Source file src/cmd/vendor/golang.org/x/sys/windows/security_windows.go

     1	// Copyright 2012 The Go Authors. All rights reserved.
     2	// Use of this source code is governed by a BSD-style
     3	// license that can be found in the LICENSE file.
     4	
     5	package windows
     6	
     7	import (
     8		"syscall"
     9		"unsafe"
    10	)
    11	
    12	const (
    13		STANDARD_RIGHTS_REQUIRED = 0xf0000
    14		STANDARD_RIGHTS_READ     = 0x20000
    15		STANDARD_RIGHTS_WRITE    = 0x20000
    16		STANDARD_RIGHTS_EXECUTE  = 0x20000
    17		STANDARD_RIGHTS_ALL      = 0x1F0000
    18	)
    19	
    20	const (
    21		NameUnknown          = 0
    22		NameFullyQualifiedDN = 1
    23		NameSamCompatible    = 2
    24		NameDisplay          = 3
    25		NameUniqueId         = 6
    26		NameCanonical        = 7
    27		NameUserPrincipal    = 8
    28		NameCanonicalEx      = 9
    29		NameServicePrincipal = 10
    30		NameDnsDomain        = 12
    31	)
    32	
    33	// This function returns 1 byte BOOLEAN rather than the 4 byte BOOL.
    34	// http://blogs.msdn.com/b/drnick/archive/2007/12/19/windows-and-upn-format-credentials.aspx
    35	//sys	TranslateName(accName *uint16, accNameFormat uint32, desiredNameFormat uint32, translatedName *uint16, nSize *uint32) (err error) [failretval&0xff==0] = secur32.TranslateNameW
    36	//sys	GetUserNameEx(nameFormat uint32, nameBuffre *uint16, nSize *uint32) (err error) [failretval&0xff==0] = secur32.GetUserNameExW
    37	
    38	// TranslateAccountName converts a directory service
    39	// object name from one format to another.
    40	func TranslateAccountName(username string, from, to uint32, initSize int) (string, error) {
    41		u, e := UTF16PtrFromString(username)
    42		if e != nil {
    43			return "", e
    44		}
    45		n := uint32(50)
    46		for {
    47			b := make([]uint16, n)
    48			e = TranslateName(u, from, to, &b[0], &n)
    49			if e == nil {
    50				return UTF16ToString(b[:n]), nil
    51			}
    52			if e != ERROR_INSUFFICIENT_BUFFER {
    53				return "", e
    54			}
    55			if n <= uint32(len(b)) {
    56				return "", e
    57			}
    58		}
    59	}
    60	
    61	const (
    62		// do not reorder
    63		NetSetupUnknownStatus = iota
    64		NetSetupUnjoined
    65		NetSetupWorkgroupName
    66		NetSetupDomainName
    67	)
    68	
    69	type UserInfo10 struct {
    70		Name       *uint16
    71		Comment    *uint16
    72		UsrComment *uint16
    73		FullName   *uint16
    74	}
    75	
    76	//sys	NetUserGetInfo(serverName *uint16, userName *uint16, level uint32, buf **byte) (neterr error) = netapi32.NetUserGetInfo
    77	//sys	NetGetJoinInformation(server *uint16, name **uint16, bufType *uint32) (neterr error) = netapi32.NetGetJoinInformation
    78	//sys	NetApiBufferFree(buf *byte) (neterr error) = netapi32.NetApiBufferFree
    79	
    80	const (
    81		// do not reorder
    82		SidTypeUser = 1 + iota
    83		SidTypeGroup
    84		SidTypeDomain
    85		SidTypeAlias
    86		SidTypeWellKnownGroup
    87		SidTypeDeletedAccount
    88		SidTypeInvalid
