Add security access and audit interfaces

xtoskrnl/se/access.cc

@@ -0,0 +1,54 @@
+/**
+ * PROJECT:         ExectOS
+ * COPYRIGHT:       See COPYING.md in the top level directory
+ * FILE:            xtoskrnl/se/access.cc
+ * DESCRIPTION:     Security access state check routines
+ * DEVELOPERS:      Aiken Harris <harraiken91@gmail.com>
+ */
+
+#include <xtos.hh>
+
+
+/**
+ * Computes the access rights that are requested but not granted.
+ *
+ * @param GrantedAccessMask
+ *        Supplies the mask of access rights currently granted to the subject.
+ *
+ * @param DesiredAccessMask
+ *        Supplies the mask of access rights requested by the subject.
+ *
+ * @return This routine returns an access mask with the bits in DesiredAccess that are not present in GrantedAccess.
+ *
+ * @since XT 1.0
+ */
+XTFASTCALL
+ACCESS_MASK
+SE::Access::ComputeDeniedAccesses(IN ACCESS_MASK GrantedAccessMask,
+                                  IN ACCESS_MASK DesiredAccessMask)
+{
+    /* Return the desired denied accesses */
+    return ~GrantedAccessMask & DesiredAccessMask;
+}
+
+/**
+ * Computes the access rights that are both requested and granted.
+ *
+ * @param GrantedAccessMask
+ *        Supplies the mask of access rights currently granted to the subject.
+ *
+ * @param DesiredAccessMask
+ *        Supplies the mask of access rights requested by the subject.
+ *
+ * @return This routine returns an access mask containing the intersection of DesiredAccess and GrantedAccess bits.
+ *
+ * @since XT 1.0
+ */
+XTFASTCALL
+ACCESS_MASK
+SE::Access::ComputeGrantedAccesses(IN ACCESS_MASK GrantedAccessMask,
+                                   IN ACCESS_MASK DesiredAccessMask)
+{
+    /* Return the desired granted accesses */
+    return GrantedAccessMask & DesiredAccessMask;
+}

xtoskrnl/se/audit.cc

@@ -0,0 +1,43 @@
+/**
+ * PROJECT:         ExectOS
+ * COPYRIGHT:       See COPYING.md in the top level directory
+ * FILE:            xtoskrnl/se/audit.cc
+ * DESCRIPTION:     Security Auditing
+ * DEVELOPERS:      Aiken Harris <harraiken91@gmail.com>
+ */
+
+#include <xtos.hh>
+
+
+/**
+ * Generates a security audit alarm for an object access operation.
+ *
+ * @param SubsystemName
+ *        Supplies the name of the subsystem triggering the audit alarm.
+ *
+ * @param HandleId
+ *        Supplies the handle or identifier of the object being accessed.
+ *
+ * @param ObjectTypeName
+ *        Supplies the name of the object type being accessed.
+ *
+ * @param AccessMask
+ *        Supplies the access mask containing the specific rights that triggered the audit.
+ *
+ * @param UserSid
+ *        Optionally supplies the SID of the user initiating the operation.
+ *
+ * @return This routine does not return any value.
+ *
+ * @since XT 1.0
+ */
+XTAPI
+VOID
+SE::Audit::OperationAuditAlarm(IN PUNICODE_STRING SubsystemName,
+                               IN PVOID HandleId,
+                               IN PUNICODE_STRING ObjectTypeName,
+                               IN ACCESS_MASK AccessMask,
+                               IN PSID UserSid)
+{
+    UNIMPLEMENTED;
+}

xtoskrnl/se/descript.cc

@@ -101,7 +101,7 @@ SE::Descriptor::ComputeQuotaInformationSize(IN PSECURITY_DESCRIPTOR SecurityDesc
 * @param ProcessorMode
 *        Supplies the processor mode that was originally used to capture the descriptor.
 *
-* @param ForceRelease
+* @param Force
 *        Supplies a boolean value indicating whether to force the deallocation.
 *
 * @return This routine does not return any value.
@@ -112,10 +112,10 @@ XTAPI
 VOID
 SE::Descriptor::ReleaseSecurityDescriptor(IN PSECURITY_DESCRIPTOR Descriptor,
                                           IN KPROCESSOR_MODE ProcessorMode,
-                                          IN BOOLEAN ForceRelease)
+                                          IN BOOLEAN Force)
 {
     /* Check if the descriptor should be released */
-    if(((ProcessorMode == KernelMode) && (ForceRelease == TRUE)) || (ProcessorMode == UserMode))
+    if(((ProcessorMode == KernelMode) && (Force == TRUE)) || (ProcessorMode == UserMode))
     {
         /* Ensure the descriptor is valid */
         if(Descriptor)