开通博客赚积分
发布资源赚积分
分类

源码开发语言/平台
当前位置：首页 > 源码/资料 > Windows编程 > 系统编程 > 查看源码
ntsec.h
资源名称：BehaviorProMon.rar　[点击查看]
上传用户：xuemeng126
上传日期：2022-07-05
资源大小：454k
文件大小：26k
源码类别：

系统编程

开发平台：

Visual C++

ntsec.h：源码内容
  1. /*--
  3. Copyright (c) 1998 Mark Russinovich
  5. Module Name:
  7.     ntsec.h
  9. Abstract:
  11.     Windows NT kernel-mode security APIs and definitions. Most of 
  12.     this is taken from winnt.h
  14. --*/
  16. #ifndef _NTSEC_
  17. #define _NTSEC_
  20. //
  21. // These typedefs convert Win32 types to DDK types
  22. //
  23. typedef ULONG DWORD;
  24. typedef UCHAR BYTE;
  25. typedef USHORT WORD;
  26. typedef PVOID LPVOID;
  27. typedef BOOLEAN BOOL;
  30. ////////////////////////////////////////////////////////////////////////
  31. //                                                                    //
  32. //              Security Id     (SID)                                 //
  33. //                                                                    //
  34. ////////////////////////////////////////////////////////////////////////
  35. //
  36. //
  37. // Pictorially the structure of an SID is as follows:
  38. //
  39. //         1   1   1   1   1   1
  40. //         5   4   3   2   1   0   9   8   7   6   5   4   3   2   1   0
  41. //      +---------------------------------------------------------------+
  42. //      |      SubAuthorityCount        |Reserved1 (SBZ)|   Revision    |
  43. //      +---------------------------------------------------------------+
  44. //      |                   IdentifierAuthority[0]                      |
  45. //      +---------------------------------------------------------------+
  46. //      |                   IdentifierAuthority[1]                      |
  47. //      +---------------------------------------------------------------+
  48. //      |                   IdentifierAuthority[2]                      |
  49. //      +---------------------------------------------------------------+
  50. //      |                                                               |
  51. //      +- -  -  -  -  -  -  -  SubAuthority[]  -  -  -  -  -  -  -  - -+
  52. //      |                                                               |
  53. //      +---------------------------------------------------------------+
  54. //
  55. //
  58. // typedef struct _SID_IDENTIFIER_AUTHORITY {
  59. //     BYTE  Value[6];
  60. // } SID_IDENTIFIER_AUTHORITY, *PSID_IDENTIFIER_AUTHORITY;
  62. // typedef struct _SID {
  63. //    BYTE  Revision;
  64. //    BYTE  SubAuthorityCount;
  65. //    SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  66. // #ifdef MIDL_PASS
  67. //    [size_is(SubAuthorityCount)] DWORD SubAuthority[*];
  68. // #else // MIDL_PASS
  69. //    DWORD SubAuthority[ANYSIZE_ARRAY];
  70. // #endif // MIDL_PASS
  71. // } SID, *PISID;
  75. //#define SID_REVISION                     (1)    // Current revision level
  76. #define SID_MAX_SUB_AUTHORITIES          (15)
  77. #define SID_RECOMMENDED_SUB_AUTHORITIES  (1)    // Will change to around 6
  78.                                                 // in a future release.
