How to revert self?

NTFSD
1

I am using SeImpersonateClientEx() to impersonate, after I am done, I need
to revert back. It seems IFSKIT does not have anything for reverting. I
come across PsRevertSelf and RevertSecurityContext somewhere, but I do know
the signiture of PsRevertSelf and RevertSecurityContext takes a PcTxtHandle
which I do not know where it comes from. Can somebody shed some light on
this?

Thanks.
YM.

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

wrote in message news:xxxxx@ntfsd…
>
> I am using SeImpersonateClientEx() to impersonate, after I am done, I need
> to revert back.

What I usually do is set ClientContext->Token to NULL and call
SeImpersonateClient(…) again. This acts as a revert. Assuming you called
SeCaptureSubjectContext, don’t forget to deref the subject conext when
you’re done.

How about that… I answered a “file system” question,

Peter
OSR

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

And what about using the following routine ?

NTKERNELAPI
VOID
PsRevertToSelf (
VOID
);

It should be called in the context of the thread
which should be reverted to its inherited context.
The routine does really nothing more than deleting
the thread imperonation information and dereferencing
the impersonation token, if any.

This should be sufficient for your task :-))

Paul

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@math.uic.edu
Sent: Friday, August 24, 2001 2:30 PM
To: File Systems Developers
Subject: [ntfsd] How to revert self?

I am using SeImpersonateClientEx() to impersonate, after I am done, I
need
to revert back. It seems IFSKIT does not have anything for reverting. I
come across PsRevertSelf and RevertSecurityContext somewhere, but I do
know
the signiture of PsRevertSelf and RevertSecurityContext takes a
PcTxtHandle
which I do not know where it comes from. Can somebody shed some light on

this?

Thanks.
YM.

You are currently subscribed to ntfsd as: xxxxx@compelson.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

Paul,

This is a terrific routine to use, but it isn’t present in the Windows 2000
IFS Kit. I don’t ever recommend that people use internal, undocumented APIs
when there is some documented alternative.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Pavel Hrdina [mailto:xxxxx@compelson.com]
Sent: Monday, August 27, 2001 4:09 PM
To: File Systems Developers
Subject: [ntfsd] RE: How to revert self?

And what about using the following routine ?

NTKERNELAPI
VOID
PsRevertToSelf (
VOID
);

It should be called in the context of the thread
which should be reverted to its inherited context.
The routine does really nothing more than deleting
the thread imperonation information and dereferencing
the impersonation token, if any.

This should be sufficient for your task :-))

Paul

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@math.uic.edu
Sent: Friday, August 24, 2001 2:30 PM
To: File Systems Developers
Subject: [ntfsd] How to revert self?

I am using SeImpersonateClientEx() to impersonate, after I am done, I
need
to revert back. It seems IFSKIT does not have anything for reverting. I
come across PsRevertSelf and RevertSecurityContext somewhere, but I do
know
the signiture of PsRevertSelf and RevertSecurityContext takes a
PcTxtHandle
which I do not know where it comes from. Can somebody shed some light on

this?

Thanks.
YM.

You are currently subscribed to ntfsd as: xxxxx@compelson.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

I agree with you, Tony - usually there isn’t only one method.

So another way is to use the ZwSetInformationThread
with ThreadInformationClass equal to ThreadImpersonationToken
and ThreadInformation pointing to the NULL handle.

HANDLE TokenHandle = NULL;

Status = ZwSetInformationThread( NtCurrentThread(),
ThreadImpersonationToken,
&TokenHandle,
sizeof(TokenHandle) );

This should be considered as at least better documented than
the previous one because the routine is documented at least
in W2K DDK and the probability of change is very very low
(far less than probability of the death :-)) - the routine
looks the same from the very beginning of the Windows NT.

Paul

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Tony Mason
Sent: Tuesday, August 28, 2001 6:06 PM
To: File Systems Developers
Subject: [ntfsd] RE: How to revert self?

Paul,

This is a terrific routine to use, but it isn’t present in the Windows
2000
IFS Kit. I don’t ever recommend that people use internal, undocumented
APIs
when there is some documented alternative.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Pavel Hrdina [mailto:xxxxx@compelson.com]
Sent: Monday, August 27, 2001 4:09 PM
To: File Systems Developers
Subject: [ntfsd] RE: How to revert self?

And what about using the following routine ?

NTKERNELAPI
VOID
PsRevertToSelf (
VOID
);

It should be called in the context of the thread
which should be reverted to its inherited context.
The routine does really nothing more than deleting
the thread imperonation information and dereferencing
the impersonation token, if any.

This should be sufficient for your task :-))

Paul

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@math.uic.edu
Sent: Friday, August 24, 2001 2:30 PM
To: File Systems Developers
Subject: [ntfsd] How to revert self?

I am using SeImpersonateClientEx() to impersonate, after I am done, I
need
to revert back. It seems IFSKIT does not have anything for reverting. I
come across PsRevertSelf and RevertSecurityContext somewhere, but I do
know
the signiture of PsRevertSelf and RevertSecurityContext takes a
PcTxtHandle
which I do not know where it comes from. Can somebody shed some light on

this?

Thanks.
YM.

You are currently subscribed to ntfsd as: xxxxx@compelson.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@compelson.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

6

>I agree with you, Tony - usually there isn’t only one method.

So another way is to use the ZwSetInformationThread

Looks like the only documented method of doing this is using KSecDD.

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com