Unit secureobj

Classes

ESecObjError - this initializes the application for security manipulation
TKernelSecObject -
TSecureableObject -
TUserSecObject -

Functions

SetPrivilegeInAccessToken - Ignore previous info
SetSpecificPrivilegeInAccessToken - TServiceSecObject = class(TSecureableObject) public procedure SetObjectSecurity(hObject: TSC_Handle); procedure GetObjectSecurity(hObject: TSC_Handle); end; {TPrivateSecObject = class(TSecureableObject) private m_hAccessToken: HANDLE; m_gmPrivateMapping: TGeneric_Mapping; m_ObjectSD: PSecurityDescriptor; m_dwUniqueHandleId: Pointer; public Constructor Create(bProtected: Boolean); override; Destructor Destroy; override; procedure SetObjectSecurity; procedure GetObjectSecurity; procedure MatchAccessRequest(dwMask: DWORD; hThread: THandle); function MapRequestedRights (dwArg: DWORD): DWORD; end;

helper function

Types

ACCESS_ALLOWED_ACE
ACCESS_DENIED_ACE
ACE_HEADER
PACCESS_ALLOWED_ACE
PACCESS_DENIED_ACE
PACE_HEADER
PSYSTEM_ALARM_ACE
PSYSTEM_AUDIT_ACE
SYSTEM_ALARM_ACE
SYSTEM_AUDIT_ACE

Constants

ACCESS_ALLOWED_ACE_TYPE
ACCESS_DENIED_ACE_TYPE
ACL_REVISION
ACL_REVISION1
ACL_REVISION2
CONTAINER_INHERIT_ACE
DOMAIN_ALIAS_RID_ACCOUNT_OPS
DOMAIN_ALIAS_RID_ADMINS
DOMAIN_ALIAS_RID_BACKUP_OPS
DOMAIN_ALIAS_RID_GUESTS
DOMAIN_ALIAS_RID_POWER_USERS
DOMAIN_ALIAS_RID_PRINT_OPS
DOMAIN_ALIAS_RID_REPLICATOR
DOMAIN_ALIAS_RID_SYSTEM_OPS
DOMAIN_ALIAS_RID_USERS
DOMAIN_GROUP_RID_ADMINS
DOMAIN_GROUP_RID_GUESTS
DOMAIN_GROUP_RID_USERS
DOMAIN_USER_RID_ADMIN
DOMAIN_USER_RID_GUEST
FAILED_ACCESS_ACE_FLAG
INHERIT_ONLY_ACE
NO_PROPAGATE_INHERIT_ACE
OBJECT_INHERIT_ACE
SECURITY_ANONYMOUS_LOGON_RID
SECURITY_BATCH_RID
SECURITY_BUILTIN_DOMAIN_RID
SECURITY_CREATOR_GROUP_RID
SECURITY_CREATOR_OWNER_RID
SECURITY_CREATOR_SID_AUTHORITY
SECURITY_DESCRIPTOR_REVISION
SECURITY_DESCRIPTOR_REVISION1
SECURITY_DIALUP_RID
SECURITY_INTERACTIVE_RID
SECURITY_LOCAL_RID
SECURITY_LOCAL_SID_AUTHORITY
SECURITY_LOCAL_SYSTEM_RID
SECURITY_LOGON_IDS_RID
SECURITY_LOGON_IDS_RID_COUNT
SECURITY_NETWORK_RID
SECURITY_NON_UNIQUE_AUTHORITY
SECURITY_NT_AUTHORITY
SECURITY_NT_NON_UNIQUE
SECURITY_NULL_RID
SECURITY_NULL_SID_AUTHORITY
SECURITY_SERVICE_RID
SECURITY_WORLD_RID
SECURITY_WORLD_SID_AUTHORITY
SUCCESSFUL_ACCESS_ACE_FLAG
SYSTEM_ALARM_ACE_TYPE
SYSTEM_AUDIT_ACE_TYPE
VALID_INHERIT_FLAGS

Variables


Functions


function SetPrivilegeInAccessToken(bEnabled: Boolean): Boolean;

Ignore previous info

function SetSpecificPrivilegeInAccessToken(lpPrivType: PAnsiChar; bEnabled: Boolean): Boolean;