  80. // typedef enum _SID_NAME_USE {
  81. //     SidTypeUser = 1,
  82. //     SidTypeGroup,
  83. //     SidTypeDomain,
  84. //     SidTypeAlias,
  85. //     SidTypeWellKnownGroup,
  86. //     SidTypeDeletedAccount,
  87. //     SidTypeInvalid,
  88. //     SidTypeUnknown
  89. // } SID_NAME_USE, *PSID_NAME_USE;
  91. // typedef struct _SID_AND_ATTRIBUTES {
  92. //     PSID Sid;
  93. //     DWORD Attributes;
  94. //     } SID_AND_ATTRIBUTES, * PSID_AND_ATTRIBUTES;
  96. typedef SID_AND_ATTRIBUTES SID_AND_ATTRIBUTES_ARRAY[ANYSIZE_ARRAY];
  97. typedef SID_AND_ATTRIBUTES_ARRAY *PSID_AND_ATTRIBUTES_ARRAY;
  100. /////////////////////////////////////////////////////////////////////////////
  101. //                                                                         //
  102. // Universal well-known SIDs                                               //
  103. //                                                                         //
  104. //     Null SID                     S-1-0-0                                //
  105. //     World                        S-1-1-0                                //
  106. //     Local                        S-1-2-0                                //
  107. //     Creator Owner ID             S-1-3-0                                //
  108. //     Creator Group ID             S-1-3-1                                //
  109. //     Creator Owner Server ID      S-1-3-2                                //
  110. //     Creator Group Server ID      S-1-3-3                                //
  111. //                                                                         //
  112. //     (Non-unique IDs)             S-1-4                                  //
  113. //                                                                         //
  114. /////////////////////////////////////////////////////////////////////////////
  116. #define SECURITY_NULL_SID_AUTHORITY       {0,0,0,0,0,0}
  117. #define SECURITY_WORLD_SID_AUTHORITY      {0,0,0,0,0,1}
  118. #define SECURITY_LOCAL_SID_AUTHORITY      {0,0,0,0,0,2}
  119. #define SECURITY_CREATOR_SID_AUTHORITY    {0,0,0,0,0,3}
  120. #define SECURITY_NON_UNIQUE_AUTHORITY     {0,0,0,0,0,4}
  122. #define SECURITY_NULL_RID                 (0x00000000L)
  123. #define SECURITY_WORLD_RID                (0x00000000L)
  124. #define SECURITY_LOCAL_RID                (0X00000000L)
  126. #define SECURITY_CREATOR_OWNER_RID        (0x00000000L)
  127. #define SECURITY_CREATOR_GROUP_RID        (0x00000001L)
  129. #define SECURITY_CREATOR_OWNER_SERVER_RID (0x00000002L)
  130. #define SECURITY_CREATOR_GROUP_SERVER_RID (0x00000003L)
  133. /////////////////////////////////////////////////////////////////////////////
  134. //                                                                         //
  135. // NT well-known SIDs                                                      //
  136. //                                                                         //
  137. //     NT Authority          S-1-5                                         //
  138. //     Dialup                S-1-5-1                                       //
  139. //                                                                         //
  140. //     Network               S-1-5-2                                       //
  141. //     Batch                 S-1-5-3                                       //
  142. //     Interactive           S-1-5-4                                       //
  143. //     Service               S-1-5-6                                       //
  144. //     AnonymousLogon        S-1-5-7       (aka null logon session)        //
  145. //     Proxy                 S-1-5-8                                       //
  146. //     ServerLogon           S-1-5-8       (aka domain controller account) //
  147. //                                                                         //
  148. //     (Logon IDs)           S-1-5-5-X-Y                                   //
  149. //                                                                         //
  150. //     (NT non-unique IDs)   S-1-5-0x15-...                                //
  151. //                                                                         //
  152. //     (Built-in domain)     s-1-5-0x20                                    //
  153. //                                                                         //
  154. /////////////////////////////////////////////////////////////////////////////
  157. #define SECURITY_NT_AUTHORITY           {0,0,0,0,0,5}   // ntifs
  159. #define SECURITY_DIALUP_RID             (0x00000001L)
  160. #define SECURITY_NETWORK_RID            (0x00000002L)
  161. #define SECURITY_BATCH_RID              (0x00000003L)
  162. #define SECURITY_INTERACTIVE_RID        (0x00000004L)
  163. #define SECURITY_SERVICE_RID            (0x00000006L)
  164. #define SECURITY_ANONYMOUS_LOGON_RID    (0x00000007L)
  165. #define SECURITY_PROXY_RID              (0x00000008L)
  166. #define SECURITY_SERVER_LOGON_RID       (0x00000009L)
  168. #define SECURITY_LOGON_IDS_RID          (0x00000005L)
  169. #define SECURITY_LOGON_IDS_RID_COUNT    (3L)
  171. #define SECURITY_LOCAL_SYSTEM_RID       (0x00000012L)
  173. #define SECURITY_NT_NON_UNIQUE          (0x00000015L)
  175. #define SECURITY_BUILTIN_DOMAIN_RID     (0x00000020L)
  178. /////////////////////////////////////////////////////////////////////////////
  179. //                                                                         //
  180. // well-known domain relative sub-authority values (RIDs)...               //
  181. //                                                                         //
  182. /////////////////////////////////////////////////////////////////////////////
  184. // Well-known users ...
