无法使用SACl将ACE添加到核心对象的SetKernelObjectSecurity中

Question

编辑1

在这里，我使用的文件句柄是来自system32目录的DLL文件。

我也试着做了以下几件事：

使用SACL_SECURITY_INFORMATION

• I代替LABEL_SECURITY_INFORMATION的

1. 尝试使用hr = SetSecurityInfo(hFile, SE_KERNEL_OBJECT, LABEL_SECURITY_INFORMATION, NULL, NULL, NULL, pNewSACL);来设置SACl而不是SetSecurityDescriptorSacl和SetKernelObjectSecurity

原创

我试图将审核ACE添加到内核安全对象中，并删除所有现有的ACE。因此，我可以通过参考互联网上的文档和其他帖子，得出以下代码。最后，我能够在没有错误的情况下运行SetKernelObjectSecurity，但是当我再次尝试验证是否添加了ACE时，我看到ACE计数为0。到现在为止，我被困在这一点上。如果有人能帮助我正确地改变内核对象SACl中的ACE，那就太好了。

谢谢。

以下是代码的简要概述：

您可以看到有5 Sections

• SECTION 1:创建handle

• SECTION 2:获取内核对象安全性和pOldSacl

• SECTION 3:从oldSACL

• SECTION 4创建newSACL :将newSACL添加到内核对象security

• SECTION 5:验证如果SACL为updated

• Aside，则有5个// NOTE标记，显示各个点的ace计数值

守则如下：

void setAceAudit()
{
    DWORD dwRes = 0;
    PACL pOldSACL = NULL, pNewSACL = NULL;
    PSECURITY_DESCRIPTOR pSS = NULL;
    EXPLICIT_ACCESS ea;

    HANDLE  hFile = NULL;

// SECTION 1: Create handle

    hFile = CreateFile2(filePath,
        FILE_GENERIC_EXECUTE | FILE_GENERIC_READ | FILE_GENERIC_WRITE | READ_CONTROL | WRITE_OWNER | ACCESS_SYSTEM_SECURITY,
        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
        OPEN_EXISTING,
        nullptr);

    if (hFile == INVALID_HANDLE_VALUE && GetLastError() == ERROR_ACCESS_DENIED)
    {
        // A directory will fail without FILE_FLAG_BACKUP_SEMANTICS.
        CREATEFILE2_EXTENDED_PARAMETERS extendedParams = {
            sizeof(CREATEFILE2_EXTENDED_PARAMETERS),
            FILE_ATTRIBUTE_NORMAL,
            FILE_FLAG_BACKUP_SEMANTICS,
            0,
            nullptr,
            nullptr
        };
        hFile = CreateFile2(filePath,
            FILE_GENERIC_EXECUTE | FILE_GENERIC_READ | FILE_GENERIC_WRITE | READ_CONTROL | WRITE_OWNER | ACCESS_SYSTEM_SECURITY,
            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
            OPEN_EXISTING,
            &extendedParams);
    }

// SECTION 1: End
// SECTION 2: Get Kernel object security and pOldSacl

    DWORD                dwSize = 0;
    HRESULT hr = S_OK;
    if (!GetKernelObjectSecurity(hFile, LABEL_SECURITY_INFORMATION, pSS, dwSize, &dwSize))
    {
        DWORD dwError = GetLastError();

        if (ERROR_INSUFFICIENT_BUFFER != dwError)
        {
            hr = HRESULT_FROM_WIN32(dwError);
        }
        else if (NULL == (pSS = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, dwSize)))
        {
            hr = E_OUTOFMEMORY;
        }
        else if (!GetKernelObjectSecurity(hFile, LABEL_SECURITY_INFORMATION, pSS, dwSize, &dwSize))
        {
            hr = HRESULT_FROM_WIN32(GetLastError());
        }
    }
    else
    {
        hr = E_UNEXPECTED;
    }

    VERIFY_ARE_EQUAL(hr, S_OK);

    
    BOOL bSaclPresent = FALSE;
    BOOL bSaclDefaulted = FALSE;

    if (!GetSecurityDescriptorSacl(pSS, &bSaclPresent, &pOldSACL, &bSaclDefaulted))
    {
        hr = HRESULT_FROM_WIN32(GetLastError());
    }

// SECTION 2: End
// SECTION 3: Create newSACL from oldSACL

    ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
    ea.grfAccessPermissions = 0X11000000;
    ea.grfAccessMode = SET_AUDIT_SUCCESS;
    ea.grfInheritance = NO_PROPAGATE_INHERIT_ACE;
    ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
    ea.Trustee.ptstrName = L"Administrator";

    dwRes = SetEntriesInAcl(1, &ea, pOldSACL, &pNewSACL);
    if (ERROR_SUCCESS != dwRes) {
        LOG_OUTPUT(L"SetEntriesInAcl Error %lu %ld\n", dwRes, GetLastError());
        return dwRes;
    }

    for (int ii = pNewSACL->AceCount - 1; ii >= 0; ii--)
    {
        PSYSTEM_MANDATORY_LABEL_ACE pAce = NULL; // Only access pAce->Header until checking AceType

        if (!GetAce(pNewSACL, ii, (LPVOID*)&pAce))
        {
            VERIFY_ARE_EQUAL((DWORD)0, GetLastError());
        }
        DeleteAce(pNewSACL, ii);
    }

