C++ GetLengthSid函数代码示例

			PVOID built(PSECURITY_DESCRIPTOR pSD) 
			{
				PSID   psidEveryone = NULL;
				PACL   pDACL   = NULL;
				BOOL   bResult = FALSE;

				__try 
				{
					SID_IDENTIFIER_AUTHORITY siaWorld = SECURITY_WORLD_SID_AUTHORITY;
					//SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;

					if (!::InitializeSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION))
						__leave;

					if (!::AllocateAndInitializeSid(&siaWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &psidEveryone)) 
						__leave;

					DWORD dwAclLength = sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) + GetLengthSid(psidEveryone);

					pDACL = (PACL)::HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwAclLength);
					if (!pDACL) 
						__leave;

					if (!::InitializeAcl(pDACL, dwAclLength, ACL_REVISION)) 
						__leave;

					if (!::AddAccessAllowedAce(pDACL, ACL_REVISION, GENERIC_ALL, psidEveryone)) 
						__leave;

					if (!::SetSecurityDescriptorDacl(pSD, TRUE, pDACL, FALSE)) 
						__leave;
					bResult = TRUE;
				} 
				__finally 
				{
					if (psidEveryone) 
						::FreeSid(psidEveryone);
				}

				if (bResult == FALSE) 
				{
					if (pDACL) ::HeapFree(::GetProcessHeap(), 0, pDACL);
					pDACL = NULL;
				}

				return (PVOID) pDACL;
			}

DWORD GetCurrentUserSID (
    PSID *Sid)
{
    TOKEN_USER *tokenUser = NULL;
    HANDLE tokenHandle;
    DWORD tokenSize;
    DWORD sidLength;

    if (OpenProcessToken (GetCurrentProcess(), TOKEN_QUERY, &tokenHandle))
    {
        GetTokenInformation (tokenHandle,
            TokenUser,
            tokenUser,
            0,
            &tokenSize);

        tokenUser = (TOKEN_USER *) malloc (tokenSize);

        if (GetTokenInformation(tokenHandle,
            TokenUser,
            tokenUser,
            tokenSize,
            &tokenSize))
        {
            sidLength = GetLengthSid (tokenUser->User.Sid);
            *Sid = (PSID) malloc (sidLength);

            memcpy (*Sid, tokenUser->User.Sid, sidLength);
            CloseHandle (tokenHandle);
        } 
        else
        {
            free (tokenUser);
            return GetLastError();
        }
    } 
    else
    {
        free (tokenUser);
        return GetLastError();
    }

    free (tokenUser);
    return ERROR_SUCCESS;
}

NTSTATUS kuhl_m_sid_add(int argc, wchar_t * argv[])
{
	PLDAP ld;
	DWORD dwErr;
	PCWCHAR szName;
	PWCHAR domain = NULL;
	PLDAPMessage pMessage = NULL;
	BERVAL NewSid;
	PBERVAL pNewSid[2] = {&NewSid, NULL};
	LDAPMod Modification = {LDAP_MOD_ADD | LDAP_MOD_BVALUES, L"sIDHistory"};
	PLDAPMod pModification[2] = {&Modification, NULL};
	Modification.mod_vals.modv_bvals = pNewSid;