  186. #define DOMAIN_USER_RID_ADMIN          (0x000001F4L)
  187. #define DOMAIN_USER_RID_GUEST          (0x000001F5L)
  189. // well-known groups ...
  191. #define DOMAIN_GROUP_RID_ADMINS        (0x00000200L)
  192. #define DOMAIN_GROUP_RID_USERS         (0x00000201L)
  193. #define DOMAIN_GROUP_RID_GUESTS        (0x00000202L)
  196. // well-known aliases ...
  198. #define DOMAIN_ALIAS_RID_ADMINS        (0x00000220L)
  199. #define DOMAIN_ALIAS_RID_USERS         (0x00000221L)
  200. #define DOMAIN_ALIAS_RID_GUESTS        (0x00000222L)
  201. #define DOMAIN_ALIAS_RID_POWER_USERS   (0x00000223L)
  203. #define DOMAIN_ALIAS_RID_ACCOUNT_OPS   (0x00000224L)
  204. #define DOMAIN_ALIAS_RID_SYSTEM_OPS    (0x00000225L)
  205. #define DOMAIN_ALIAS_RID_PRINT_OPS     (0x00000226L)
  206. #define DOMAIN_ALIAS_RID_BACKUP_OPS    (0x00000227L)
  208. #define DOMAIN_ALIAS_RID_REPLICATOR    (0x00000228L)
  211. ////////////////////////////////////////////////////////////////////////
  212. //                                                                    //
  213. //                          User and Group related SID attributes     //
  214. //                                                                    //
  215. ////////////////////////////////////////////////////////////////////////
  217. //
  218. // Group attributes
  219. //
  221. #define SE_GROUP_MANDATORY              (0x00000001L)
  222. #define SE_GROUP_ENABLED_BY_DEFAULT     (0x00000002L)
  223. #define SE_GROUP_ENABLED                (0x00000004L)
  224. #define SE_GROUP_OWNER                  (0x00000008L)
  225. #define SE_GROUP_LOGON_ID               (0xC0000000L)
  229. //
  230. //  The structure of an ACE is a common ace header followed by ace type
  231. //  specific data.  Pictorally the structure of the common ace header is
  232. //  as follows:
  233. //
  234. //       3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
  235. //       1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
  236. //      +---------------+-------+-------+---------------+---------------+
  237. //      |            AceSize            |    AceFlags   |     AceType   |
  238. //      +---------------+-------+-------+---------------+---------------+
  239. //
  240. //  AceType denotes the type of the ace, there are some predefined ace
  241. //  types
  242. //
  243. //  AceSize is the size, in bytes, of ace.
  244. //
  245. //  AceFlags are the Ace flags for audit and inheritance, defined shortly.
  247. typedef struct _ACE_HEADER {
  248.     BYTE  AceType;
  249.     BYTE  AceFlags;
  250.     WORD   AceSize;
  251. } ACE_HEADER;
  252. typedef ACE_HEADER *PACE_HEADER;
  254. //
  255. //  The following are the predefined ace types that go into the AceType
  256. //  field of an Ace header.
