Release 2.21.

Breaks loading of all DOS executables.

patches/Compiler_Warnings/0001-ole32-Fix-compilation-with-recent-versions-of-gcc.patch

@@ -1,26 +0,0 @@
-From 43628d9b1905396ff6442e4f1e07c9dd48739b19 Mon Sep 17 00:00:00 2001
-From: Sebastian Lackner <sebastian@fds-team.de>
-Date: Fri, 14 Apr 2017 15:57:18 +0200
-Subject: ole32: Fix compilation with recent versions of gcc.
-
----
- dlls/ole32/storage32.h | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/dlls/ole32/storage32.h b/dlls/ole32/storage32.h
-index 4fcfd9c362..2b23ab8eb8 100644
---- a/dlls/ole32/storage32.h
-+++ b/dlls/ole32/storage32.h
-@@ -526,6 +526,9 @@ StgStreamImpl* StgStreamImpl_Construct(
- /******************************************************************************
-  * Endian conversion macros
-  */
-+#undef htole32
-+#undef htole16
-+
- #ifdef WORDS_BIGENDIAN
- 
- #define htole32(x) RtlUlongByteSwap(x)
--- 
-2.12.2
-

patches/Compiler_Warnings/0003-shell32-Fix-length-parameter-for-ZeroMemory.patch

@@ -1,25 +0,0 @@
-From 33717bde9e702520e23ae014c398bd7076902d43 Mon Sep 17 00:00:00 2001
-From: Sebastian Lackner <sebastian@fds-team.de>
-Date: Sun, 4 Jun 2017 12:56:47 +0200
-Subject: shell32: Fix length parameter for ZeroMemory.
-
----
- dlls/shell32/shfldr_fs.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/dlls/shell32/shfldr_fs.c b/dlls/shell32/shfldr_fs.c
-index c7259276d1d..10653f92b52 100644
---- a/dlls/shell32/shfldr_fs.c
-+++ b/dlls/shell32/shfldr_fs.c
-@@ -1315,7 +1315,7 @@ ISFHelper_fnCopyItems (ISFHelper * iface, IShellFolder * pSFFrom, UINT cidl,
- 
-         if (SUCCEEDED (IPersistFolder2_GetCurFolder (ppf2, &pidl))) {
-             SHGetPathFromIDListW (pidl, wszSrcPathRoot);
--            ZeroMemory(wszDstPath, MAX_PATH+1);
-+            ZeroMemory(wszDstPath, sizeof(wszDstPath));
-             if (This->sPathTarget)
-                 lstrcpynW(wszDstPath, This->sPathTarget, MAX_PATH);
-             PathAddBackslashW(wszSrcPathRoot);
--- 
-2.13.0
-

patches/Compiler_Warnings/0004-fusion-Fix-length-parameter-for-ZeroMemory.patch

@@ -1,25 +0,0 @@
-From 2b5e9f330770221eee2eda2aab251eba8d370a60 Mon Sep 17 00:00:00 2001
-From: Sebastian Lackner <sebastian@fds-team.de>
-Date: Sun, 4 Jun 2017 13:17:54 +0200
-Subject: fusion: Fix length parameter for ZeroMemory.
-
----
- dlls/fusion/tests/asmname.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/dlls/fusion/tests/asmname.c b/dlls/fusion/tests/asmname.c
-index 5fb14a48291..21cd4874edc 100644
---- a/dlls/fusion/tests/asmname.c
-+++ b/dlls/fusion/tests/asmname.c
-@@ -358,7 +358,7 @@ static void test_assembly_name_props_line(IAssemblyName *name,
-         to_widechar(expect, vals[i].val);
- 
-         size = MAX_PATH;
--        ZeroMemory(str, MAX_PATH);
-+        ZeroMemory(str, sizeof(str));
-         hr = IAssemblyName_GetProperty(name, i, str, &size);
-         to_multibyte(val, str);
- 
--- 
-2.13.0
-

patches/Compiler_Warnings/0005-fusion-tests-Avoid-compiler-warnings-with-GCC-7.patch