    89		SidTypeUnknown
    90		SidTypeComputer
    91		SidTypeLabel
    92	)
    93	
    94	type SidIdentifierAuthority struct {
    95		Value [6]byte
    96	}
    97	
    98	var (
    99		SECURITY_NULL_SID_AUTHORITY        = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 0}}
   100		SECURITY_WORLD_SID_AUTHORITY       = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 1}}
   101		SECURITY_LOCAL_SID_AUTHORITY       = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 2}}
   102		SECURITY_CREATOR_SID_AUTHORITY     = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 3}}
   103		SECURITY_NON_UNIQUE_AUTHORITY      = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 4}}
   104		SECURITY_NT_AUTHORITY              = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 5}}
   105		SECURITY_MANDATORY_LABEL_AUTHORITY = SidIdentifierAuthority{[6]byte{0, 0, 0, 0, 0, 16}}
   106	)
   107	
   108	const (
   109		SECURITY_NULL_RID                   = 0
   110		SECURITY_WORLD_RID                  = 0
   111		SECURITY_LOCAL_RID                  = 0
   112		SECURITY_CREATOR_OWNER_RID          = 0
   113		SECURITY_CREATOR_GROUP_RID          = 1
   114		SECURITY_DIALUP_RID                 = 1
   115		SECURITY_NETWORK_RID                = 2
   116		SECURITY_BATCH_RID                  = 3
   117		SECURITY_INTERACTIVE_RID            = 4
   118		SECURITY_LOGON_IDS_RID              = 5
   119		SECURITY_SERVICE_RID                = 6
   120		SECURITY_LOCAL_SYSTEM_RID           = 18
   121		SECURITY_BUILTIN_DOMAIN_RID         = 32
   122		SECURITY_PRINCIPAL_SELF_RID         = 10
   123		SECURITY_CREATOR_OWNER_SERVER_RID   = 0x2
   124		SECURITY_CREATOR_GROUP_SERVER_RID   = 0x3
   125		SECURITY_LOGON_IDS_RID_COUNT        = 0x3
   126		SECURITY_ANONYMOUS_LOGON_RID        = 0x7
   127		SECURITY_PROXY_RID                  = 0x8
   128		SECURITY_ENTERPRISE_CONTROLLERS_RID = 0x9
   129		SECURITY_SERVER_LOGON_RID           = SECURITY_ENTERPRISE_CONTROLLERS_RID
   130		SECURITY_AUTHENTICATED_USER_RID     = 0xb
   131		SECURITY_RESTRICTED_CODE_RID        = 0xc
   132		SECURITY_NT_NON_UNIQUE_RID          = 0x15
   133	)
   134	
   135	// Predefined domain-relative RIDs for local groups.
   136	// See https://msdn.microsoft.com/en-us/library/windows/desktop/aa379649(v=vs.85).aspx
   137	const (
   138		DOMAIN_ALIAS_RID_ADMINS                         = 0x220
   139		DOMAIN_ALIAS_RID_USERS                          = 0x221
   140		DOMAIN_ALIAS_RID_GUESTS                         = 0x222
   141		DOMAIN_ALIAS_RID_POWER_USERS                    = 0x223
   142		DOMAIN_ALIAS_RID_ACCOUNT_OPS                    = 0x224
   143		DOMAIN_ALIAS_RID_SYSTEM_OPS                     = 0x225
   144		DOMAIN_ALIAS_RID_PRINT_OPS                      = 0x226
   145		DOMAIN_ALIAS_RID_BACKUP_OPS                     = 0x227
   146		DOMAIN_ALIAS_RID_REPLICATOR                     = 0x228
   147		DOMAIN_ALIAS_RID_RAS_SERVERS                    = 0x229
   148		DOMAIN_ALIAS_RID_PREW2KCOMPACCESS               = 0x22a
   149		DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS           = 0x22b