  257. //
  259. #define ACCESS_ALLOWED_ACE_TYPE          (0x0)
  260. #define ACCESS_DENIED_ACE_TYPE           (0x1)
  261. #define SYSTEM_AUDIT_ACE_TYPE            (0x2)
  262. #define SYSTEM_ALARM_ACE_TYPE            (0x3)
  264. //
  265. //  The following are the inherit flags that go into the AceFlags field
  266. //  of an Ace header.
  267. //
  269. #define OBJECT_INHERIT_ACE                (0x1)
  270. #define CONTAINER_INHERIT_ACE             (0x2)
  271. #define NO_PROPAGATE_INHERIT_ACE          (0x4)
  272. #define INHERIT_ONLY_ACE                  (0x8)
  273. #define VALID_INHERIT_FLAGS               (0xF)
  276. //  The following are the currently defined ACE flags that go into the
  277. //  AceFlags field of an ACE header.  Each ACE type has its own set of
  278. //  AceFlags.
  279. //
  280. //  SUCCESSFUL_ACCESS_ACE_FLAG - used only with system audit and alarm ACE
  281. //  types to indicate that a message is generated for successful accesses.
  282. //
  283. //  FAILED_ACCESS_ACE_FLAG - used only with system audit and alarm ACE types
  284. //  to indicate that a message is generated for failed accesses.
  285. //
  287. //
  288. //  SYSTEM_AUDIT and SYSTEM_ALARM AceFlags
  289. //
  290. //  These control the signaling of audit and alarms for success or failure.
  291. //
  293. #define SUCCESSFUL_ACCESS_ACE_FLAG       (0x40)
  294. #define FAILED_ACCESS_ACE_FLAG           (0x80)
  297. //
  298. //  We'll define the structure of the predefined ACE types.  Pictorally
  299. //  the structure of the predefined ACE's is as follows:
  300. //
  301. //       3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
  302. //       1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
  303. //      +---------------+-------+-------+---------------+---------------+
  304. //      |    AceFlags   | Resd  |Inherit|    AceSize    |     AceType   |
  305. //      +---------------+-------+-------+---------------+---------------+
  306. //      |                              Mask                             |
  307. //      +---------------------------------------------------------------+
  308. //      |                                                               |
  309. //      +                                                               +
  310. //      |                                                               |
  311. //      +                              Sid                              +
  312. //      |                                                               |
  313. //      +                                                               +
  314. //      |                                                               |
  315. //      +---------------------------------------------------------------+
  316. //
  317. //  Mask is the access mask associated with the ACE.  This is either the
  318. //  access allowed, access denied, audit, or alarm mask.
  319. //
  320. //  Sid is the Sid associated with the ACE.
  321. //
  323. //  The following are the four predefined ACE types.
  325. //  Examine the AceType field in the Header to determine
  326. //  which structure is appropriate to use for casting.
  329. typedef struct _ACCESS_ALLOWED_ACE {
  330.     ACE_HEADER Header;
  331.     ACCESS_MASK Mask;
  332.     DWORD SidStart;
  333. } ACCESS_ALLOWED_ACE;
  335. typedef ACCESS_ALLOWED_ACE *PACCESS_ALLOWED_ACE;
  337. typedef struct _ACCESS_DENIED_ACE {
  338.     ACE_HEADER Header;
  339.     ACCESS_MASK Mask;
  340.     DWORD SidStart;
  341. } ACCESS_DENIED_ACE;
  342. typedef ACCESS_DENIED_ACE *PACCESS_DENIED_ACE;
  344. typedef struct _SYSTEM_AUDIT_ACE {
  345.     ACE_HEADER Header;
  346.     ACCESS_MASK Mask;
  347.     DWORD SidStart;
  348. } SYSTEM_AUDIT_ACE;
  349. typedef SYSTEM_AUDIT_ACE *PSYSTEM_AUDIT_ACE;
  351. typedef struct _SYSTEM_ALARM_ACE {
  352.     ACE_HEADER Header;
  353.     ACCESS_MASK Mask;
  354.     DWORD SidStart;
