Add stubs for handle duplication auditing and token-based audit checks

xtoskrnl/includes/se/audit.hh

@@ -18,6 +18,11 @@ namespace SE
     class Audit
     {
         public:
+            STATIC XTAPI VOID AuditHandleDuplication(PVOID SourceHandle,
+                                                     PVOID TargetHandle,
+                                                     PEPROCESS SourceProcess,
+                                                     PEPROCESS TargetProcess);
+            STATIC XTFASTCALL BOOLEAN AuditWithToken(IN PACCESS_TOKEN AccessToken);
             STATIC XTAPI VOID OperationAuditAlarm(IN PUNICODE_STRING SubsystemName,
                                                   IN PVOID HandleId,
                                                   IN PUNICODE_STRING ObjectTypeName,

xtoskrnl/se/audit.cc

@@ -9,6 +9,55 @@
 #include <xtos.hh>
 
 
+/**
+ * Generates a security audit event for an object handle duplication.
+ *
+ * @param SourceHandle
+ *        Supplies the original handle identifier as it exists in the source process.
+ *
+ * @param TargetHandle
+ *        Supplies the newly created handle identifier as it exists in the target process.
+ *
+ * @param SourceProcess
+ *        Supplies a pointer to the executive process originating the duplication.
+ *
+ * @param TargetProcess
+ *        Supplies a pointer to the executive process receiving the duplicated handle.
+ *
+ * @return This routine does not return any value.
+ *
+ * @since XT 1.0
+ */
+XTAPI
+VOID
+SE::Audit::AuditHandleDuplication(PVOID SourceHandle,
+                                  PVOID TargetHandle,
+                                  PEPROCESS SourceProcess,
+                                  PEPROCESS TargetProcess)
+{
+    UNIMPLEMENTED;
+}
+
+/**
+ * Determines whether detailed security auditing is enabled for a specific token.
+ *
+ * @param AccessToken
+ *        Supplies an optional pointer to the access token to be evaluated.
+ *
+ * @return This routine returns TRUE if auditing is required, or FALSE otherwise.
+ *
+ * @since XT 1.0
+ */
+XTFASTCALL
+BOOLEAN
+SE::Audit::AuditWithToken(IN PACCESS_TOKEN AccessToken)
+{
+    UNIMPLEMENTED;
+
+    /* Bypass audit generation */
+    return FALSE;
+}
+
 /**
  * Generates a security audit alarm for an object access operation.
  *