   150		DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS      = 0x22c
   151		DOMAIN_ALIAS_RID_INCOMING_FOREST_TRUST_BUILDERS = 0x22d
   152		DOMAIN_ALIAS_RID_MONITORING_USERS               = 0x22e
   153		DOMAIN_ALIAS_RID_LOGGING_USERS                  = 0x22f
   154		DOMAIN_ALIAS_RID_AUTHORIZATIONACCESS            = 0x230
   155		DOMAIN_ALIAS_RID_TS_LICENSE_SERVERS             = 0x231
   156		DOMAIN_ALIAS_RID_DCOM_USERS                     = 0x232
   157		DOMAIN_ALIAS_RID_IUSERS                         = 0x238
   158		DOMAIN_ALIAS_RID_CRYPTO_OPERATORS               = 0x239
   159		DOMAIN_ALIAS_RID_CACHEABLE_PRINCIPALS_GROUP     = 0x23b
   160		DOMAIN_ALIAS_RID_NON_CACHEABLE_PRINCIPALS_GROUP = 0x23c
   161		DOMAIN_ALIAS_RID_EVENT_LOG_READERS_GROUP        = 0x23d
   162		DOMAIN_ALIAS_RID_CERTSVC_DCOM_ACCESS_GROUP      = 0x23e
   163	)
   164	
   165	//sys	LookupAccountSid(systemName *uint16, sid *SID, name *uint16, nameLen *uint32, refdDomainName *uint16, refdDomainNameLen *uint32, use *uint32) (err error) = advapi32.LookupAccountSidW
   166	//sys	LookupAccountName(systemName *uint16, accountName *uint16, sid *SID, sidLen *uint32, refdDomainName *uint16, refdDomainNameLen *uint32, use *uint32) (err error) = advapi32.LookupAccountNameW
   167	//sys	ConvertSidToStringSid(sid *SID, stringSid **uint16) (err error) = advapi32.ConvertSidToStringSidW
   168	//sys	ConvertStringSidToSid(stringSid *uint16, sid **SID) (err error) = advapi32.ConvertStringSidToSidW
   169	//sys	GetLengthSid(sid *SID) (len uint32) = advapi32.GetLengthSid
   170	//sys	CopySid(destSidLen uint32, destSid *SID, srcSid *SID) (err error) = advapi32.CopySid
   171	//sys	AllocateAndInitializeSid(identAuth *SidIdentifierAuthority, subAuth byte, subAuth0 uint32, subAuth1 uint32, subAuth2 uint32, subAuth3 uint32, subAuth4 uint32, subAuth5 uint32, subAuth6 uint32, subAuth7 uint32, sid **SID) (err error) = advapi32.AllocateAndInitializeSid
   172	//sys	createWellKnownSid(sidType WELL_KNOWN_SID_TYPE, domainSid *SID, sid *SID, sizeSid *uint32) (err error) = advapi32.CreateWellKnownSid
   173	//sys	FreeSid(sid *SID) (err error) [failretval!=0] = advapi32.FreeSid
   174	//sys	EqualSid(sid1 *SID, sid2 *SID) (isEqual bool) = advapi32.EqualSid
   175	
   176	// The security identifier (SID) structure is a variable-length
   177	// structure used to uniquely identify users or groups.
   178	type SID struct{}
   179	
   180	// StringToSid converts a string-format security identifier
   181	// sid into a valid, functional sid.
   182	func StringToSid(s string) (*SID, error) {
   183		var sid *SID
   184		p, e := UTF16PtrFromString(s)
   185		if e != nil {
   186			return nil, e
   187		}
   188		e = ConvertStringSidToSid(p, &sid)
   189		if e != nil {
   190			return nil, e
   191		}
   192		defer LocalFree((Handle)(unsafe.Pointer(sid)))
   193		return sid.Copy()
   194	}
   195	
   196	// LookupSID retrieves a security identifier sid for the account
   197	// and the name of the domain on which the account was found.
   198	// System specify target computer to search.