	if(kull_m_string_args_byName(argc, argv, L"new", &szName, NULL))
	{
		if(ConvertStringSidToSid(szName, (PSID *) &NewSid.bv_val) || kull_m_token_getSidDomainFromName(szName, (PSID *) &NewSid.bv_val, &domain, NULL, NULL))
		{
			if(IsValidSid((PSID) NewSid.bv_val))
			{
				NewSid.bv_len = GetLengthSid((PSID) NewSid.bv_val);
				if(kuhl_m_sid_quickSearch(argc, argv, TRUE, NULL, &ld, &pMessage))
				{
					kprintf(L"\n  * Will try to add \'%s\' this new SID:\'", Modification.mod_type);
					kull_m_string_displaySID(NewSid.bv_val);
					kprintf(L"\': ");
					dwErr = ldap_modify_s(ld, ldap_get_dn(ld, pMessage), pModification);
					if(dwErr == LDAP_SUCCESS)
						kprintf(L"OK!\n");
					else PRINT_ERROR(L"ldap_modify_s 0x%x (%u)\n", dwErr, dwErr);
					if(pMessage)
						ldap_msgfree(pMessage);
					ldap_unbind(ld);
				}
			}
			else PRINT_ERROR(L"Invalid SID\n");
			LocalFree(NewSid.bv_val);
			if(domain)
				LocalFree(domain);
		}
		else PRINT_ERROR_AUTO(L"ConvertStringSidToSid / kull_m_token_getSidDomainFromName");
	}
	else PRINT_ERROR(L"/new:sid or /new:resolvable_name is needed");
	return STATUS_SUCCESS;
}

BOOL SetTokenIL(HANDLE hToken, DWORD dwIntegrityLevel)
{

    BOOL                  fRet = FALSE;
    PSID                  pIntegritySid = NULL;
    TOKEN_MANDATORY_LABEL TIL = { 0 };

    // Low integrity SID
    WCHAR wszIntegritySid[32];

    if (FAILED(StringCbPrintf(wszIntegritySid, sizeof(wszIntegritySid), L"S-1-16-%d", dwIntegrityLevel)))
    {
        printf("Error creating IL SID\n");
        goto CleanExit;
    }

    fRet = ConvertStringSidToSid(wszIntegritySid, &pIntegritySid);

    if (!fRet)
    {
        printf("Error converting IL string %ls\n", GetErrorMessage().c_str());
        goto CleanExit;
    }

    TIL.Label.Attributes = SE_GROUP_INTEGRITY;
    TIL.Label.Sid = pIntegritySid;

    fRet = SetTokenInformation(hToken,
                               TokenIntegrityLevel,
                               &TIL,
                               sizeof(TOKEN_MANDATORY_LABEL) + GetLengthSid(pIntegritySid));

    if (!fRet)
    {
        printf("Error setting IL %d\n", GetLastError());
        goto CleanExit;
    }

CleanExit:

    LocalFree(pIntegritySid);

    return fRet;
}

bool SecurityHelper::GetLogonSid(HANDLE htok, void* psid, DWORD cbMax)
{
    DWORD cb;
    GetTokenInformation(htok, TokenGroups, 0, 0, &cb);
    TOKEN_GROUPS* ptg = (TOKEN_GROUPS*)LocalAlloc(LMEM_FIXED, cb);
    if (!ptg)
	{
        LOOM;
        return false;
    }

    bool success = false;
    if (GetTokenInformation(htok, TokenGroups, ptg, cb, &cb))
	{

        // search for the logon SID
		DWORD i = 0;
        for (i = 0; i < ptg->GroupCount; ++i)
		{
            if (ptg->Groups[i].Attributes & SE_GROUP_LOGON_ID)
			{
                void* logonSid = ptg->Groups[i].Sid;
                const DWORD cb = GetLengthSid(logonSid);
                if (cbMax < cb) return false; // sanity check caller's buffer size
                if (!CopySid(cb, psid, logonSid))
				{
                    LCF1(L"CopySid failed: %d", GetLastError());
                    break;
                }
                success = true;
                break;
            }
        }
        if (i == ptg->GroupCount)
		{
            LCF(L"Failed to find a logon SID in the user's access token!");
        }
    }
    else LCF1(L"GetTokenInformation(TokenGroups) failed: %d", GetLastError());

    LocalFree(ptg);

    return success;
}

static int
iwin32_gid_current (group_id_t *gid)
{
  HANDLE               thread_tok;
  DWORD                needed;
  TOKEN_PRIMARY_GROUP *group;
  DWORD                sid_size;

  assert (gid        != NULL);
  assert (gid->value == NULL);

  if (!OpenProcessToken (GetCurrentProcess(),
    STANDARD_RIGHTS_READ | READ_CONTROL | TOKEN_QUERY, &thread_tok)) return 0;