@@ -1,34 +0,0 @@
-From 3e59710a3091a4a61b7cce00606ed23b7b66dfda Mon Sep 17 00:00:00 2001
-From: Sebastian Lackner <sebastian@fds-team.de>
-Date: Sun, 4 Jun 2017 12:55:31 +0200
-Subject: fusion/tests: Avoid compiler warnings with GCC 7.
-
----
- dlls/fusion/tests/asmenum.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/dlls/fusion/tests/asmenum.c b/dlls/fusion/tests/asmenum.c
-index 1dc34a286e5..8b95f2a6bd5 100644
---- a/dlls/fusion/tests/asmenum.c
-+++ b/dlls/fusion/tests/asmenum.c
-@@ -223,7 +223,7 @@ typedef struct _tagASMNAME
- static BOOL enum_gac_assemblies(struct list *assemblies, int depth, LPSTR path)
- {
-     WIN32_FIND_DATAA ffd;
--    CHAR buf[MAX_PATH];
-+    CHAR buf[MAX_PATH + 37];
-     CHAR disp[MAX_PATH];
-     ASMNAME *name;
-     HANDLE hfind;
-@@ -248,7 +248,7 @@ static BOOL enum_gac_assemblies(struct list *assemblies, int depth, LPSTR path)
-         else if (depth == 1)
-         {
-             char culture[MAX_PATH];
--            char dll[MAX_PATH], exe[MAX_PATH];
-+            char dll[MAX_PATH + 6], exe[MAX_PATH + 6];
- 
-             /* Directories with no dll or exe will not be enumerated */
-             sprintf(dll, "%s\\%s\\%s.dll", path, ffd.cFileName, parent);
--- 
-2.13.0
-

patches/Compiler_Warnings/0006-kernel32-tests-Avoid-compiler-warnings-with-GCC-7.patch

@@ -1,34 +0,0 @@
-From d1eafd34d4c0619f956afd365ddbde79680a18dc Mon Sep 17 00:00:00 2001
-From: Sebastian Lackner <sebastian@fds-team.de>
-Date: Sun, 4 Jun 2017 12:56:10 +0200
-Subject: kernel32/tests: Avoid compiler warnings with GCC 7.
-
----
- dlls/kernel32/tests/heap.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/dlls/kernel32/tests/heap.c b/dlls/kernel32/tests/heap.c
-index 0acf109dff0..70ba674bc91 100644
---- a/dlls/kernel32/tests/heap.c
-+++ b/dlls/kernel32/tests/heap.c
-@@ -109,6 +109,9 @@ static void test_heap(void)
-     }
- 
-     /* test some border cases of HeapAlloc and HeapReAlloc */
-+#pragma GCC diagnostic push
-+#pragma GCC diagnostic ignored "-Wpragmas"
-+#pragma GCC diagnostic ignored "-Walloc-size-larger-than="
-     mem = HeapAlloc(GetProcessHeap(), 0, 0);
-     ok(mem != NULL, "memory not allocated for size 0\n");
-     msecond = HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, mem, ~(SIZE_T)0 - 7);
-@@ -125,6 +128,7 @@ static void test_heap(void)
-     ok(size == 0 || broken(size == 1) /* some vista and win7 */,
-        "HeapSize should have returned 0 instead of %lu\n", size);
-     HeapFree(GetProcessHeap(), 0, msecond);
-+#pragma GCC diagnostic pop
- 
-     /* large blocks must be 16-byte aligned */
-     mem = HeapAlloc(GetProcessHeap(), 0, 512 * 1024);
--- 
-2.13.1
-

patches/Compiler_Warnings/0007-rsaenh-tests-Avoid-compiler-warnings-with-GCC-7.patch

@@ -1,25 +0,0 @@
-From 61ceddca38f26c2df2acc6361c35ced52fe9b098 Mon Sep 17 00:00:00 2001
-From: Sebastian Lackner <sebastian@fds-team.de>
-Date: Sun, 4 Jun 2017 12:58:31 +0200
-Subject: rsaenh/tests: Avoid compiler warnings with GCC 7.
-
----
- dlls/rsaenh/rsaenh.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/dlls/rsaenh/rsaenh.c b/dlls/rsaenh/rsaenh.c
-index 9af770dfc6e..6978c860278 100644
---- a/dlls/rsaenh/rsaenh.c
-+++ b/dlls/rsaenh/rsaenh.c
-@@ -1097,7 +1097,7 @@ static void store_key_permissions(HCRYPTKEY hCryptKey, HKEY hKey, DWORD dwKeySpe
-  */
- static BOOL create_container_key(KEYCONTAINER *pKeyContainer, REGSAM sam, HKEY *phKey)
- {
--    CHAR szRSABase[MAX_PATH];
-+    CHAR szRSABase[MAX_PATH + 25];
-     HKEY hRootKey;
- 
-     sprintf(szRSABase, RSAENH_REGKEY, pKeyContainer->szName);
--- 
-2.13.0
-