   199	func LookupSID(system, account string) (sid *SID, domain string, accType uint32, err error) {
   200		if len(account) == 0 {
   201			return nil, "", 0, syscall.EINVAL
   202		}
   203		acc, e := UTF16PtrFromString(account)
   204		if e != nil {
   205			return nil, "", 0, e
   206		}
   207		var sys *uint16
   208		if len(system) > 0 {
   209			sys, e = UTF16PtrFromString(system)
   210			if e != nil {
   211				return nil, "", 0, e
   212			}
   213		}
   214		n := uint32(50)
   215		dn := uint32(50)
   216		for {
   217			b := make([]byte, n)
   218			db := make([]uint16, dn)
   219			sid = (*SID)(unsafe.Pointer(&b[0]))
   220			e = LookupAccountName(sys, acc, sid, &n, &db[0], &dn, &accType)
   221			if e == nil {
   222				return sid, UTF16ToString(db), accType, nil
   223			}
   224			if e != ERROR_INSUFFICIENT_BUFFER {
   225				return nil, "", 0, e
   226			}
   227			if n <= uint32(len(b)) {
   228				return nil, "", 0, e
   229			}
   230		}
   231	}
   232	
   233	// String converts sid to a string format
   234	// suitable for display, storage, or transmission.
   235	func (sid *SID) String() (string, error) {
   236		var s *uint16
   237		e := ConvertSidToStringSid(sid, &s)
   238		if e != nil {
   239			return "", e
   240		}
   241		defer LocalFree((Handle)(unsafe.Pointer(s)))
   242		return UTF16ToString((*[256]uint16)(unsafe.Pointer(s))[:]), nil
   243	}
   244	
   245	// Len returns the length, in bytes, of a valid security identifier sid.
   246	func (sid *SID) Len() int {
   247		return int(GetLengthSid(sid))
   248	}
   249	
   250	// Copy creates a duplicate of security identifier sid.
   251	func (sid *SID) Copy() (*SID, error) {
   252		b := make([]byte, sid.Len())
   253		sid2 := (*SID)(unsafe.Pointer(&b[0]))
   254		e := CopySid(uint32(len(b)), sid2, sid)
   255		if e != nil {
   256			return nil, e
   257		}
   258		return sid2, nil
   259	}
   260	
   261	// LookupAccount retrieves the name of the account for this sid
   262	// and the name of the first domain on which this sid is found.
   263	// System specify target computer to search for.
   264	func (sid *SID) LookupAccount(system string) (account, domain string, accType uint32, err error) {
   265		var sys *uint16
   266		if len(system) > 0 {
   267			sys, err = UTF16PtrFromString(system)
   268			if err != nil {
   269				return "", "", 0, err
   270			}
   271		}
   272		n := uint32(50)
   273		dn := uint32(50)
   274		for {
   275			b := make([]uint16, n)
   276			db := make([]uint16, dn)
   277			e := LookupAccountSid(sys, sid, &b[0], &n, &db[0], &dn, &accType)
   278			if e == nil {
   279				return UTF16ToString(b), UTF16ToString(db), accType, nil
   280			}
   281			if e != ERROR_INSUFFICIENT_BUFFER {
   282				return "", "", 0, e
   283			}
   284			if n <= uint32(len(b)) {
   285				return "", "", 0, e
   286			}
   287		}
   288	}
   289	
   290	// Various types of pre-specified sids that can be synthesized at runtime.