TServiceSecObject = class(TSecureableObject) public procedure SetObjectSecurity(hObject: TSC_Handle); procedure GetObjectSecurity(hObject: TSC_Handle); end; {TPrivateSecObject = class(TSecureableObject) private m_hAccessToken: HANDLE; m_gmPrivateMapping: TGeneric_Mapping; m_ObjectSD: PSecurityDescriptor; m_dwUniqueHandleId: Pointer; public Constructor Create(bProtected: Boolean); override; Destructor Destroy; override; procedure SetObjectSecurity; procedure GetObjectSecurity; procedure MatchAccessRequest(dwMask: DWORD; hThread: THandle); function MapRequestedRights (dwArg: DWORD): DWORD; end;

helper function


Types


ACCESS_ALLOWED_ACE = record
Header : ACE_HEADER;
Mask : ACCESS_MASK;
SidStart : DWORD;
end;
We'll define the structure of the predefined ACE types. Pictorally the structure of the predefined ACE's is as follows: // 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 +---------------+-------+-------+---------------+---------------+ | AceFlags | Resd |Inherit| AceSize | AceType | +---------------+-------+-------+---------------+---------------+ | Mask | +---------------------------------------------------------------+ | | + + | | + Sid + | | + + | | +---------------------------------------------------------------+ // Mask is the access mask associated with the ACE. This is either the access allowed, access denied, audit, or alarm mask. // Sid is the Sid associated with the ACE. // The following are the four predefined ACE types. Examine the AceType field in the Header to determine which structure is appropriate to use for casting.
ACCESS_DENIED_ACE = record
Header : ACE_HEADER;
Mask : ACCESS_MASK;
SidStart : DWORD;
end;

ACE_HEADER = record
AceType : BYTE;
AceFlags : BYTE;
AceSize : WORD;
end;
The structure of an ACE is a common ace header followed by ace type specific data. Pictorally the structure of the common ace header is as follows: // 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 +---------------+-------+-------+---------------+---------------+ | AceSize | AceFlags | AceType | +---------------+-------+-------+---------------+---------------+ // AceType denotes the type of the ace, there are some predefined ace types // AceSize is the size, in bytes, of ace. // AceFlags are the Ace flags for audit and inheritance, defined shortly.
PACCESS_ALLOWED_ACE = ^ACCESS_ALLOWED_ACE

PACCESS_DENIED_ACE = ^ACCESS_DENIED_ACE

PACE_HEADER = ^ACE_HEADER

PSYSTEM_ALARM_ACE = ^SYSTEM_ALARM_ACE

PSYSTEM_AUDIT_ACE = ^SYSTEM_AUDIT_ACE

SYSTEM_ALARM_ACE = record
Header : ACE_HEADER;
Mask : ACCESS_MASK;
SidStart : DWORD;
end;

SYSTEM_AUDIT_ACE = record
Header : ACE_HEADER;
Mask : ACCESS_MASK;
SidStart : DWORD;
end;

Constants

ACCESS_ALLOWED_ACE_TYPE = $0

The following are the predefined ace types that go into the AceType field of an Ace header. //

ACCESS_DENIED_ACE_TYPE = $1

ACL_REVISION = 2

end_ntddk // ////////////////////////////////////////////////////////////////////// // ACL and ACE // // ////////////////////////////////////////////////////////////////////// // Define an ACL and the ACE format. The structure of an ACL header followed by one or more ACEs. Pictorally the structure of an ACL header is as follows: // 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 +-------------------------------+---------------+---------------+ | AclSize | Sbz1 | AclRevision | +-------------------------------+---------------+---------------+ | Sbz2 | AceCount | +-------------------------------+-------------------------------+ // The current AclRevision is defined to be ACL_REVISION. // AclSize is the size, in bytes, allocated for the ACL. This includes the ACL header, ACES, and remaining free space in the buffer. // AceCount is the number of ACES in the ACL. // begin_ntddk begin_ntifs This is the *current* ACL revision

ACL_REVISION1 = 1

This is the history of ACL revisions. Add a new one whenever ACL_REVISION is updated

ACL_REVISION2 = 2

CONTAINER_INHERIT_ACE = $2

DOMAIN_ALIAS_RID_ACCOUNT_OPS = $00000224

(0x00000223L

DOMAIN_ALIAS_RID_ADMINS = $00000220

(0x00000202L) well-known aliases ...

DOMAIN_ALIAS_RID_BACKUP_OPS = $00000227

(0x00000226L

DOMAIN_ALIAS_RID_GUESTS = $00000222

(0x00000221L

DOMAIN_ALIAS_RID_POWER_USERS = $00000223

(0x00000222L

DOMAIN_ALIAS_RID_PRINT_OPS = $00000226

(0x00000225L

DOMAIN_ALIAS_RID_REPLICATOR = $00000228

(0x00000227L

DOMAIN_ALIAS_RID_SYSTEM_OPS = $00000225

(0x00000224L

DOMAIN_ALIAS_RID_USERS = $00000221

(0x00000220L

DOMAIN_GROUP_RID_ADMINS = $00000200

(0x000001F5L) well-known groups ...