  /*
   * Is this _really_ correct?
   */

  if (!GetTokenInformation (thread_tok, TokenPrimaryGroup, NULL, 0, &needed)) {
    if (GetLastError () == ERROR_INSUFFICIENT_BUFFER) {
      group = malloc (needed);
      if (group == NULL) return 0;
      if (GetTokenInformation (thread_tok, TokenPrimaryGroup, group, needed, &needed)) {
        sid_size   = GetLengthSid (group->PrimaryGroup);
        gid->value = malloc (sid_size);
        if (gid->value == NULL) {
          free (group);
          return 0;
        }
        if (!CopySid (sid_size, gid->value, group->PrimaryGroup)) {
          free (gid->value);
          free (group);
          return 0;
        }
      }
      free (group);
    } else {
      return 0;
    }
  }

  return 1;
}

VOID QueueHashAdd(Queue *pQueue, PSID Sid, VOID *pValue, BOOL EnterCritSec) {
    QueueHashNode *pQueueHashNode;
    DWORD SidLength;

    ASSERT(pQueue != NULL);

    if (pQueue->lpCriticalSection != NULL && EnterCritSec) EnterCriticalSection(pQueue->lpCriticalSection);

#ifdef DEBUG2
    DbgMsgRecord(TEXT("-> QueueHashAdd\n"));
#endif

    pQueueHashNode = (QueueHashNode *) AutoHeapAlloc(sizeof(QueueHashNode));

    SidLength = GetLengthSid(Sid);

    // We need to copy the key so that if the original
    // copy gets deallocated we still have one.
    if ((pQueueHashNode->pKey = AutoHeapAlloc(SidLength)) == NULL) {
        AddToMessageLog(TEXT("QueueHashAdd: AutoHeapAlloc failed"));

        if (pQueue->lpCriticalSection != NULL && EnterCritSec) LeaveCriticalSection(pQueue->lpCriticalSection);
        return;
    }

    if (CopySid(SidLength, pQueueHashNode->pKey, Sid) == 0) {
        AddToMessageLogProcFailure(TEXT("QueueHashAdd: CopySid"), GetLastError());

        if (pQueue->lpCriticalSection != NULL && EnterCritSec) LeaveCriticalSection(pQueue->lpCriticalSection);
        return;    
    }

    pQueueHashNode->pValue = pValue;

    QueueAdd(pQueue, (VOID *) pQueueHashNode, FALSE);

#ifdef DEBUG2
    DbgMsgRecord(TEXT("<- QueueHashAdd\n"));
#endif

    if (pQueue->lpCriticalSection != NULL && EnterCritSec) LeaveCriticalSection(pQueue->lpCriticalSection);
}

PWCHAR kuhl_m_sid_filterFromArgs(int argc, wchar_t * argv[])
{
	PWCHAR filter = NULL;
	PCWCHAR szName;
	DWORD i, sidLen;
	size_t buffLen;
	PSID pSid;