   291	type WELL_KNOWN_SID_TYPE uint32
   292	
   293	const (
   294		WinNullSid                                    = 0
   295		WinWorldSid                                   = 1
   296		WinLocalSid                                   = 2
   297		WinCreatorOwnerSid                            = 3
   298		WinCreatorGroupSid                            = 4
   299		WinCreatorOwnerServerSid                      = 5
   300		WinCreatorGroupServerSid                      = 6
   301		WinNtAuthoritySid                             = 7
   302		WinDialupSid                                  = 8
   303		WinNetworkSid                                 = 9
   304		WinBatchSid                                   = 10
   305		WinInteractiveSid                             = 11
   306		WinServiceSid                                 = 12
   307		WinAnonymousSid                               = 13
   308		WinProxySid                                   = 14
   309		WinEnterpriseControllersSid                   = 15
   310		WinSelfSid                                    = 16
   311		WinAuthenticatedUserSid                       = 17
   312		WinRestrictedCodeSid                          = 18
   313		WinTerminalServerSid                          = 19
   314		WinRemoteLogonIdSid                           = 20
   315		WinLogonIdsSid                                = 21
   316		WinLocalSystemSid                             = 22
   317		WinLocalServiceSid                            = 23
   318		WinNetworkServiceSid                          = 24
   319		WinBuiltinDomainSid                           = 25
   320		WinBuiltinAdministratorsSid                   = 26
   321		WinBuiltinUsersSid                            = 27
   322		WinBuiltinGuestsSid                           = 28
   323		WinBuiltinPowerUsersSid                       = 29
   324		WinBuiltinAccountOperatorsSid                 = 30
   325		WinBuiltinSystemOperatorsSid                  = 31
   326		WinBuiltinPrintOperatorsSid                   = 32
   327		WinBuiltinBackupOperatorsSid                  = 33
   328		WinBuiltinReplicatorSid                       = 34
   329		WinBuiltinPreWindows2000CompatibleAccessSid   = 35
   330		WinBuiltinRemoteDesktopUsersSid               = 36
   331		WinBuiltinNetworkConfigurationOperatorsSid    = 37
   332		WinAccountAdministratorSid                    = 38
   333		WinAccountGuestSid                            = 39
   334		WinAccountKrbtgtSid                           = 40
   335		WinAccountDomainAdminsSid                     = 41
   336		WinAccountDomainUsersSid                      = 42
   337		WinAccountDomainGuestsSid                     = 43
   338		WinAccountComputersSid                        = 44
   339		WinAccountControllersSid                      = 45
   340		WinAccountCertAdminsSid                       = 46
   341		WinAccountSchemaAdminsSid                     = 47
   342		WinAccountEnterpriseAdminsSid                 = 48
   343		WinAccountPolicyAdminsSid                     = 49
   344		WinAccountRasAndIasServersSid                 = 50
   345		WinNTLMAuthenticationSid                      = 51
   346		WinDigestAuthenticationSid                    = 52
   347		WinSChannelAuthenticationSid                  = 53
   348		WinThisOrganizationSid                        = 54
   349		WinOtherOrganizationSid                       = 55
   350		WinBuiltinIncomingForestTrustBuildersSid      = 56
   351		WinBuiltinPerfMonitoringUsersSid              = 57
   352		WinBuiltinPerfLoggingUsersSid                 = 58
   353		WinBuiltinAuthorizationAccessSid              = 59
   354		WinBuiltinTerminalServerLicenseServersSid     = 60
   355		WinBuiltinDCOMUsersSid                        = 61
   356		WinBuiltinIUsersSid                           = 62
   357		WinIUserSid                                   = 63