patches/Compiler_Warnings/0008-kernel32-Avoid-compiler-warnings-with-GCC-7.patch

@@ -1,46 +0,0 @@
-From 67ed53ca67214d7dbdea7f342b9f2ff0356a220b Mon Sep 17 00:00:00 2001
-From: Sebastian Lackner <sebastian@fds-team.de>
-Date: Sun, 4 Jun 2017 12:59:10 +0200
-Subject: kernel32: Avoid compiler warnings with GCC 7.
-
----
- dlls/kernel32/oldconfig.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/dlls/kernel32/oldconfig.c b/dlls/kernel32/oldconfig.c
-index 6c80dc614f0..3e628757283 100644
---- a/dlls/kernel32/oldconfig.c
-+++ b/dlls/kernel32/oldconfig.c
-@@ -290,7 +290,8 @@ static void create_hardware_branch(void)
-         {
-             if (strncmp(dent->d_name, "hd", 2) == 0)
-             {
--                sprintf(cStr, procname_ide_media, dent->d_name);
-+                result = snprintf(cStr, sizeof(cStr), procname_ide_media, dent->d_name);
-+                if (result < 0 || result >= sizeof(cStr)) continue;
-                 procfile = fopen(cStr, "r");
-                 if (!procfile)
-                 {
-@@ -306,7 +307,8 @@ static void create_hardware_branch(void)
-                     if (nType == DRIVE_UNKNOWN) continue;
-                 }
- 
--                sprintf(cStr, procname_ide_model, dent->d_name);
-+                result = snprintf(cStr, sizeof(cStr), procname_ide_model, dent->d_name);
-+                if (result < 0 || result >= sizeof(cStr)) continue;
-                 procfile = fopen(cStr, "r");
-                 if (!procfile)
-                 {
-@@ -322,7 +324,8 @@ static void create_hardware_branch(void)
-                     cDevModel[strlen(cDevModel) - 1] = 0;
-                 }
- 
--                sprintf(cUnixDeviceName, "/dev/%s", dent->d_name);
-+                result = snprintf(cUnixDeviceName, sizeof(cUnixDeviceName), "/dev/%s", dent->d_name);
-+                if (result < 0 || result >= sizeof(cUnixDeviceName)) continue;
-                 scsi_addr.PortNumber = (dent->d_name[2] - 'a') / 2;
-                 scsi_addr.PathId = 0;
-                 scsi_addr.TargetId = (dent->d_name[2] - 'a') % 2;
--- 
-2.13.0
-

patches/Compiler_Warnings/0021-d2d1-Avoid-implicit-cast-of-interface-pointer.patch

@@ -1,18 +1,18 @@
-From 929eaf5dcdca040cd82141ad5ddfdcbc6c5f4a03 Mon Sep 17 00:00:00 2001
+From 79ff79dba6d5c8008c53e4bcf5e38c3a54271091 Mon Sep 17 00:00:00 2001
 From: Sebastian Lackner <sebastian@fds-team.de>
 Date: Tue, 22 Mar 2016 21:54:26 +0100
 Subject: d2d1: Avoid implicit cast of interface pointer.
 
 ---
- dlls/d2d1/brush.c    | 6 +++---
+ dlls/d2d1/brush.c    | 8 ++++----
  dlls/d2d1/geometry.c | 6 +++---
- 2 files changed, 6 insertions(+), 6 deletions(-)
+ 2 files changed, 7 insertions(+), 7 deletions(-)
 
 diff --git a/dlls/d2d1/brush.c b/dlls/d2d1/brush.c
-index aa92318..19b0993 100644
+index 7f4c7bbb763..30d25fec4b4 100644
 --- a/dlls/d2d1/brush.c
 +++ b/dlls/d2d1/brush.c
-@@ -181,7 +181,7 @@ static void d2d_brush_init(struct d2d_brush *brush, ID2D1Factory *factory,
+@@ -251,7 +251,7 @@ static void d2d_brush_init(struct d2d_brush *brush, ID2D1Factory *factory,
  
  static inline struct d2d_brush *impl_from_ID2D1SolidColorBrush(ID2D1SolidColorBrush *iface)
  {
@@ -21,7 +21,7 @@ index aa92318..19b0993 100644
  }
  
  static HRESULT STDMETHODCALLTYPE d2d_solid_color_brush_QueryInterface(ID2D1SolidColorBrush *iface,
-@@ -318,7 +318,7 @@ void d2d_solid_color_brush_init(struct d2d_brush *brush, ID2D1Factory *factory,
+@@ -394,7 +394,7 @@ HRESULT d2d_solid_color_brush_create(ID2D1Factory *factory, const D2D1_COLOR_F *
  
  static inline struct d2d_brush *impl_from_ID2D1LinearGradientBrush(ID2D1LinearGradientBrush *iface)
  {
@@ -30,7 +30,16 @@ index aa92318..19b0993 100644
  }
  
