🚀 go-pugleaf

Andrue Cope wrote:

>Hiya,

Hey m8.

>problem is that when I call AccessCheck() it always indicates that I
>have no permission to do anything. More oddly it indicates that it
>determined this without reference to any privilege
>(PRIVILEGE_SET.PrivilegeCount is zero).

I'm sorry I have no experience in this, but reading the doc on
AccessCheck, it looks like it would be extreemely easy to not get the
parameters right.

From this:
"...receives the privileges used to perform the access validation. If
no privileges were used... "
It sounds like it didn't need to *use* any privilage sets to answer
the querry. Maybe because the question didn't actually ask anything?

Perhaps some actual code would help others rule that out?

Bob Gonder wrote:

> I'm sorry I have no experience in this, but reading the doc on
> AccessCheck, it looks like it would be extreemely easy to not get the
> parameters right.
> 
> From this:
> "...receives the privileges used to perform the access validation. If
> no privileges were used... "
> It sounds like it didn't need to use any privilage sets to answer
> the querry. Maybe because the question didn't actually ask anything?
> 
> Perhaps some actual code would help others rule that out?

Yeah that's possible I suppose. It's certainly not obvious what I
should be asking for and what GENERIC_MAPPING should be.

From my manual traversal of the ACL I can see that the single ACE has
permissions of 0x20003 and so I've tried asking for that, for 0x3 and
for 0x20000 but with no luck. I think that if I don't create the
correct GENERIC_MAPPING structure it could go wrong there as well.

Unfortunately it's not entirely clear how one goes about populating
that structure. I can see why something like it is needed but that's
not the same as knowing how to populate it :-/

Unfortunately for our application we can't just try to open the
mailbox. We are effectively doing that ourselves and are just trying to
provide the same level of security that Outlook does.

I seem to have wandered into an area of Windows that no-one knows
anything much about which is always fun :)
-- 
Andrue Cope
[Bicester, Uk]
http://info.borland.com/newsgroups/guide.html

Andrue Cope wrote:

>> Perhaps some actual code would help others rule that out?
>
>Yeah that's possible I suppose. It's certainly not obvious what I
>should be asking for and what GENERIC_MAPPING should be.
>
>From my manual traversal of the ACL I can see that the single ACE has
>permissions of 0x20003 and so I've tried asking for that, for 0x3 and

0x00 02 00 03
Specific Rights == 3
Standard rights == READ_CONTROL
GenericRights == 0

So perhaps

     GENERIC_MAPPING   gm = { 0x20003, 0, 0, 0x20003 };
     DWORD   AccessMask = GENERIC_READ;
     MapGenericMask( &AccessMask, &gm );

As I read this, GENERIC_READ causes MapGenericMask to copy GenericRead
from gm, so we should be able to skip that part and just use
     DWORD   AccessMask =  0x20003;
Unless we are supposed to be getting GENERIC_MAPPING from the system?

     AccessCheck( something, something, AccessMask, &gm, etc.

One wonders why you need to call MapGenericMask if you are going to be
passing gm anyway.


Are you doing this for some files at driver level? If so, look at
http://msdn2.microsoft.com/en-us/library/aa490870.aspx
GENERIC_MAPPING*   IoGetFileObjectGenericMapping(void);

Here's an example of using AcessCheck

Date: Tue, 23 May 2006 18:16:05 -0400
From: Colin B Maharaj
Newsgroups: borland.public.cppbuilder.nativeapi
Subject: Re: WHat is my account type
References: <lko372tv8d3pmfa8aljurjaqc4st3e5g9n@4ax.com>
Message-ID: <447389a3@newsgroups.borland.com>

An older message that looks similar

From: "Stephane Baillargeon"
Newsgroups: borland.public.cppbuilder.winapi
Subject: RE:Administrator priviliges
Date: Fri, 18 Jan 2002 17:17:10 -0500
Message-ID: <3c489efd_2@dnews>
Xref: dnews borland.public.cppbuilder.winapi:52777

Go to Google/More/Groups and search on the Message-ID

http://groups.google.com/group/borland.public.cppbuilder.nativeapi/browse_thread/thread/283096f94514b8ce

http://groups.google.com/group/borland.public.cppbuilder.winapi/browse_thread/thread/c3cf04a2b1ba722c

Bob Gonder wrote:

> As I read this, GENERIC_READ causes MapGenericMask to copy GenericRead
> from gm, so we should be able to skip that part and just use
>      DWORD   AccessMask =  0x20003;
> Unless we are supposed to be getting GENERIC_MAPPING from the system?
> 
>      AccessCheck( something, something, AccessMask, &gm, etc.
> 
> One wonders why you need to call MapGenericMask if you are going to be
> passing gm anyway.

I think I've tried it with and without.