   358		WinBuiltinCryptoOperatorsSid                  = 64
   359		WinUntrustedLabelSid                          = 65
   360		WinLowLabelSid                                = 66
   361		WinMediumLabelSid                             = 67
   362		WinHighLabelSid                               = 68
   363		WinSystemLabelSid                             = 69
   364		WinWriteRestrictedCodeSid                     = 70
   365		WinCreatorOwnerRightsSid                      = 71
   366		WinCacheablePrincipalsGroupSid                = 72
   367		WinNonCacheablePrincipalsGroupSid             = 73
   368		WinEnterpriseReadonlyControllersSid           = 74
   369		WinAccountReadonlyControllersSid              = 75
   370		WinBuiltinEventLogReadersGroup                = 76
   371		WinNewEnterpriseReadonlyControllersSid        = 77
   372		WinBuiltinCertSvcDComAccessGroup              = 78
   373		WinMediumPlusLabelSid                         = 79
   374		WinLocalLogonSid                              = 80
   375		WinConsoleLogonSid                            = 81
   376		WinThisOrganizationCertificateSid             = 82
   377		WinApplicationPackageAuthoritySid             = 83
   378		WinBuiltinAnyPackageSid                       = 84
   379		WinCapabilityInternetClientSid                = 85
   380		WinCapabilityInternetClientServerSid          = 86
   381		WinCapabilityPrivateNetworkClientServerSid    = 87
   382		WinCapabilityPicturesLibrarySid               = 88
   383		WinCapabilityVideosLibrarySid                 = 89
   384		WinCapabilityMusicLibrarySid                  = 90
   385		WinCapabilityDocumentsLibrarySid              = 91
   386		WinCapabilitySharedUserCertificatesSid        = 92
   387		WinCapabilityEnterpriseAuthenticationSid      = 93
   388		WinCapabilityRemovableStorageSid              = 94
   389		WinBuiltinRDSRemoteAccessServersSid           = 95
   390		WinBuiltinRDSEndpointServersSid               = 96
   391		WinBuiltinRDSManagementServersSid             = 97
   392		WinUserModeDriversSid                         = 98
   393		WinBuiltinHyperVAdminsSid                     = 99
   394		WinAccountCloneableControllersSid             = 100
   395		WinBuiltinAccessControlAssistanceOperatorsSid = 101
   396		WinBuiltinRemoteManagementUsersSid            = 102
   397		WinAuthenticationAuthorityAssertedSid         = 103
   398		WinAuthenticationServiceAssertedSid           = 104
   399		WinLocalAccountSid                            = 105
   400		WinLocalAccountAndAdministratorSid            = 106
   401		WinAccountProtectedUsersSid                   = 107
   402		WinCapabilityAppointmentsSid                  = 108
   403		WinCapabilityContactsSid                      = 109
   404		WinAccountDefaultSystemManagedSid             = 110
   405		WinBuiltinDefaultSystemManagedGroupSid        = 111
   406		WinBuiltinStorageReplicaAdminsSid             = 112
   407		WinAccountKeyAdminsSid                        = 113
   408		WinAccountEnterpriseKeyAdminsSid              = 114
   409		WinAuthenticationKeyTrustSid                  = 115
   410		WinAuthenticationKeyPropertyMFASid            = 116
   411		WinAuthenticationKeyPropertyAttestationSid    = 117
   412		WinAuthenticationFreshKeyAuthSid              = 118
   413		WinBuiltinDeviceOwnersSid                     = 119
   414	)
   415	
   416	// Creates a sid for a well-known predefined alias, generally using the constants of the form
   417	// Win*Sid, for the local machine.
   418	func CreateWellKnownSid(sidType WELL_KNOWN_SID_TYPE) (*SID, error) {
   419		return CreateWellKnownDomainSid(sidType, nil)
   420	}
   421	
   422	// Creates a sid for a well-known predefined alias, generally using the constants of the form
   423	// Win*Sid, for the domain specified by the domainSid parameter.