  355. } SYSTEM_ALARM_ACE;
  356. typedef SYSTEM_ALARM_ACE *PSYSTEM_ALARM_ACE;
  359. //
  360. // Minimum length, in bytes, needed to build a security descriptor
  361. // (NOTE: This must manually be kept consistent with the)
  362. // (sizeof(SECURITY_DESCRIPTOR)                         )
  363. //
  365. #define SECURITY_DESCRIPTOR_MIN_LENGTH   (20)
  368. typedef WORD   SECURITY_DESCRIPTOR_CONTROL, *PSECURITY_DESCRIPTOR_CONTROL;
  370. #define SE_OWNER_DEFAULTED               (0x0001)
  371. #define SE_GROUP_DEFAULTED               (0x0002)
  372. #define SE_DACL_PRESENT                  (0x0004)
  373. #define SE_DACL_DEFAULTED                (0x0008)
  374. #define SE_SACL_PRESENT                  (0x0010)
  375. #define SE_SACL_DEFAULTED                (0x0020)
  376. #define SE_SELF_RELATIVE                 (0x8000)
  378. //
  379. //  Where:
  380. //
  381. //      SE_OWNER_DEFAULTED - This boolean flag, when set, indicates that the
  382. //          SID pointed to by the Owner field was provided by a
  383. //          defaulting mechanism rather than explicitly provided by the
  384. //          original provider of the security descriptor.  This may
  385. //          affect the treatment of the SID with respect to inheritence
  386. //          of an owner.
  387. //
  388. //      SE_GROUP_DEFAULTED - This boolean flag, when set, indicates that the
  389. //          SID in the Group field was provided by a defaulting mechanism
  390. //          rather than explicitly provided by the original provider of
  391. //          the security descriptor.  This may affect the treatment of
  392. //          the SID with respect to inheritence of a primary group.
  393. //
  394. //      SE_DACL_PRESENT - This boolean flag, when set, indicates that the
  395. //          security descriptor contains a discretionary ACL.  If this
  396. //          flag is set and the Dacl field of the SECURITY_DESCRIPTOR is
  397. //          null, then a null ACL is explicitly being specified.
  398. //
  399. //      SE_DACL_DEFAULTED - This boolean flag, when set, indicates that the
  400. //          ACL pointed to by the Dacl field was provided by a defaulting
  401. //          mechanism rather than explicitly provided by the original
  402. //          provider of the security descriptor.  This may affect the
  403. //          treatment of the ACL with respect to inheritence of an ACL.
  404. //          This flag is ignored if the DaclPresent flag is not set.
  405. //
  406. //      SE_SACL_PRESENT - This boolean flag, when set,  indicates that the
  407. //          security descriptor contains a system ACL pointed to by the
  408. //          Sacl field.  If this flag is set and the Sacl field of the
  409. //          SECURITY_DESCRIPTOR is null, then an empty (but present)
  410. //          ACL is being specified.
  411. //
  412. //      SE_SACL_DEFAULTED - This boolean flag, when set, indicates that the
  413. //          ACL pointed to by the Sacl field was provided by a defaulting
  414. //          mechanism rather than explicitly provided by the original
  415. //          provider of the security descriptor.  This may affect the
  416. //          treatment of the ACL with respect to inheritence of an ACL.
  417. //          This flag is ignored if the SaclPresent flag is not set.
  418. //
  419. //      SE_SELF_RELATIVE - This boolean flag, when set, indicates that the
  420. //          security descriptor is in self-relative form.  In this form,
  421. //          all fields of the security descriptor are contiguous in memory
  422. //          and all pointer fields are expressed as offsets from the
  423. //          beginning of the security descriptor.  This form is useful
  424. //          for treating security descriptors as opaque data structures
  425. //          for transmission in communication protocol or for storage on
  426. //          secondary media.