	if(kull_m_string_args_byName(argc, argv, L"sam", &szName, NULL))
	{
		buffLen = wcslen(L"(sAMAccountName=") + wcslen(szName) + wcslen(L")") + 1;
		if(filter = (PWCHAR) LocalAlloc(LPTR, buffLen * sizeof(wchar_t)))
		{
			if(swprintf_s(filter, buffLen, L"(sAMAccountName=%s)", szName) != (buffLen - 1))
				filter = (PWCHAR) LocalFree(filter);
		}
	}
	else if(kull_m_string_args_byName(argc, argv, L"sid", &szName, NULL))
	{
		if(ConvertStringSidToSid(szName, &pSid))
		{
			if(IsValidSid(pSid))
			{
				sidLen = GetLengthSid(pSid);
				buffLen = wcslen(L"(objectSid=") + (sidLen * 3) + wcslen(L")") + 1;
				if(filter = (PWCHAR) LocalAlloc(LPTR, buffLen * sizeof(wchar_t)))
				{
					RtlCopyMemory(filter, L"(objectSid=", sizeof(L"(objectSid="));
					for(i = 0; i < sidLen; i++)
						swprintf_s(filter + ARRAYSIZE(L"(objectSid=") - 1 + (i * 3), 3 + 1, L"\\%02x", ((PBYTE) pSid)[i]);
					filter[buffLen - 2] = L')';
				}
			}
			else PRINT_ERROR(L"Invalid SID\n");
			LocalFree(pSid);
		}
		else PRINT_ERROR_AUTO(L"ConvertStringSidToSid");
	}
	else PRINT_ERROR(L"/sam or /sid to target the account is needed\n");
	
	return filter;
}

BOOL kuhl_m_pac_marshall_sid(PISID pSid, PVOID * current, DWORD * size)
{
	BOOL status = FALSE;
	PVOID newbuffer;
	DWORD sidSize, actualsize;
	sidSize = GetLengthSid(pSid);
	actualsize = sizeof(ULONG32) + sidSize;
	if(newbuffer = LocalAlloc(LPTR, *size + actualsize))
	{
		RtlCopyMemory(newbuffer, *current, *size);
		(*(PULONG32) ((PBYTE) newbuffer + *size)) = pSid->SubAuthorityCount;
		RtlCopyMemory((PBYTE) newbuffer + *size + sizeof(ULONG32), pSid, sidSize);

		LocalFree(*current);
		*current = newbuffer;
		*size += actualsize;

		status = TRUE;
	}
	return status;
}

HRESULT COpcSecurity::GetCurrentUserSID(PSID *ppSid)
{
	HANDLE tkHandle;

	if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &tkHandle))
	{
		TOKEN_USER *tkUser;
		DWORD tkSize;
		DWORD sidLength;

		// Call to get size information for alloc
		GetTokenInformation(tkHandle, TokenUser, NULL, 0, &tkSize);
		tkUser = (TOKEN_USER *) malloc(tkSize);
		if (tkUser == NULL)
			return E_OUTOFMEMORY;

		// Now make the real call
		if (GetTokenInformation(tkHandle, TokenUser, tkUser, tkSize, &tkSize))
		{
			sidLength = GetLengthSid(tkUser->User.Sid);
			*ppSid = (PSID) malloc(sidLength);
			if (*ppSid == NULL)
				return E_OUTOFMEMORY;

			memcpy(*ppSid, tkUser->User.Sid, sidLength);
			CloseHandle(tkHandle);

			free(tkUser);
			return S_OK;
		}
		else
		{
			free(tkUser);
			return HRESULT_FROM_WIN32(GetLastError());
		}
	}
	return HRESULT_FROM_WIN32(GetLastError());
}

static PSID
GetCurrentUserSid (void)
{
    PSID sid = NULL;
    guint32 size = 0;
    gpointer token = ves_icall_System_Security_Principal_WindowsIdentity_GetCurrentToken ();

    GetTokenInformation (token, TokenUser, NULL, size, (PDWORD)&size);
    if (size > 0) {
        TOKEN_USER *tu = g_malloc0 (size);
        if (GetTokenInformation (token, TokenUser, tu, size, (PDWORD)&size)) {
            DWORD length = GetLengthSid (tu->User.Sid);
            sid = (PSID) g_malloc0 (length);
            if (!CopySid (length, sid, tu->User.Sid)) {
                g_free (sid);
                sid = NULL;
            }
        }
        g_free (tu);
    }
    /* Note: this SID must be freed with g_free () */
    return sid;
}