   424	func CreateWellKnownDomainSid(sidType WELL_KNOWN_SID_TYPE, domainSid *SID) (*SID, error) {
   425		n := uint32(50)
   426		for {
   427			b := make([]byte, n)
   428			sid := (*SID)(unsafe.Pointer(&b[0]))
   429			err := createWellKnownSid(sidType, domainSid, sid, &n)
   430			if err == nil {
   431				return sid, nil
   432			}
   433			if err != ERROR_INSUFFICIENT_BUFFER {
   434				return nil, err
   435			}
   436			if n <= uint32(len(b)) {
   437				return nil, err
   438			}
   439		}
   440	}
   441	
   442	const (
   443		// do not reorder
   444		TOKEN_ASSIGN_PRIMARY = 1 << iota
   445		TOKEN_DUPLICATE
   446		TOKEN_IMPERSONATE
   447		TOKEN_QUERY
   448		TOKEN_QUERY_SOURCE
   449		TOKEN_ADJUST_PRIVILEGES
   450		TOKEN_ADJUST_GROUPS
   451		TOKEN_ADJUST_DEFAULT
   452		TOKEN_ADJUST_SESSIONID
   453	
   454		TOKEN_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED |
   455			TOKEN_ASSIGN_PRIMARY |
   456			TOKEN_DUPLICATE |
   457			TOKEN_IMPERSONATE |
   458			TOKEN_QUERY |
   459			TOKEN_QUERY_SOURCE |
   460			TOKEN_ADJUST_PRIVILEGES |
   461			TOKEN_ADJUST_GROUPS |
   462			TOKEN_ADJUST_DEFAULT |
   463			TOKEN_ADJUST_SESSIONID
   464		TOKEN_READ  = STANDARD_RIGHTS_READ | TOKEN_QUERY
   465		TOKEN_WRITE = STANDARD_RIGHTS_WRITE |
   466			TOKEN_ADJUST_PRIVILEGES |
   467			TOKEN_ADJUST_GROUPS |
   468			TOKEN_ADJUST_DEFAULT
   469		TOKEN_EXECUTE = STANDARD_RIGHTS_EXECUTE
   470	)
   471	
   472	const (
   473		// do not reorder
   474		TokenUser = 1 + iota
   475		TokenGroups
   476		TokenPrivileges
   477		TokenOwner
   478		TokenPrimaryGroup
   479		TokenDefaultDacl
   480		TokenSource
   481		TokenType
   482		TokenImpersonationLevel
   483		TokenStatistics
   484		TokenRestrictedSids
   485		TokenSessionId
   486		TokenGroupsAndPrivileges
   487		TokenSessionReference
   488		TokenSandBoxInert
   489		TokenAuditPolicy
   490		TokenOrigin
   491		TokenElevationType
   492		TokenLinkedToken
   493		TokenElevation
   494		TokenHasRestrictions
   495		TokenAccessInformation
   496		TokenVirtualizationAllowed
   497		TokenVirtualizationEnabled
   498		TokenIntegrityLevel
   499		TokenUIAccess
   500		TokenMandatoryPolicy
   501		TokenLogonSid
   502		MaxTokenInfoClass
   503	)
   504	
   505	type SIDAndAttributes struct {
   506		Sid        *SID
   507		Attributes uint32
   508	}
   509	
   510	type Tokenuser struct {
   511		User SIDAndAttributes
   512	}
   513	
   514	type Tokenprimarygroup struct {
   515		PrimaryGroup *SID
   516	}
   517	
   518	type Tokengroups struct {
   519		GroupCount uint32
   520		Groups     [1]SIDAndAttributes
   521	}
   522	
   523	// Authorization Functions
   524	//sys checkTokenMembership(tokenHandle Token, sidToCheck *SID, isMember *int32) (err error) = advapi32.CheckTokenMembership
   525	//sys	OpenProcessToken(h Handle, access uint32, token *Token) (err error) = advapi32.OpenProcessToken
   526	//sys	GetTokenInformation(t Token, infoClass uint32, info *byte, infoLen uint32, returnedLen *uint32) (err error) = advapi32.GetTokenInformation
   527	//sys	GetUserProfileDirectory(t Token, dir *uint16, dirLen *uint32) (err error) = userenv.GetUserProfileDirectoryW
   528	//sys	getSystemDirectory(dir *uint16, dirLen uint32) (len uint32, err error) = kernel32.GetSystemDirectoryW
   529	
   530	// An access token contains the security information for a logon session.
   531	// The system creates an access token when a user logs on, and every
   532	// process executed on behalf of the user has a copy of the token.
   533	// The token identifies the user, the user's groups, and the user's
   534	// privileges. The system uses the token to control access to securable
   535	// objects and to control the ability of the user to perform various
   536	// system-related operations on the local computer.