  static HRESULT STDMETHODCALLTYPE d2d_linear_gradient_brush_QueryInterface(ID2D1LinearGradientBrush *iface,
-@@ -476,7 +476,7 @@ void d2d_linear_gradient_brush_init(struct d2d_brush *brush, ID2D1Factory *facto
+@@ -580,7 +580,7 @@ HRESULT d2d_linear_gradient_brush_create(ID2D1Factory *factory, const D2D1_LINEA
+ 
+ static inline struct d2d_brush *impl_from_ID2D1RadialGradientBrush(ID2D1RadialGradientBrush *iface)
+ {
+-    return CONTAINING_RECORD(iface, struct d2d_brush, ID2D1Brush_iface);
++    return CONTAINING_RECORD((ID2D1Brush *)iface, struct d2d_brush, ID2D1Brush_iface);
+ }
+ 
+ static HRESULT STDMETHODCALLTYPE d2d_radial_gradient_brush_QueryInterface(ID2D1RadialGradientBrush *iface,
+@@ -776,7 +776,7 @@ HRESULT d2d_radial_gradient_brush_create(ID2D1Factory *factory, const D2D1_BRUSH
  
  static inline struct d2d_brush *impl_from_ID2D1BitmapBrush(ID2D1BitmapBrush *iface)
  {
@@ -40,10 +49,10 @@ index aa92318..19b0993 100644
  
  static HRESULT STDMETHODCALLTYPE d2d_bitmap_brush_QueryInterface(ID2D1BitmapBrush *iface,
 diff --git a/dlls/d2d1/geometry.c b/dlls/d2d1/geometry.c
-index 9fa1783..125c610 100644
+index a9588985642..b8457a9e1ea 100644
 --- a/dlls/d2d1/geometry.c
 +++ b/dlls/d2d1/geometry.c
-@@ -2022,7 +2022,7 @@ static const struct ID2D1GeometrySinkVtbl d2d_geometry_sink_vtbl =
+@@ -3024,7 +3024,7 @@ static const struct ID2D1GeometrySinkVtbl d2d_geometry_sink_vtbl =
  
  static inline struct d2d_geometry *impl_from_ID2D1PathGeometry(ID2D1PathGeometry *iface)
  {
@@ -52,7 +61,7 @@ index 9fa1783..125c610 100644
  }
  
  static HRESULT STDMETHODCALLTYPE d2d_path_geometry_QueryInterface(ID2D1PathGeometry *iface, REFIID iid, void **out)
-@@ -2283,7 +2283,7 @@ void d2d_path_geometry_init(struct d2d_geometry *geometry, ID2D1Factory *factory
+@@ -3540,7 +3540,7 @@ void d2d_path_geometry_init(struct d2d_geometry *geometry, ID2D1Factory *factory
  
  static inline struct d2d_geometry *impl_from_ID2D1RectangleGeometry(ID2D1RectangleGeometry *iface)
  {
@@ -61,7 +70,7 @@ index 9fa1783..125c610 100644
  }
  
  static HRESULT STDMETHODCALLTYPE d2d_rectangle_geometry_QueryInterface(ID2D1RectangleGeometry *iface,
-@@ -2531,7 +2531,7 @@ HRESULT d2d_rectangle_geometry_init(struct d2d_geometry *geometry, ID2D1Factory
+@@ -3876,7 +3876,7 @@ fail:
  
  static inline struct d2d_geometry *impl_from_ID2D1TransformedGeometry(ID2D1TransformedGeometry *iface)
  {
@@ -71,5 +80,5 @@ index 9fa1783..125c610 100644
  
  static HRESULT STDMETHODCALLTYPE d2d_transformed_geometry_QueryInterface(ID2D1TransformedGeometry *iface,
 -- 
-2.7.1
+2.14.1
 

patches/Compiler_Warnings/0033-evr-Avoid-implicit-cast-of-interface-pointer.patch

@@ -0,0 +1,25 @@
+From b4586e37df817f205c8bebe319b4765dea5c62d5 Mon Sep 17 00:00:00 2001
+From: Sebastian Lackner <sebastian@fds-team.de>
+Date: Sun, 24 Sep 2017 19:21:06 +0200
+Subject: evr: Avoid implicit cast of interface pointer.
+
+---
+ dlls/evr/evr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/dlls/evr/evr.c b/dlls/evr/evr.c
+index c2d2933211e..5533f38a649 100644
+--- a/dlls/evr/evr.c
++++ b/dlls/evr/evr.c
+@@ -136,7 +136,7 @@ static const IUnknownVtbl evr_inner_vtbl =
+ 
+ static inline evr_filter *impl_from_IBaseFilter(IBaseFilter *iface)
+ {
+-    return CONTAINING_RECORD(iface, evr_filter, filter);
++    return CONTAINING_RECORD(iface, evr_filter, filter.IBaseFilter_iface);
+ }
+ 
+ static HRESULT WINAPI filter_QueryInterface(IBaseFilter *iface, REFIID riid, void **ppv)
+-- 
+2.14.1
+

patches/advapi-LsaLookupPrivilegeName/0001-advapi32-Fix-error-code-when-calling-LsaOpenPolicy-f.patch