  427. //
  428. //
  429. //
  430. // Pictorially the structure of a security descriptor is as follows:
  431. //
  432. //       3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
  433. //       1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
  434. //      +---------------------------------------------------------------+
  435. //      |            Control            |Reserved1 (SBZ)|   Revision    |
  436. //      +---------------------------------------------------------------+
  437. //      |                            Owner                              |
  438. //      +---------------------------------------------------------------+
  439. //      |                            Group                              |
  440. //      +---------------------------------------------------------------+
  441. //      |                            Sacl                               |
  442. //      +---------------------------------------------------------------+
  443. //      |                            Dacl                               |
  444. //      +---------------------------------------------------------------+
  445. //
  446. // In general, this data structure should be treated opaquely to ensure future
  447. // compatibility.
  448. //
  449. //
  451. typedef struct _SECURITY_ATTRIBUTES {
  452.     DWORD nLength;
  453.     LPVOID lpSecurityDescriptor;
  454.     BOOL bInheritHandle;
  455. } SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES;
  457. ////////////////////////////////////////////////////////////////////
  458. //                                                                //
  459. //           Token Object Definitions                             //
  460. //                                                                //
  461. //                                                                //
  462. ////////////////////////////////////////////////////////////////////
  465. //
  466. // Token Specific Access Rights.
  467. //
  469. #define TOKEN_ASSIGN_PRIMARY    (0x0001)
  470. #define TOKEN_DUPLICATE         (0x0002)
  471. #define TOKEN_IMPERSONATE       (0x0004)
  472. #define TOKEN_QUERY             (0x0008)
  473. #define TOKEN_QUERY_SOURCE      (0x0010)
  474. #define TOKEN_ADJUST_PRIVILEGES (0x0020)
  475. #define TOKEN_ADJUST_GROUPS     (0x0040)
  476. #define TOKEN_ADJUST_DEFAULT    (0x0080)
  478. #define TOKEN_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED  |
  479.                           TOKEN_ASSIGN_PRIMARY      |
  480.                           TOKEN_DUPLICATE           |
  481.                           TOKEN_IMPERSONATE         |
  482.                           TOKEN_QUERY               |
  483.                           TOKEN_QUERY_SOURCE        |
  484.                           TOKEN_ADJUST_PRIVILEGES   |
  485.                           TOKEN_ADJUST_GROUPS       |
  486.                           TOKEN_ADJUST_DEFAULT)
  489. #define TOKEN_READ       (STANDARD_RIGHTS_READ      |
  490.                           TOKEN_QUERY)
  493. #define TOKEN_WRITE      (STANDARD_RIGHTS_WRITE     |
  494.                           TOKEN_ADJUST_PRIVILEGES   |
  495.                           TOKEN_ADJUST_GROUPS       |
  496.                           TOKEN_ADJUST_DEFAULT)
  498. #define TOKEN_EXECUTE    (STANDARD_RIGHTS_EXECUTE)
  500. //
  501. //
  502. // Token Types
  503. //
  505. // typedef enum _TOKEN_TYPE {
  506. //     TokenPrimary = 1,
  507. //     TokenImpersonation
  508. //     } TOKEN_TYPE;
  509. // typedef TOKEN_TYPE *PTOKEN_TYPE;
  511. //
  512. // Token Information Classes.
