From b33b6b2131c5b9f72b567b830cba94a70e6b6114 Mon Sep 17 00:00:00 2001
From: Aiken Harris <harraiken91@gmail.com>
Date: Tue, 18 Aug 2026 23:18:12 +0200
Subject: [PATCH] Implement privilege check functions

---
 xtoskrnl/includes/se/privileg.hh | 10 +++++
 xtoskrnl/se/privileg.cc          | 75 ++++++++++++++++++++++++++++++++
 2 files changed, 85 insertions(+)

diff --git a/xtoskrnl/includes/se/privileg.hh b/xtoskrnl/includes/se/privileg.hh
index 0cebb56..ded58e0 100644
--- a/xtoskrnl/includes/se/privileg.hh
+++ b/xtoskrnl/includes/se/privileg.hh
@@ -19,8 +19,18 @@ namespace SE
     {
 
         public:
+            STATIC XTAPI BOOLEAN CheckPrivilege(IN OUT PPRIVILEGE_SET RequiredPrivileges,
+                                                IN PSECURITY_SUBJECT_CONTEXT SecurityContext,
+                                                IN KPROCESSOR_MODE ProcessorMode);
             STATIC XTAPI BOOLEAN CheckSinglePrivilege(LUID PrivilegeValue,
                                                       KPROCESSOR_MODE ProcessorMode);
+
+        private:
+            STATIC XTAPI BOOLEAN CheckPrivilege(IN PTOKEN Token,
+                                                IN OUT PLUID_AND_ATTRIBUTES Privileges,
+                                                IN ULONG PrivilegeCount,
+                                                IN ULONG PrivilegeSet,
+                                                IN KPROCESSOR_MODE ProcessorMode);
     };
 }
 
diff --git a/xtoskrnl/se/privileg.cc b/xtoskrnl/se/privileg.cc
index cdcfa6c..1ed8113 100644
--- a/xtoskrnl/se/privileg.cc
+++ b/xtoskrnl/se/privileg.cc
@@ -9,6 +9,81 @@
 #include <xtos.hh>
 
 
+/**
+ * Performs a privilege check against a specific access token.
+ *
+ * @param Token
+ *        Supplies a pointer to the access token being queried.
+ *
+ * @param Privileges
+ *        Supplies a pointer to an array of privileges and their attributes.
+ *
+ * @param PrivilegeCount
+ *        Supplies the number of privileges in the array.
+ *
+ * @param PrivilegeSet
+ *        Supplies the control flags specifying how the privileges are evaluated.
+ *
+ * @param ProcessorMode
+ *        Supplies the processor mode from which the request originated.
+ *
+ * @return This routine returns TRUE if the required privileges are held, or FALSE otherwise.
+ *
+ * @since XT 1.0
+ */
+XTAPI
+BOOLEAN
+SE::Privileges::CheckPrivilege(IN PTOKEN Token,
+                               IN OUT PLUID_AND_ATTRIBUTES Privileges,
+                               IN ULONG PrivilegeCount,
+                               IN ULONG PrivilegeSet,
+                               IN KPROCESSOR_MODE ProcessorMode)
+{
+    UNIMPLEMENTED;
+
+    /* Return TRUE */
+    return TRUE;
+}
+
+/**
+ * Checks whether the specified privileges are held by the security context.
+ *
+ * @param RequiredPrivileges
+ *        Supplies a pointer to the privilege set that specifies the privileges to check.
+ *
+ * @param SecurityContext
+ *        Supplies a pointer to the security subject context representing the caller.
+ *
+ * @param ProcessorMode
+ *        Supplies the processor mode of the caller.
+ *
+ * @return This routine returns TRUE if the required privileges are held, or FALSE otherwise.
+ *
+ * @since XT 1.0
+ */
+XTAPI
+BOOLEAN
+SE::Privileges::CheckPrivilege(IN OUT PPRIVILEGE_SET RequiredPrivileges,
+                               IN PSECURITY_SUBJECT_CONTEXT SecurityContext,
+                               IN KPROCESSOR_MODE ProcessorMode)
+{
+    PACCESS_TOKEN Token;
+
+    /* Verify that an existing client token has a sufficient impersonation level */
+    if((SecurityContext->ClientToken != NULLPTR) && (SecurityContext->ImpersonationLevel < SecurityImpersonation))
+    {
+        /* The impersonation level is too low to perform privilege checks, return FALSE */
+        return FALSE;
+    }
+
+    /* Select the effective access token based on the presence of a client impersonation token */
+    Token = SecurityContext->ClientToken ? SecurityContext->ClientToken : SecurityContext->PrimaryToken;
+
+    /* Dispatch the privilege check and return the result */
+    return CheckPrivilege((PTOKEN)Token, RequiredPrivileges->Privilege, RequiredPrivileges->PrivilegeCount,
+                          RequiredPrivileges->Control, ProcessorMode);
+}
+
 /**
 * Checks if the current thread's access token holds a specific privilege.
 *