@@ -1,4 +1,4 @@
-From ce0ab0ccd6e4953a9673d15e00cf602668469c2c Mon Sep 17 00:00:00 2001
+From 971cfbe9ab8a7cb62c5b3e62fe4fe0bfc4518889 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
 Date: Sun, 5 Mar 2017 23:04:36 +0100
 Subject: advapi32: Fix error code when calling LsaOpenPolicy for non existing
@@ -10,10 +10,10 @@ Subject: advapi32: Fix error code when calling LsaOpenPolicy for non existing
  2 files changed, 11 insertions(+), 1 deletion(-)
 
 diff --git a/dlls/advapi32/lsa.c b/dlls/advapi32/lsa.c
-index b8dedbd6d58..e5e3b1649c0 100644
+index bfd879bbc73..2e021a1ec2d 100644
 --- a/dlls/advapi32/lsa.c
 +++ b/dlls/advapi32/lsa.c
-@@ -692,7 +692,7 @@ NTSTATUS WINAPI LsaOpenPolicy(
+@@ -659,7 +659,7 @@ NTSTATUS WINAPI LsaOpenPolicy(
            ObjectAttributes, DesiredAccess, PolicyHandle);
  
      ADVAPI_ForceLocalComputer(SystemName ? SystemName->Buffer : NULL,
@@ -23,10 +23,10 @@ index b8dedbd6d58..e5e3b1649c0 100644
  
      if(PolicyHandle) *PolicyHandle = (LSA_HANDLE)0xcafe;
 diff --git a/dlls/advapi32/tests/lsa.c b/dlls/advapi32/tests/lsa.c
-index 4daf75f58d1..7ddda731be2 100644
+index 861fea0525e..bb291e65a71 100644
 --- a/dlls/advapi32/tests/lsa.c
 +++ b/dlls/advapi32/tests/lsa.c
-@@ -70,6 +70,8 @@ static BOOL init(void)
+@@ -39,6 +39,8 @@ DEFINE_GUID(GUID_NULL,0,0,0,0,0,0,0,0,0,0,0);
  
  static void test_lsa(void)
  {
@@ -35,7 +35,7 @@ index 4daf75f58d1..7ddda731be2 100644
      NTSTATUS status;
      LSA_HANDLE handle;
      LSA_OBJECT_ATTRIBUTES object_attributes;
-@@ -77,6 +79,14 @@ static void test_lsa(void)
+@@ -46,6 +48,14 @@ static void test_lsa(void)
      ZeroMemory(&object_attributes, sizeof(object_attributes));
      object_attributes.Length = sizeof(object_attributes);
  
@@ -43,13 +43,13 @@ index 4daf75f58d1..7ddda731be2 100644
 +    machine.Length = sizeof(machineW) - 2;
 +    machine.MaximumLength = sizeof(machineW);
 +
-+    status = pLsaOpenPolicy( &machine, &object_attributes, POLICY_LOOKUP_NAMES, &handle);
++    status = LsaOpenPolicy( &machine, &object_attributes, POLICY_LOOKUP_NAMES, &handle);
 +    ok(status == RPC_NT_SERVER_UNAVAILABLE,
 +       "LsaOpenPolicy(POLICY_LOOKUP_NAMES) for invalid machine returned 0x%08x\n", status);
 +
-     status = pLsaOpenPolicy( NULL, &object_attributes, POLICY_ALL_ACCESS, &handle);
+     status = LsaOpenPolicy( NULL, &object_attributes, POLICY_ALL_ACCESS, &handle);
      ok(status == STATUS_SUCCESS || status == STATUS_ACCESS_DENIED,
         "LsaOpenPolicy(POLICY_ALL_ACCESS) returned 0x%08x\n", status);
 -- 
-2.11.0
+2.14.2
 

patches/advapi-LsaLookupPrivilegeName/0003-advapi32-Implement-LsaLookupPrivilegeName.patch