If you want to play around with it (and I suppose it has educational
value concerning LDAP <g>) I've uploaded a BCB6 project
'AccessCheck.zip'. You'll need to change main() to use your login and
domain details and you'll need to be running MS Exchange though unless
you want to try for some other permission.
-- 
Andrue Cope
[Bicester, Uk]
http://info.borland.com/newsgroups/guide.html

Andrue Cope wrote:

>I think I've tried it with and without.

First thing I've noticed is that as soon as you hit

        while(pAttribute != NULL)

All returns leave the Connection Bound, and values allocated.

	TOKEN_READ|TOKEN_QUERY,

Note that TOKEN_READ includes TOKEN_QUERY

You call it  clientToken, but it is a process token (TRUE == process)

	if(!ConvertSidToStringSidW(ownerInfo->Owner, &ourSid))
	{
		delete[] ourSid;

Doesn't look right, should be LocalFree, or better yet, nothing
Also, you never use it nor  LocalFree( ourSid )   it.

The links I gave last night mention (among other things)

      // AccessCheck is sensitive about what is in the SD; set
      // the group and owner.
      SetSecurityDescriptorGroup(psdAdmin, psidAdmin, FALSE);
      SetSecurityDescriptorOwner(psdAdmin, psidAdmin, FALSE);

      dwAccessDesired = FM_ACCESS_READ;
      // Initialize GenericMapping structure even though we
      // won't be using generic rights.
      GenericMapping.GenericRead    = FM_ACCESS_READ;
      GenericMapping.GenericWrite   = FM_ACCESS_WRITE;
      GenericMapping.GenericExecute = 0;
      GenericMapping.GenericAll     = FM_ACCESS_READ |
FM_ACCESS_WRITE;

      if (!AccessCheck(psdAdmin, hToken, dwAccessDesired,
  
>If you want to play around with it (and I suppose it has educational
>value concerning LDAP <g>) I've uploaded a BCB6 project
>'AccessCheck.zip'. You'll need to change main() to use your login and
>domain details and you'll need to be running MS Exchange though unless
>you want to try for some other permission.

I don't think I have login and domain details, nor MS Exchange
(XPHome). No idea what to change to be meaningfull on my system.

Bob Gonder wrote:

> First thing I've noticed is that as soon as you hit
> 
>         while(pAttribute != NULL)
> 
> All returns leave the Connection Bound, and values allocated.

Doesn't surprise me. This is proof of concept code mostly grabbed from
the Web and hacked around a lot. That's the trouble with example code
from the web - it is nearly all ugly, poorly written stuff frequently
using hungarian notation.

So fear not - I already have plans to convert it to a nice RAII class
based solution but I first want to get it working :)

>       // AccessCheck is sensitive about what is in the SD; set
>       // the group and owner.
>       SetSecurityDescriptorGroup(psdAdmin, psidAdmin, FALSE);
>       SetSecurityDescriptorOwner(psdAdmin, psidAdmin, FALSE);

Aye but that example is /creating/ a DACL. I got my DACL from Active
Directory so I shouldn't be modifying it.

> I don't think I have login and domain details, nor MS Exchange
> (XPHome). No idea what to change to be meaningfull on my system.

Ah. You'd need to find another DACL attribute within the Active
Directory that you could query.
-- 
Andrue Cope
[Bicester, Uk]
http://info.borland.com/newsgroups/guide.html

Actually I just had a thought. The ACL contains an entry with
NT_AUTHORITY/SELF which seems to be a reference meaning 'the SID to
which this ACL belongs'. AccessCheck() has no way of resolving that and
therefore probably just compares it to the user SID which will fail.

It looks like I might have to fix up the DACL before I can query it.

-- 
Andrue Cope
[Bicester, Uk]
http://info.borland.com/newsgroups/guide.html

Success!

The answer /was/ to fix up that SID and now everything seems good.
Apart from the source code, lol.

Thanks for all your help :)

-- 
Andrue Cope
[Bicester, Uk]
http://info.borland.com/newsgroups/guide.html

Andrue Cope wrote:

>Thanks for all your help :)

np. Beats mining Veldspar

Bob Gonder <notbg@notmindspring.invalid> wrote:

>np. Beats mining Veldspar

Is that beyond the Dark Portal?

Alan Bellingham
-- 
ACCU Conference 2006 - 19-22 April, Randolph Hotel, Oxford, UK

Alan Bellingham <alanb@episys.com> wrote:

>-- 
>ACCU Conference 2006 - 19-22 April, Randolph Hotel, Oxford, UK

Oh my, that signature is really out of date, since I'm sitting in a
panel on concepts a year later, at a different hotel.

Alan Bellingham wrote:

>Is that beyond the Dark Portal?

Eve.
Andrue turned me onto it back in '05

Bob Gonder wrote:

> > Thanks for all your help :)
> 
> np. Beats mining Veldspar

So do a lot of things :)

L4 missions for me right now.

-- 
Andrue Cope
[Bicester, Uk]
http://info.borland.com/newsgroups/guide.html