private void btnOK_Click(object sender, EventArgs e)
{
bool success = false;
try
{
Sid = new Sid(textBoxSid.Text);
success = true;
}
catch (Exception)
{
}
if (!success)
{
try
{
Sid = NtSecurity.LookupAccountName(textBoxSid.Text);
success = true;
}
catch (Exception ex)
{
MessageBox.Show(this, ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
}
}
if (success)
{
DialogResult = DialogResult.OK;
Close();
}
}
/// <summary>
/// Constructor from existing Sid.
/// </summary>
/// <param name="sid">The existing Sid.</param>
public Sid(Sid sid) : this(sid.Authority, sid.SubAuthorities.ToArray())
{
}
/// <summary>
/// Constructor from existing SID.
/// </summary>
/// <param name="sid">The SID.</param>
/// <param name="defaulted">Whether the SID was defaulted or not.</param>
public SecurityDescriptorSid(Sid sid, bool defaulted)
{
Sid = sid;
Defaulted = defaulted;
}
/// <summary>
/// Add mandatory integrity label to SACL
/// </summary>
/// <param name="label">The integrity label SID</param>
/// <param name="flags">The ACE flags.</param>
/// <param name="policy">The mandatory label policy</param>
public void AddMandatoryLabel(Sid label, AceFlags flags, MandatoryLabelPolicy policy)
{
if (Sacl == null)
{
Sacl = new Acl();
}
Sacl.NullAcl = false;
Sacl.Add(new Ace(AceType.MandatoryLabel, flags, (uint)policy, label));
}
private void AddAccessDeniedAceInternal(uint mask, AceFlags flags, Sid sid)
{
AddAce(AceType.Denied, mask, flags, sid);
}
/// <summary>
/// Add an access denied ACE to the DACL
/// </summary>
/// <param name="mask">The access mask</param>
/// <param name="flags">The ACE flags</param>
/// <param name="sid">The SID</param>
public void AddAccessDeniedAce(uint mask, AceFlags flags, Sid sid)
{
AddAccessDeniedAceInternal(mask, flags, sid);
}
/// <summary>
/// Add an access denied ACE to the DACL
/// </summary>
/// <param name="mask">The access mask</param>
/// <param name="sid">The SID</param>
public void AddAccessDeniedAce(GenericAccessRights mask, Sid sid)
{
AddAccessDeniedAceInternal((uint)mask, AceFlags.None, sid);
}
internal void Serialize(BinaryWriter writer)
{
byte[] sid_data = Sid.ToArray();
if (Type == AceType.AllowedCompound)
{
MemoryStream stm = new MemoryStream();
BinaryWriter sidwriter = new BinaryWriter(stm);
sidwriter.Write((int)CompoundAceType.Impersonation);
sidwriter.Write(ServerSid.ToArray());
sidwriter.Write(sid_data);
sid_data = stm.ToArray();
}
int total_length = 4 + 4 + sid_data.Length;
if (ApplicationData != null)
{
total_length += ApplicationData.Length;
}
// Add a round up to 4 byte alignment.
int padding = 4 - (total_length % 4);
if (padding == 4)
{
padding = 0;
}
total_length += padding;
ObjectAceFlags flags = ObjectAceFlags.None;
if (IsObjectAce)
{
// For Flags
total_length += 4;
if (ObjectType.HasValue)
{
total_length += 16;
flags |= ObjectAceFlags.ObjectTypePresent;
}
if (InheritedObjectType.HasValue)
{
total_length += 16;
flags |= ObjectAceFlags.InheritedObjectTypePresent;
}
}
if (total_length > ushort.MaxValue)
{
throw new ArgumentOutOfRangeException("Total ACE length greater than maximum");
}
writer.Write((byte)Type);
writer.Write(MapFromFlags(Type, Flags));
writer.Write((ushort)total_length);
writer.Write(Mask.Access);
if (IsObjectAce)
{
writer.Write((uint)flags);
if (ObjectType.HasValue)
{
writer.Write(ObjectType.Value.ToByteArray());
}
if (InheritedObjectType.HasValue)
{
writer.Write(InheritedObjectType.Value.ToByteArray());
}
}
writer.Write(sid_data);
writer.Write(ApplicationData ?? new byte[0]);
if (padding != 0)
{
writer.Write(new byte[padding]);
}
}
/// <summary>
/// Add an access allowed ACE to the DACL
/// </summary>
/// <param name="mask">The access mask</param>
/// <param name="flags">The ACE flags</param>
/// <param name="sid">The SID</param>
public void AddAccessAllowedAce(GenericAccessRights mask, AceFlags flags, Sid sid)
{
AddAccessAllowedAceInternal((uint)mask, flags, sid);
}
private void AddAce(AceType type, uint mask, AceFlags flags, Sid sid)
{
if (Dacl == null)
{
Dacl = new Acl();
}
Dacl.NullAcl = false;
Dacl.Add(new Ace(type, flags, mask, sid));
}
/// <summary>
/// Add a list of SIDs to the boundary descriptor.