@@ -1,163 +0,0 @@
-From fcefc5661656de44d02fed0431b4a61fa618b663 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
-Date: Sun, 5 Mar 2017 23:50:06 +0100
-Subject: advapi32: Implement LsaLookupPrivilegeName.
-
----
- dlls/advapi32/advapi32.spec   |  2 +-
- dlls/advapi32/advapi32_misc.h |  2 ++
- dlls/advapi32/lsa.c           | 39 +++++++++++++++++++++++++++++++++++++++
- dlls/advapi32/security.c      | 27 ++++++++++++++++++---------
- include/ntsecapi.h            |  1 +
- 5 files changed, 61 insertions(+), 10 deletions(-)
-
-diff --git a/dlls/advapi32/advapi32.spec b/dlls/advapi32/advapi32.spec
-index d5503490a0..709a385967 100644
---- a/dlls/advapi32/advapi32.spec
-+++ b/dlls/advapi32/advapi32.spec
-@@ -469,7 +469,7 @@
- @ stdcall LsaLookupNames(long long ptr ptr ptr)
- @ stdcall LsaLookupNames2(ptr long long ptr ptr ptr)
- @ stub LsaLookupPrivilegeDisplayName
--# @ stub LsaLookupPrivilegeName
-+@ stdcall LsaLookupPrivilegeName(long ptr ptr)
- # @ stub LsaLookupPrivilegeValue
- @ stdcall LsaLookupSids(ptr long ptr ptr ptr)
- # @ stub LsaLookupSids2
-diff --git a/dlls/advapi32/advapi32_misc.h b/dlls/advapi32/advapi32_misc.h
-index d116ecb836..ecb07f635a 100644
---- a/dlls/advapi32/advapi32_misc.h
-+++ b/dlls/advapi32/advapi32_misc.h
-@@ -68,4 +68,6 @@ static inline WCHAR *strdupAW( const char *src )
-     return dst;
- }
- 
-+const WCHAR * const WellKnownPrivNames[SE_MAX_WELL_KNOWN_PRIVILEGE + 1];
-+
- #endif /* __WINE_ADVAPI32MISC_H */
-diff --git a/dlls/advapi32/lsa.c b/dlls/advapi32/lsa.c
-index 3da6d19b82..af5f9dd46d 100644
---- a/dlls/advapi32/lsa.c
-+++ b/dlls/advapi32/lsa.c
-@@ -973,3 +973,42 @@ NTSTATUS WINAPI LsaUnregisterPolicyChangeNotification(
-     FIXME("(%d,%p) stub\n", class, event);
-     return STATUS_SUCCESS;
- }
-+
-+/******************************************************************************
-+ * LsaLookupPrivilegeName [ADVAPI32.@]
-+ *
-+ */
-+NTSTATUS WINAPI LsaLookupPrivilegeName(
-+    LSA_HANDLE handle,
-+    PLUID lpLuid,
-+    PUNICODE_STRING *name)
-+{
-+    UNICODE_STRING *priv_unicode;
-+    size_t priv_size;
-+    WCHAR *strW;
-+
-+    TRACE("(%p, %p, %p)\n", handle, lpLuid, name);
-+
-+    if (!handle)
-+        return STATUS_INVALID_HANDLE;
-+
-+    if (!name)
-+        return STATUS_INVALID_PARAMETER;
-+
-+    if (lpLuid->HighPart ||
-+        (lpLuid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
-+         lpLuid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE ||
-+         !WellKnownPrivNames[lpLuid->LowPart]))
-+        return STATUS_NO_SUCH_PRIVILEGE;
-+
-+    priv_size = (strlenW(WellKnownPrivNames[lpLuid->LowPart]) + 1) * sizeof(WCHAR);
-+    priv_unicode = heap_alloc(sizeof(*priv_unicode) + priv_size);
-+    if (!priv_unicode) return STATUS_NO_MEMORY;
-+
-+    strW = (WCHAR *)(priv_unicode + 1);
-+    strcpyW(strW, WellKnownPrivNames[lpLuid->LowPart]);
-+    RtlInitUnicodeString(priv_unicode, strW);
-+
-+    *name = priv_unicode;
-+    return STATUS_SUCCESS;
-+}
-diff --git a/dlls/advapi32/security.c b/dlls/advapi32/security.c