   537	type Token Handle
   538	
   539	// OpenCurrentProcessToken opens the access token
   540	// associated with current process.
   541	func OpenCurrentProcessToken() (Token, error) {
   542		p, e := GetCurrentProcess()
   543		if e != nil {
   544			return 0, e
   545		}
   546		var t Token
   547		e = OpenProcessToken(p, TOKEN_QUERY, &t)
   548		if e != nil {
   549			return 0, e
   550		}
   551		return t, nil
   552	}
   553	
   554	// Close releases access to access token.
   555	func (t Token) Close() error {
   556		return CloseHandle(Handle(t))
   557	}
   558	
   559	// getInfo retrieves a specified type of information about an access token.
   560	func (t Token) getInfo(class uint32, initSize int) (unsafe.Pointer, error) {
   561		n := uint32(initSize)
   562		for {
   563			b := make([]byte, n)
   564			e := GetTokenInformation(t, class, &b[0], uint32(len(b)), &n)
   565			if e == nil {
   566				return unsafe.Pointer(&b[0]), nil
   567			}
   568			if e != ERROR_INSUFFICIENT_BUFFER {
   569				return nil, e
   570			}
   571			if n <= uint32(len(b)) {
   572				return nil, e
   573			}
   574		}
   575	}
   576	
   577	// GetTokenUser retrieves access token t user account information.
   578	func (t Token) GetTokenUser() (*Tokenuser, error) {
   579		i, e := t.getInfo(TokenUser, 50)
   580		if e != nil {
   581			return nil, e
   582		}
   583		return (*Tokenuser)(i), nil
   584	}
   585	
   586	// GetTokenGroups retrieves group accounts associated with access token t.
   587	func (t Token) GetTokenGroups() (*Tokengroups, error) {
   588		i, e := t.getInfo(TokenGroups, 50)
   589		if e != nil {
   590			return nil, e
   591		}
   592		return (*Tokengroups)(i), nil
   593	}
   594	
   595	// GetTokenPrimaryGroup retrieves access token t primary group information.
   596	// A pointer to a SID structure representing a group that will become
   597	// the primary group of any objects created by a process using this access token.
   598	func (t Token) GetTokenPrimaryGroup() (*Tokenprimarygroup, error) {
   599		i, e := t.getInfo(TokenPrimaryGroup, 50)
   600		if e != nil {
   601			return nil, e
   602		}
   603		return (*Tokenprimarygroup)(i), nil
   604	}
   605	
   606	// GetUserProfileDirectory retrieves path to the
   607	// root directory of the access token t user's profile.
   608	func (t Token) GetUserProfileDirectory() (string, error) {
   609		n := uint32(100)
   610		for {
   611			b := make([]uint16, n)
   612			e := GetUserProfileDirectory(t, &b[0], &n)
   613			if e == nil {
   614				return UTF16ToString(b), nil
   615			}
   616			if e != ERROR_INSUFFICIENT_BUFFER {
   617				return "", e
   618			}
   619			if n <= uint32(len(b)) {
   620				return "", e
   621			}
   622		}
   623	}
   624	
   625	// GetSystemDirectory retrieves path to current location of the system
   626	// directory, which is typically, though not always, C:\Windows\System32.
   627	func GetSystemDirectory() (string, error) {
   628		n := uint32(MAX_PATH)
   629		for {
   630			b := make([]uint16, n)
   631			l, e := getSystemDirectory(&b[0], n)
   632			if e != nil {
   633				return "", e
   634			}
   635			if l <= n {
   636				return UTF16ToString(b[:l]), nil
   637			}
   638			n = l
   639		}
   640	}
   641	
   642	// IsMember reports whether the access token t is a member of the provided SID.
   643	func (t Token) IsMember(sid *SID) (bool, error) {
   644		var b int32
   645		if e := checkTokenMembership(t, sid, &b); e != nil {
   646			return false, e
   647		}
   648		return b != 0, nil
   649	}
   650	

View as plain text