mirrors/reactos
0
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-18 08:33:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

[NTOS:SE] Mark the token as no longer belonging to admin group upon effective duplication

Browse Source 
A scenario where it happens that an access token belongs to an administrators group but it's disabled (that is, SeAliasAdminsSid has no attributes or it doesn't have SE_GROUP_ENABLED turn ON), the function removes this group from the token but still has TOKEN_HAS_ADMIN_GROUP flag which can lead to erratic behavior across the kernel and security modules -- implying that the token still belongs to administrators group.

This is an oversight from my part.
This commit is contained in:
George Bișoc 2021-11-01 20:35:21 +01:00
parent 17ec81eab8
commit 0129de218b
No known key found for this signature in database
GPG Key ID: 688C4FBE25D7DEF6
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
ntoskrnl/se/token.c
View File

@ -1196,6 +1196,20 @@ SepDuplicateToken(
if (AccessToken->UserAndGroups[GroupsIndex].Attributes == 0 ||
(AccessToken->UserAndGroups[GroupsIndex].Attributes & SE_GROUP_ENABLED) == 0)
{
/*
* If this group is an administrators group
* and the token belongs to such group,
* we've to take away TOKEN_HAS_ADMIN_GROUP
* for the fact that's not enabled and as
* such the token no longer belongs to
* this group.
*/
if (RtlEqualSid(SeAliasAdminsSid,
&AccessToken->UserAndGroups[GroupsIndex].Sid))
{
AccessToken->TokenFlags &= ~TOKEN_HAS_ADMIN_GROUP;
}
/*
* A group is not enabled, it's time to remove
* from the token and update the groups index
@ -1203,6 +1217,7 @@ SepDuplicateToken(
*/
SepRemoveUserGroupToken(AccessToken, GroupsIndex);
GroupsIndex--;
continue;
}
}
@ -1228,6 +1243,7 @@ SepDuplicateToken(
*/
SepRemovePrivilegeToken(AccessToken, PrivilegesIndex);
PrivilegesIndex--;
continue;
}
}
}