-index e36792cff4..3bc8f48b19 100644
---- a/dlls/advapi32/security.c
-+++ b/dlls/advapi32/security.c
-@@ -1840,7 +1840,7 @@ static const WCHAR SE_IMPERSONATE_NAME_W[] =
- static const WCHAR SE_CREATE_GLOBAL_NAME_W[] =
-  { 'S','e','C','r','e','a','t','e','G','l','o','b','a','l','P','r','i','v','i','l','e','g','e',0 };
- 
--static const WCHAR * const WellKnownPrivNames[SE_MAX_WELL_KNOWN_PRIVILEGE + 1] =
-+const WCHAR * const WellKnownPrivNames[SE_MAX_WELL_KNOWN_PRIVILEGE + 1] =
- {
-     NULL,
-     NULL,
-@@ -2043,33 +2043,42 @@ BOOL WINAPI
- LookupPrivilegeNameW( LPCWSTR lpSystemName, PLUID lpLuid, LPWSTR lpName,
-  LPDWORD cchName)
- {
-+    UNICODE_STRING system_name, *priv;
-+    LSA_HANDLE lsa;
-+    NTSTATUS status;
-     size_t privNameLen;
- 
-     TRACE("%s,%p,%p,%p\n",debugstr_w(lpSystemName), lpLuid, lpName, cchName);
- 
--    if (!ADVAPI_IsLocalComputer(lpSystemName))
-+    RtlInitUnicodeString(&system_name, lpSystemName);
-+    status = LsaOpenPolicy(&system_name, NULL, POLICY_LOOKUP_NAMES, &lsa);
-+    if (status)
-     {
--        SetLastError(RPC_S_SERVER_UNAVAILABLE);
-+        SetLastError(LsaNtStatusToWinError(status));
-         return FALSE;
-     }
--    if (lpLuid->HighPart || (lpLuid->LowPart < SE_MIN_WELL_KNOWN_PRIVILEGE ||
--     lpLuid->LowPart > SE_MAX_WELL_KNOWN_PRIVILEGE))
-+
-+    status = LsaLookupPrivilegeName(&lsa, lpLuid, &priv);
-+    LsaClose(lsa);
-+    if (status)
-     {
--        SetLastError(ERROR_NO_SUCH_PRIVILEGE);
-+        SetLastError(LsaNtStatusToWinError(status));
-         return FALSE;
-     }
--    privNameLen = strlenW(WellKnownPrivNames[lpLuid->LowPart]);
--    /* Windows crashes if cchName is NULL, so will I */
-+
-+    privNameLen = priv->Length / sizeof(WCHAR);
-     if (*cchName <= privNameLen)
-     {
-         *cchName = privNameLen + 1;
-+        LsaFreeMemory(priv);
-         SetLastError(ERROR_INSUFFICIENT_BUFFER);
-         return FALSE;
-     }
-     else
-     {
--        strcpyW(lpName, WellKnownPrivNames[lpLuid->LowPart]);
-+        strcpyW(lpName, priv->Buffer);
-         *cchName = privNameLen;
-+        LsaFreeMemory(priv);
-         return TRUE;
-     }
- }
-diff --git a/include/ntsecapi.h b/include/ntsecapi.h
-index 2bb3d312e4..0bf0eca43e 100644
---- a/include/ntsecapi.h
-+++ b/include/ntsecapi.h
-@@ -370,6 +370,7 @@ NTSTATUS WINAPI LsaLookupNames(LSA_HANDLE,ULONG,PLSA_UNICODE_STRING,PLSA_REFEREN
-                                PLSA_TRANSLATED_SID*);
- NTSTATUS WINAPI LsaLookupNames2(LSA_HANDLE,ULONG,ULONG,PLSA_UNICODE_STRING,PLSA_REFERENCED_DOMAIN_LIST*,
-                                 PLSA_TRANSLATED_SID2*);
-+NTSTATUS WINAPI LsaLookupPrivilegeName(LSA_HANDLE,PLUID,PUNICODE_STRING*);
- NTSTATUS WINAPI LsaLookupSids(LSA_HANDLE,ULONG,PSID *,PLSA_REFERENCED_DOMAIN_LIST *,PLSA_TRANSLATED_NAME *);
- ULONG WINAPI LsaNtStatusToWinError(NTSTATUS);
- NTSTATUS WINAPI LsaOpenPolicy(PLSA_UNICODE_STRING,PLSA_OBJECT_ATTRIBUTES,ACCESS_MASK,PLSA_HANDLE);
--- 
-2.13.1
-