  513. //
  516. // typedef enum _TOKEN_INFORMATION_CLASS {
  517. //     TokenUser = 1,
  518. //     TokenGroups,
  519. //     TokenPrivileges,
  520. //     TokenOwner,
  521. //     TokenPrimaryGroup,
  522. //     TokenDefaultDacl,
  523. //     TokenSource,
  524. //     TokenType,
  525. //     TokenImpersonationLevel,
  526. //     TokenStatistics
  527. // } TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
  529. // typedef struct _TOKEN_USER {
  530. //     SID_AND_ATTRIBUTES User;
  531. // } TOKEN_USER, *PTOKEN_USER;
  533. // typedef struct _TOKEN_GROUPS {
  534. //     DWORD GroupCount;
  535. //     SID_AND_ATTRIBUTES Groups[ANYSIZE_ARRAY];
  536. // } TOKEN_GROUPS, *PTOKEN_GROUPS;
  539. // typedef struct _TOKEN_PRIVILEGES {
  540. //     DWORD PrivilegeCount;
  541. //     LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
  542. // } TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES;
  544. // typedef struct _TOKEN_OWNER {
  545. //     PSID Owner;
  546. // } TOKEN_OWNER, *PTOKEN_OWNER;
  549. // typedef struct _TOKEN_PRIMARY_GROUP {
  550. //     PSID PrimaryGroup;
  551. // } TOKEN_PRIMARY_GROUP, *PTOKEN_PRIMARY_GROUP;
  554. // typedef struct _TOKEN_DEFAULT_DACL {
  555. //     PACL DefaultDacl;
  556. // } TOKEN_DEFAULT_DACL, *PTOKEN_DEFAULT_DACL;
  559. #define TOKEN_SOURCE_LENGTH 8
  561. // typedef struct _TOKEN_SOURCE {
  562. //     CHAR SourceName[TOKEN_SOURCE_LENGTH];
  563. //     LUID SourceIdentifier;
  564. // } TOKEN_SOURCE, *PTOKEN_SOURCE;
  567. // typedef struct _TOKEN_STATISTICS {
  568. //     LUID TokenId;
  569. //     LUID AuthenticationId;
  570. //     LARGE_INTEGER ExpirationTime;
  571. //     TOKEN_TYPE TokenType;
  572. //     SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
  573. //     DWORD DynamicCharged;
  574. //     DWORD DynamicAvailable;
  575. //     DWORD GroupCount;
  576. //     DWORD PrivilegeCount;
  577. //     LUID ModifiedId;
  578. // } TOKEN_STATISTICS, *PTOKEN_STATISTICS;
  581. // typedef struct _TOKEN_CONTROL {
  582. //     LUID TokenId;
  583. //     LUID AuthenticationId;
  584. //     LUID ModifiedId;
  585. //     TOKEN_SOURCE TokenSource;
  586. //     } TOKEN_CONTROL, *PTOKEN_CONTROL;
  589. //
  590. // Data structure used to represent client security context for a thread.
  591. // This data structure is used to support impersonation.
  592. //
  593. //  THE FIELDS OF THIS DATA STRUCTURE SHOULD BE CONSIDERED OPAQUE
  594. //  BY ALL EXCEPT THE SECURITY ROUTINES.
  595. //
  597. // typedef struct _SECURITY_CLIENT_CONTEXT {
  598. //     SECURITY_QUALITY_OF_SERVICE SecurityQos;
  599. //     PACCESS_TOKEN ClientToken;
  600. //     BOOLEAN DirectlyAccessClientToken;
  601. //     BOOLEAN DirectAccessEffectiveOnly;
  602. //     BOOLEAN ServerIsRemote;
  603. //     TOKEN_CONTROL ClientTokenControl;
  604. //     } SECURITY_CLIENT_CONTEXT, *PSECURITY_CLIENT_CONTEXT;
  607. //
  608. // Privileges
  609. //
  610. #define SE_CREATE_TOKEN_NAME              TEXT("SeCreateTokenPrivilege")
  611. #define SE_ASSIGNPRIMARYTOKEN_NAME        TEXT("SeAssignPrimaryTokenPrivilege")
  612. #define SE_LOCK_MEMORY_NAME               TEXT("SeLockMemoryPrivilege")