PSID convert_jsstring_to_sid(JSContext * cx, JSString * curMemberString, DWORD * errorCode)
{
	PSID curMember;
	if(!ConvertStringSidToSid((LPWSTR)JS_GetStringChars(curMemberString), &curMember))
	{
		DWORD sidSize = 0, cbDomain;
		SID_NAME_USE peUse;
		*errorCode = GetLastError();
		JS_YieldRequest(cx);
		if(!LookupAccountName(NULL, (LPWSTR)JS_GetStringChars(curMemberString), NULL, &sidSize, NULL, &cbDomain, &peUse) && GetLastError() != ERROR_INSUFFICIENT_BUFFER)
		{
			*errorCode = GetLastError();
			return NULL;
		}
		curMember = (PSID)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sidSize);
		JS_YieldRequest(cx);
		LPTSTR domainName = (LPTSTR)HeapAlloc(GetProcessHeap(), 0, cbDomain * sizeof(TCHAR));
		if(!LookupAccountName(NULL, (LPWSTR)JS_GetStringChars(curMemberString), curMember, &sidSize, domainName, &cbDomain, &peUse))
		{
			*errorCode = GetLastError();
			HeapFree(GetProcessHeap(), 0, curMember);
			HeapFree(GetProcessHeap(), 0, domainName);
			return NULL;
		}
		HeapFree(GetProcessHeap(), 0, domainName);
		*errorCode = ERROR_SUCCESS;
	}
	else
	{
		DWORD sidSize = GetLengthSid(curMember);
		PSID retMember = (PSID)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sidSize);
		CopySid(sidSize, retMember, curMember);
		LocalFree(curMember);
		curMember = retMember;
	}
	return curMember;
}

void AddDefaultUserdata(PluginPanelItem* Item,int level,int sortorder,int itemtype,PSID sid,const wchar_t* wide_name,const wchar_t* filename)
{
  TCHAR* item_filename=(TCHAR*)malloc((_tcslen(filename)+1)*sizeof(TCHAR));
  Item->FileName=item_filename;
  if(item_filename)
  {
    if(item_filename) _tcscpy(item_filename,filename);
  }
  PluginUserData *user_data;
  int user_data_size=sizeof(PluginUserData),sid_size=0,name_size=0;
  if(sid&&IsValidSid(sid))
    sid_size=GetLengthSid(sid);
  name_size=(wcslen(wide_name)+1)*sizeof(wchar_t);
  user_data_size+=sid_size+name_size;

  user_data=(PluginUserData *)malloc(user_data_size);
  if(user_data)
  {
    user_data->size=user_data_size;
    user_data->level=level;
    user_data->sortorder=sortorder;
    user_data->itemtype=itemtype;
    if(sid_size)
    {
      CopySid(sid_size,(PSID)(user_data+1),sid);
      user_data->user_diff=sizeof(PluginUserData);
    }
    if(name_size)
    {
      wchar_t *ptr=(wchar_t *)((char *)(user_data+1)+sid_size);
      user_data->wide_name_diff=sizeof(PluginUserData)+sid_size;
      wcscpy(ptr,wide_name);
    }
    Item->UserData.FreeData=FreeUserData;
    Item->UserData.Data=user_data;
  }
}

DWORD
IDMCloneSid(
    PSID pSid,
    PSID *ppNewSid
    )
{
    DWORD dwError = 0;
    DWORD sidLen = 0;
    PSID pNewSid = NULL;

    if (!IsValidSid(pSid))
    {
        dwError = ERROR_INVALID_SID;
        BAIL_ON_ERROR(dwError);
    }

    sidLen = GetLengthSid(pSid);
    dwError = IDMAllocateMemory(
                    sidLen,
                    (PVOID*) &pNewSid);
    BAIL_ON_ERROR(dwError);

    if (!CopySid(sidLen, pNewSid, pSid))
    {
        dwError = GetLastError();
        BAIL_ON_ERROR(dwError);
    }