/// </summary>
/// <param name="sid">The first SID to add</param>
/// <param name="sids">Additional SIDs</param>
public void AddSids(Sid sid, params Sid[] sids)
{
AddSids(new Sid[] { sid }.Concat(sids));
}
/// <summary>
/// Add a SID to the boundary descriptor.
/// </summary>
/// <remarks>This SID is used in an access check when creating or deleting private namespaces.</remarks>
/// <param name="sid">The SID to add.</param>
public void AddSid(Sid sid)
{
using (SafeSidBufferHandle sid_buffer = sid.ToSafeBuffer()) {
NtRtl.RtlAddSIDToBoundaryDescriptor(ref _boundary_descriptor, sid_buffer).ToNtException();
}
}
private void AddIntegrityLevel(Sid sid)
{
using (SafeSidBufferHandle sid_buffer = sid.ToSafeBuffer()) {
NtRtl.RtlAddIntegrityLabelToBoundaryDescriptor(ref _boundary_descriptor, sid_buffer).ToNtException();
}
}
/// <summary>
/// Get hash code.
/// </summary>
/// <returns>The hash code</returns>
public override int GetHashCode()
{
return(Type.GetHashCode() ^ Flags.GetHashCode() ^ Mask.GetHashCode()
^ Sid.GetHashCode() ^ ObjectType.GetHashCode() ^ InheritedObjectType.GetHashCode()
^ ServerSid?.GetHashCode() ?? 0 ^ NtObjectUtils.GetHashCodeByteArray(ApplicationData));
}
/// <summary>
/// Compares two sids to see if their prefixes are the same.
/// </summary>
/// <param name="sid">The sid to compare against</param>
/// <returns>True if the sids share a prefix.</returns>
public bool EqualPrefix(Sid sid)
{
using (SafeSidBufferHandle sid1 = ToSafeBuffer(), sid2 = sid.ToSafeBuffer())
{
return NtRtl.RtlEqualPrefixSid(sid1, sid2);
}
}
/// <summary>
/// Add an access allowed ACE to the DACL
/// </summary>
/// <param name="mask">The access mask</param>
/// <param name="sid">The SID</param>
public void AddAccessAllowedAce(uint mask, Sid sid)
{
AddAccessAllowedAceInternal((uint)mask, AceFlags.None, sid);
}
/// <summary>
/// Process record.
/// </summary>
protected override void ProcessRecord()
{
Sid sid;
switch (ParameterSetName)
{
case "sddl":
sid = new Sid(Sddl);
break;
case "name":
sid = NtSecurity.LookupAccountName(Name);
break;
case "service":
sid = NtSecurity.GetServiceSid(ServiceName);
break;
case "il":
sid = NtSecurity.GetIntegritySid(IntegrityLevel);
break;
case "il_raw":
sid = NtSecurity.GetIntegritySidRaw(IntegrityLevelRaw);
break;
case "package":
sid = TokenUtils.DerivePackageSidFromName(PackageName);
if (RestrictedPackageName != null)
{
sid = TokenUtils.DeriveRestrictedPackageSidFromSid(sid, RestrictedPackageName);
}
break;
case "known":
sid = KnownSids.GetKnownSid(KnownSid);
break;
case "token":
using (NtToken token = NtToken.OpenProcessToken())
{
if (PrimaryGroup)
{
sid = token.PrimaryGroup;
}
else if (Owner)
{
sid = token.Owner;
}
else if (LogonGroup)
{
sid = token.LogonSid.Sid;
}
else if (AppContainer)
{
sid = token.AppContainerSid;
}
else if (Label)
{
sid = token.IntegrityLevelSid.Sid;
}
else
{
sid = token.User.Sid;
}
}
break;
case "cap":
sid = CapabilityGroup ? NtSecurity.GetCapabilityGroupSid(CapabilityName)
: NtSecurity.GetCapabilitySid(CapabilityName);
break;
case "sid":
sid = new Sid(SecurityAuthority, RelativeIdentifiers);
break;
default:
throw new ArgumentException("No SID type specified");
}
WriteObject(sid);
}