  613. #define SE_INCREASE_QUOTA_NAME            TEXT("SeIncreaseQuotaPrivilege")
  614. #define SE_UNSOLICITED_INPUT_NAME         TEXT("SeUnsolicitedInputPrivilege")
  615. #define SE_MACHINE_ACCOUNT_NAME           TEXT("SeMachineAccountPrivilege")
  616. #define SE_TCB_NAME                       TEXT("SeTcbPrivilege")
  617. #define SE_SECURITY_NAME                  TEXT("SeSecurityPrivilege")
  618. #define SE_TAKE_OWNERSHIP_NAME            TEXT("SeTakeOwnershipPrivilege")
  619. #define SE_LOAD_DRIVER_NAME               TEXT("SeLoadDriverPrivilege")
  620. #define SE_SYSTEM_PROFILE_NAME            TEXT("SeSystemProfilePrivilege")
  621. #define SE_SYSTEMTIME_NAME                TEXT("SeSystemtimePrivilege")
  622. #define SE_PROF_SINGLE_PROCESS_NAME       TEXT("SeProfileSingleProcessPrivilege")
  623. #define SE_INC_BASE_PRIORITY_NAME         TEXT("SeIncreaseBasePriorityPrivilege")
  624. #define SE_CREATE_PAGEFILE_NAME           TEXT("SeCreatePagefilePrivilege")
  625. #define SE_CREATE_PERMANENT_NAME          TEXT("SeCreatePermanentPrivilege")
  626. #define SE_BACKUP_NAME                    TEXT("SeBackupPrivilege")
  627. #define SE_RESTORE_NAME                   TEXT("SeRestorePrivilege")
  628. #define SE_SHUTDOWN_NAME                  TEXT("SeShutdownPrivilege")
  629. #define SE_DEBUG_NAME                     TEXT("SeDebugPrivilege")
  630. #define SE_AUDIT_NAME                     TEXT("SeAuditPrivilege")
  631. #define SE_SYSTEM_ENVIRONMENT_NAME        TEXT("SeSystemEnvironmentPrivilege")
  632. #define SE_CHANGE_NOTIFY_NAME             TEXT("SeChangeNotifyPrivilege")
  633. #define SE_REMOTE_SHUTDOWN_NAME           TEXT("SeRemoteShutdownPrivilege")
  635. //
  636. // Privilege attributes
  637. //
  638. #define SE_PRIVILEGE_ENABLED_BY_DEFAULT (0x00000001L)
  639. #define SE_PRIVILEGE_ENABLED            (0x00000002L)
  640. #define SE_PRIVILEGE_USED_FOR_ACCESS    (0x80000000L)
  643. //
  644. // SID Manipulation
  645. //
  648. // Win32: IsEqualSid
  649. // BOOLEAN 
  650. // NTAPI 
  651. // RtlEqualSid(
  652. //     PSID Sid1, 
  653. //     PSID Sid2 
  654. //     );
  657. // Win32: GetLengthSid
  658. // ULONG 
  659. // NTAPI 
  660. // RtlLengthSid(
  661. //     PSID Sid 
  662. //     );
  664. // Win32: CopySid
  665. // NTSTATUS 
  666. // NTAPI 
  667. // RtlCopySid(
  668. //     ULONG nDestinationSidLength, 
  669. //     PSID pDestinationSid, 
  670. //     PSID pSourceSid 
  671. //     );
  673. // Win32: AdjustTokenPrivileges
  674. NTSTATUS 
  675. NTAPI 
  676. NtAdjustPrivilegesToken(
  677.     HANDLE TokenHandle, 
  678.     BOOLEAN DisableAllPrivileges, 
  679.     PTOKEN_PRIVILEGES NewState, 
  680.     ULONG BufferLength, 
  681.     PTOKEN_PRIVILEGES PreviousState, 
  682.     PULONG ReturnLength 
  683.     );
  686. //
  687. // Token manipulation
  688. //
  690. // PVOID 
  691. // NTAPI 
  692. // PsReferencePrimaryToken(
  693. //    PEPROCESS Process 
  694. //    );
  697. // PVOID 
  698. // NTAPI 
  699. // PsReferenceImpersonationToken(
  700. //     PETHREAD Thread, 
  701. //     PBOOLEAN CopyOnOpen, 
  702. //     PBOOLEAN EffectiveOnly, 
  703. //     PSECURITY_IMPERSONATION_LEVEL ImpersonationLevel 
  704. //     );
  706. #endif // _NTSEC_