    *ppNewSid = pNewSid;

error:
    if (dwError)
    {
        IDM_SAFE_FREE_MEMORY(pNewSid);
    }
    return dwError;
}

BOOL RemoveAceFromWindowStation(HWINSTA hwinsta, PSID psid)
{
    // Obtain the DACL for the window station.
    SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;
    DWORD sd_length = 0;
    if (!GetUserObjectSecurity(hwinsta, &si, NULL, 0, &sd_length)) {
        if (GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
            printf("GetUserObjectSecurity() failed: %d\n", GetLastError());
            return FALSE;
        }
    }
    auto_buffer<PSECURITY_DESCRIPTOR> psd(sd_length);
    if (!GetUserObjectSecurity(hwinsta, &si, psd.get(), sd_length, &sd_length)) {
        printf("GetUserObjectSecurity() failed: %d\n", GetLastError());
        return FALSE;
    }

    // Create a new DACL.
    auto_buffer<PSECURITY_DESCRIPTOR> psd_new(sd_length);
    if (!InitializeSecurityDescriptor(psd_new.get(), SECURITY_DESCRIPTOR_REVISION)) {
        printf("InitializeSecurityDescriptor() failed: %d\n", GetLastError());
        return FALSE;
    }

    // Get the DACL from the security descriptor.
    BOOL bDaclPresent;
    PACL pacl;
    BOOL bDaclExist;
    if (!GetSecurityDescriptorDacl(psd.get(), &bDaclPresent, &pacl, &bDaclExist)) {
        printf("GetSecurityDescriptorDacl() failed: %d\n", GetLastError());
        return FALSE;
    }
    
    // Initialize the ACL.
    ACL_SIZE_INFORMATION aclSizeInfo = {};
    aclSizeInfo.AclBytesInUse = sizeof(ACL);
    if (NULL != pacl) {
        // get the file ACL size info
        if (!GetAclInformation(pacl, &aclSizeInfo, sizeof aclSizeInfo, AclSizeInformation)) {
            printf("GetAclInformation() failed: %d\n", GetLastError());
            return FALSE;
        }
    }

    // Compute the size of the new ACL.
    DWORD new_acl_size = aclSizeInfo.AclBytesInUse -
                         ((2 * sizeof(ACCESS_ALLOWED_ACE)) + 
                          (2 * GetLengthSid(psid)) - (2 * sizeof(DWORD)));
    auto_buffer<PACL> new_acl(new_acl_size);

    // Initialize the new DACL.
    if (!InitializeAcl(new_acl.get(), new_acl_size, ACL_REVISION)) {
        printf("InitializeAcl() failed: %d\n", GetLastError());
        return FALSE;
    }

    // If DACL is present, copy it to a new DACL.
    if (bDaclPresent) {
        // Copy the ACEs to the new ACL.
        for (DWORD i = 0; i != aclSizeInfo.AceCount; ++i) {
            ACCESS_ALLOWED_ACE* pace;
            if (!GetAce(pacl, i, (void**)&pace)) {
                printf("GetAce() failed: %d\n", GetLastError());
                return FALSE;
            }
            if (!EqualSid(psid, &pace->SidStart)) {
                if (!AddAce(new_acl.get(), ACL_REVISION, MAXDWORD,
                            pace, pace->Header.AceSize)) {
                    printf("AddAce() failed: %d\n", GetLastError());
                    return FALSE;
                }
            }
        }
    }

    // Set a new DACL for the security descriptor.
    if (!SetSecurityDescriptorDacl(psd_new.get(), TRUE, new_acl.get(), FALSE)) {
        printf("SetSecurityDescriptorDacl() failed: %d\n", GetLastError());
        return FALSE;
    }

    // Set the new security descriptor for the window station.
    if (!SetUserObjectSecurity(hwinsta, &si, psd_new.get())) {
        printf("SetUserObjectSecurity() failed: %d\n", GetLastError());
        return FALSE;
    }

    return TRUE;
}