DOMAIN_GROUP_RID_GUESTS = $00000202

(0x00000201L

DOMAIN_GROUP_RID_USERS = $00000201

(0x00000200L

DOMAIN_USER_RID_ADMIN = $000001F4

(0x00000020L) /////////////////////////////////////////////////////////////////////////// // well-known domain relative sub-authority values (RIDs)... // // /////////////////////////////////////////////////////////////////////////// Well-known users ...

DOMAIN_USER_RID_GUEST = $000001F5

(0x000001F4L

FAILED_ACCESS_ACE_FLAG = $80

INHERIT_ONLY_ACE = $8

NO_PROPAGATE_INHERIT_ACE = $4

OBJECT_INHERIT_ACE = $1

The following are the inherit flags that go into the AceFlags field of an Ace header. //

SECURITY_ANONYMOUS_LOGON_RID = $00000007

(0x00000006L

SECURITY_BATCH_RID = $00000003

(0x00000002L

SECURITY_BUILTIN_DOMAIN_RID = $00000020

(0x00000015L

SECURITY_CREATOR_GROUP_RID = $00000001

(0x00000000L

SECURITY_CREATOR_OWNER_RID = $00000000

(0X00000000L

SECURITY_CREATOR_SID_AUTHORITY = (0,0,0,0,0,3)

SECURITY_DESCRIPTOR_REVISION = 1

(0x00000228L) ////////////////////////////////////////////////////////////////////// // SECURITY_DESCRIPTOR // // ////////////////////////////////////////////////////////////////////// // Define the Security Descriptor and related data types. This is an opaque data structure. // begin_ntddk begin_ntifs // Current security descriptor revision value //

SECURITY_DESCRIPTOR_REVISION1 = 1

SECURITY_DIALUP_RID = $00000001

ntifs

SECURITY_INTERACTIVE_RID = $00000004

(0x00000003L

SECURITY_LOCAL_RID = $00000000

(0x00000000L

SECURITY_LOCAL_SID_AUTHORITY = (0,0,0,0,0,2)

SECURITY_LOCAL_SYSTEM_RID = $00000012

(3L

SECURITY_LOGON_IDS_RID = $00000005

(0x00000007L

SECURITY_LOGON_IDS_RID_COUNT = 3

(0x00000005L

SECURITY_NETWORK_RID = $00000002

(0x00000001L

SECURITY_NON_UNIQUE_AUTHORITY = (0,0,0,0,0,4)

SECURITY_NT_AUTHORITY = (0,0,0,0,0,5)

(0x00000001L) /////////////////////////////////////////////////////////////////////////// // NT well-known SIDs // // NT Authority S-1-5 // Dialup S-1-5-1 // // Network S-1-5-2 // Batch S-1-5-3 // Interactive S-1-5-4 // Service S-1-5-6 // AnonymousLogon S-1-5-7 (aka null logon session) // // (Logon IDs) S-1-5-5-X-Y // // (NT non-unique IDs) S-1-5-0x15-... // // (Built-in domain) s-1-5-0x20 // // ///////////////////////////////////////////////////////////////////////////

SECURITY_NT_NON_UNIQUE = $00000015

(0x00000012L

SECURITY_NULL_RID = $00000000

SECURITY_NULL_SID_AUTHORITY = (0,0,0,0,0,0)

/////////////////////////////////////////////////////////////////////////// // Universal well-known SIDs // // Null SID S-1-0-0 // World S-1-1-0 // Local S-1-2-0 // Creator Owner ID S-1-3-0 // Creator Group ID S-1-3-1 // // (Non-unique IDs) S-1-4 // // ///////////////////////////////////////////////////////////////////////////

SECURITY_SERVICE_RID = $00000006

(0x00000004L

SECURITY_WORLD_RID = $00000000

(0x00000000L);

SECURITY_WORLD_SID_AUTHORITY = (0,0,0,0,0,1)

SUCCESSFUL_ACCESS_ACE_FLAG = $40

The following are the currently defined ACE flags that go into the AceFlags field of an ACE header. Each ACE type has its own set of AceFlags. // SUCCESSFUL_ACCESS_ACE_FLAG - used only with system audit and alarm ACE types to indicate that a message is generated for successful accesses. // FAILED_ACCESS_ACE_FLAG - used only with system audit and alarm ACE types to indicate that a message is generated for failed accesses. // // SYSTEM_AUDIT and SYSTEM_ALARM AceFlags // These control the signaling of audit and alarms for success or failure. //

SYSTEM_ALARM_ACE_TYPE = $3

SYSTEM_AUDIT_ACE_TYPE = $2

VALID_INHERIT_FLAGS = $F


Variables