lywsvip/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2026-05-30 23:33:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

[NTOS:SE] Use the captured security descriptor when access checking

Browse Source 
When performing access security check, use the security descriptor that we've captured it to determine based on that descriptor if the client can be granted access or not.
This commit is contained in:
George Bișoc
2021-09-12 16:07:44 +02:00
parent f81fb355ae
commit fc5bc55fbb
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ntoskrnl/se/accesschk.c
View File

@@ -882,8 +882,8 @@ NtAccessCheck(
}
/* Check security descriptor for valid owner and group */
if (SepGetSDOwner(SecurityDescriptor) == NULL || // FIXME: use CapturedSecurityDescriptor
SepGetSDGroup(SecurityDescriptor) == NULL) // FIXME: use CapturedSecurityDescriptor
if (SepGetSDOwner(CapturedSecurityDescriptor) == NULL ||
SepGetSDGroup(CapturedSecurityDescriptor) == NULL)
{
DPRINT("Security Descriptor does not have a valid group or owner\n");
SeReleaseSecurityDescriptor(CapturedSecurityDescriptor,
@@ -902,7 +902,7 @@ NtAccessCheck(
/* Check if the token is the owner and grant WRITE_DAC and READ_CONTROL rights */
if (DesiredAccess & (WRITE_DAC | READ_CONTROL | MAXIMUM_ALLOWED))
{
if (SepTokenIsOwner(Token, SecurityDescriptor, FALSE)) // FIXME: use CapturedSecurityDescriptor
if (SepTokenIsOwner(Token, CapturedSecurityDescriptor, FALSE))
{
if (DesiredAccess & MAXIMUM_ALLOWED)
PreviouslyGrantedAccess |= (WRITE_DAC | READ_CONTROL);
@@ -921,7 +921,7 @@ NtAccessCheck(
else
{
/* Now perform the access check */
SepAccessCheck(SecurityDescriptor, // FIXME: use CapturedSecurityDescriptor
SepAccessCheck(CapturedSecurityDescriptor,
&SubjectSecurityContext,
DesiredAccess,
NULL,