    PSID    pIntegritySid = NULL;

    BOOL    fRet;

    if (true)
    {
        fRet = ConvertStringSidToSidW(SDDL_ML_HIGH, &pIntegritySid);
    }
    else
    {
        fRet = ConvertStringSidToSidW(SDDL_ML_MEDIUM, &pIntegritySid);
    }

    VERIFY_IS_TRUE(fRet);

    fRet = AddAuditAccessAce(pNewSACL, ACL_REVISION_DS, OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE, pIntegritySid, FALSE, FALSE);

    VERIFY_IS_TRUE(fRet);

    DWORD absSize = 0;
    DWORD daclSize = 0;
    DWORD saclSize = 0;
    DWORD ownerSize = 0;
    DWORD primGroupSize = 0;
    fRet = MakeAbsoluteSD(pSS, NULL, &absSize, NULL, &daclSize, NULL, &saclSize, NULL, &ownerSize, NULL, &primGroupSize);

    PSECURITY_DESCRIPTOR pSD = LocalAlloc(0, absSize);
    fRet = MakeAbsoluteSD(pSS,
        pSD, &absSize,
        /*pSD->Dacl =*/ (PACL)LocalAlloc(0, daclSize), &daclSize,
        /*pSD->Sacl =*/ (PACL)LocalAlloc(0, saclSize), &saclSize,
        /*pSD->Owner =*/ (PSID)LocalAlloc(0, ownerSize), &ownerSize,
        /*pSD->Group =*/ (PSID)LocalAlloc(0, primGroupSize), &primGroupSize);

// NOTE 1: Verified that ACE count is 1 in pNewSACL before inserting it
// SECTION 3: End
// SECTION 4: Add newSACL to kernel object security

    if (!SetSecurityDescriptorSacl(pSD, TRUE, pNewSACL, FALSE))
    {
        DWORD dwError = GetLastError();
        hr = HRESULT_FROM_WIN32(dwError);
    }

// NOTE 2: Verified that new SACL in pSD has ACE count as 1 by using GetSecurityDescriptorSacl

    if (!SetKernelObjectSecurity(hFile, SACL_SECURITY_INFORMATION, pSD))
    {
        // NOTE 3: Call flow doesn't go here so SetKernelObjectSecurity is success.
        DWORD dwError = GetLastError();
        hr = HRESULT_FROM_WIN32(dwError);
    }

// SECTION 4: End
// SECTION 5: Validate if SACL is updated

// NOTE 4: Following code is to validate that ACE count is changed by using GetKernelObjectSecurity and GetSecurityDescriptorSacl but as in (NOTE 5) it is found to be 0

    dwSize = 0;
    PSECURITY_DESCRIPTOR pSD1 = NULL;

    if (!GetKernelObjectSecurity(hFile, LABEL_SECURITY_INFORMATION, pSD1, dwSize, &dwSize))
    {
        DWORD dwError = GetLastError();

        if (ERROR_INSUFFICIENT_BUFFER != dwError)
        {
            hr = HRESULT_FROM_WIN32(dwError);
        }
        else if (NULL == (pSD1 = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, dwSize)))
        {
            hr = E_OUTOFMEMORY;
        }
        else if (!GetKernelObjectSecurity(hFile, LABEL_SECURITY_INFORMATION, pSD1, dwSize, &dwSize))
        {
            hr = HRESULT_FROM_WIN32(GetLastError());
        }
    }
    else
    {
        // Should never get here, as dwSize was initialized to 0,
        // so the call to GetKernelObjectSecurity should fail.
        // Adding this to avoid Prefast/Prefix complaining that
        // potential use of NULL pSD below.
        hr = E_UNEXPECTED;
    }

    VERIFY_ARE_EQUAL(hr, S_OK);

    PACL pSacl = NULL;
    bSaclPresent = FALSE;
    bSaclDefaulted = FALSE;

    if (!GetSecurityDescriptorSacl(pSD1, &bSaclPresent, &pSacl, &bSaclDefaulted))
    {
        hr = HRESULT_FROM_WIN32(GetLastError());
    }

    VERIFY_ARE_EQUAL(hr, S_OK);
    VERIFY_ARE_NOT_EQUAL(pSacl, (PACL)NULL);
    VERIFY_ARE_EQUAL(bSaclPresent, (BOOL)true);
    VERIFY_ARE_NOT_EQUAL(pSacl->AceCount, (WORD)0); // NOTE 5: ACE Count is 0

// SECTION 5: End

    CloseHandle(hFile);

}

Answer 1

将LABEL_SECURITY_INFORMATION替换为SACL_SECURITY_INFORMATION。