sd.c revision 7e7bd3dccbfe8f79e25e5c1554b5bc3a9aaca321
#include "types.h"
#include "layout.h"
#include "sd.h"
/**
* init_system_file_sd -
*
* NTFS 3.1 - System files security decriptors
* =====================================================
*
* Create the security descriptor for system file number @sys_file_no and
* return a pointer to the descriptor.
*
* Note the root directory system file (".") is very different and handled by a
* different function.
*
* The sd is returned in *@sd_val and has length *@sd_val_len.
*
* Do NOT free *@sd_val as it is static memory. This also means that you can
* only use *@sd_val until the next call to this function.
*/
{
if (sys_file_no < 0) {
*sd_val_len = 0;
return;
}
*sd_val_len = 0x64;
/*
* Now at offset 0x14, as specified in the security descriptor, we have
* the DACL.
*/
acl->alignment1 = 0;
/*
* Now at offset 0x1c, just after the DACL's ACL, we have the first
* ACE of the DACL. The type of the ACE is access allowed.
*/
switch (sys_file_no) {
case FILE_AttrDef:
case FILE_Boot:
break;
default:
break;
}
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
/*
* Now at offset 0x30 within security descriptor, just after the first
* ACE of the DACL. All system files, except the root directory, have
* a second ACE.
*/
/* The second ACE of the DACL. Type is access allowed. */
/* Only $AttrDef and $Boot behave differently to everything else. */
switch (sys_file_no) {
case FILE_AttrDef:
case FILE_Boot:
break;
default:
break;
}
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
/*
* Now at offset 0x48 into the security descriptor, as specified in the
* security descriptor, we now have the owner SID.
*/
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
/*
* Now at offset 0x54 into the security descriptor, as specified in the
* security descriptor, we have the group SID.
*/
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
}
/**
* init_root_sd -
*
* Creates the security_descriptor for the root folder on ntfs 3.1 as created
* by Windows Vista (when the format is done from the disk management MMC
* snap-in, note this is different from the format done from the disk
* properties in Windows Explorer).
*/
{
static char sd_array[0x102c];
*sd_val_len = 0x102c;
//security descriptor relative
//acl
acl->alignment1 = 0;
acl->alignment2 = 0;
//ace1
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//ace2
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//ace3
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//ace4
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//ace5
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//ace6
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//ace7
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//ace8
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//owner sid
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//group sid
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
}
/**
* init_secure_sds -
*
* NTFS 3.1 - System files security decriptors
* ===========================================
* Create the security descriptor entries in $SDS data stream like they
* are in a partition, newly formatted with windows 2003
*/
void init_secure_sds(char *sd_val)
{
/*
* security descriptor #1
*/
//header
//security descriptor relative
sizeof(SECURITY_DESCRIPTOR_HEADER));
//acl
//ace1
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//ace2
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//owner sid
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
sid->sub_authority[0] =
//group sid
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
sid->sub_authority[0] =
/*
* security descriptor #2
*/
//header
//security descriptor relative
sizeof(SECURITY_DESCRIPTOR_HEADER));
//acl
//ace1
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//ace2
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
//owner sid
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
sid->sub_authority[0] =
//group sid
/* SECURITY_NT_SID_AUTHORITY (S-1-5) */
sid->sub_authority[0] =
return;
}