCurrentThreadId() ); + ok(handle != NULL, "OpenThread(THREAD_TERMINATE) with err:%d\n", GetLastError()); + TEST_GRANTED_ACCESS( handle, PROCESS_TERMINATE ); + CloseHandle( handle ); + + handle = OpenThread( THREAD_SET_THREAD_TOKEN, FALSE, GetCurrentThreadId() ); + todo_wine + ok(handle == NULL, "OpenThread(THREAD_SET_THREAD_TOKEN) should have failed\n"); }
static void test_impersonation_level(void)
-
Alexandre Julliard