patches/advapi-LsaLookupPrivilegeName/0004-advapi32-Add-stub-for-LsaLookupPrivilegeDisplayName.patch

@@ -1,62 +0,0 @@
-From 63d642a1af3ccc579123cb8fd13959ab5e9136dd Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
-Date: Mon, 6 Mar 2017 00:01:53 +0100
-Subject: advapi32: Add stub for LsaLookupPrivilegeDisplayName.
-
----
- dlls/advapi32/advapi32.spec |  2 +-
- dlls/advapi32/lsa.c         | 21 +++++++++++++++++++++
- 2 files changed, 22 insertions(+), 1 deletion(-)
-
-diff --git a/dlls/advapi32/advapi32.spec b/dlls/advapi32/advapi32.spec
-index 124f527282..0b03cec3f5 100644
---- a/dlls/advapi32/advapi32.spec
-+++ b/dlls/advapi32/advapi32.spec
-@@ -468,7 +468,7 @@
- # @ stub LsaICLookupSidsWithCreds
- @ stdcall LsaLookupNames(long long ptr ptr ptr)
- @ stdcall LsaLookupNames2(ptr long long ptr ptr ptr)
--@ stub LsaLookupPrivilegeDisplayName
-+@ stdcall LsaLookupPrivilegeDisplayName(long ptr ptr ptr)
- @ stdcall LsaLookupPrivilegeName(long ptr ptr)
- # @ stub LsaLookupPrivilegeValue
- @ stdcall LsaLookupSids(ptr long ptr ptr ptr)
-diff --git a/dlls/advapi32/lsa.c b/dlls/advapi32/lsa.c
-index ceb3b05c05..c2e02fb462 100644
---- a/dlls/advapi32/lsa.c
-+++ b/dlls/advapi32/lsa.c
-@@ -44,6 +44,12 @@ WINE_DEFAULT_DEBUG_CHANNEL(advapi);
-         return FailureCode; \
- }
- 
-+static LPCSTR debugstr_us( const UNICODE_STRING *us )
-+{
-+    if (!us) return "(null)";
-+    return debugstr_wn(us->Buffer, us->Length / sizeof(WCHAR));
-+}
-+
- static void dumpLsaAttributes(const LSA_OBJECT_ATTRIBUTES *oa)
- {
-     if (oa)
-@@ -1011,3 +1017,18 @@ NTSTATUS WINAPI LsaLookupPrivilegeName(
-     *name = priv_unicode;
-     return STATUS_SUCCESS;
- }
-+
-+/******************************************************************************
-+ * LsaLookupPrivilegeDisplayName [ADVAPI32.@]
-+ *
-+ */
-+NTSTATUS WINAPI LsaLookupPrivilegeDisplayName(
-+    LSA_HANDLE handle,
-+    PLSA_UNICODE_STRING name,
-+    PLSA_UNICODE_STRING *dispname,
-+    SHORT *language)
-+{
-+    FIXME("(%p, %s, %p, %p)\n", handle, debugstr_us(name), dispname, language);
-+
-+    return STATUS_NO_SUCH_PRIVILEGE;
-+}
--- 
-2.11.0
-

patches/advapi-LsaLookupPrivilegeName/definition

@@ -1 +0,0 @@
-Fixes: [43316] Add LsaLookupPrivilege[Display]Name stubs

patches/advapi32-CreateRestrictedToken/0001-ntdll-Implement-NtFilterToken.patch

@@ -0,0 +1,315 @@
+From 3f314cc8251f62f592013abe7b1c3b977de0699a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Fri, 4 Aug 2017 02:33:14 +0200
+Subject: ntdll: Implement NtFilterToken.
+
+---
+ dlls/ntdll/nt.c       | 59 ++++++++++++++++++++++++++++++++++++
+ dlls/ntdll/ntdll.spec |  2 +-
+ include/winnt.h       |  5 +++
+ include/winternl.h    |  1 +
+ server/process.c      |  2 +-
+ server/protocol.def   | 10 ++++++
+ server/security.h     |  4 ++-
+ server/token.c        | 84 +++++++++++++++++++++++++++++++++++++++++++++++++--
+ 8 files changed, 162 insertions(+), 5 deletions(-)
+
+diff --git a/dlls/ntdll/nt.c b/dlls/ntdll/nt.c
+index 93554e929be..5822dec9b15 100644
+--- a/dlls/ntdll/nt.c
++++ b/dlls/ntdll/nt.c
+@@ -136,6 +136,65 @@ NTSTATUS WINAPI NtDuplicateToken(
+ }
+ 
+ /******************************************************************************
++ *  NtFilterToken        [NTDLL.@]
++ *  ZwFilterToken        [NTDLL.@]
++ */
++NTSTATUS WINAPI NtFilterToken( HANDLE token, ULONG flags, TOKEN_GROUPS *disable_sids,
++                               TOKEN_PRIVILEGES *privileges, TOKEN_GROUPS *restrict_sids,
++                               HANDLE *new_token )
++{
++    data_size_t privileges_len = 0;
++    data_size_t sids_len = 0;
++    SID *sids = NULL;
++    NTSTATUS status;
++
++    TRACE( "(%p, 0x%08x, %p, %p, %p, %p)\n", token, flags, disable_sids, privileges,
++           restrict_sids, new_token );
++
++    if (flags)
++        FIXME( "flags %x unsupported\n", flags );
++
++    if (restrict_sids)
++        FIXME( "support for restricting sids not yet implemented\n" );
++
++    if (privileges)
++        privileges_len = privileges->PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
++
++    if (disable_sids)
++    {
++        DWORD len, i;
++        BYTE *tmp;
++
++        for (i = 0; i < disable_sids->GroupCount; i++)
++            sids_len += RtlLengthSid( disable_sids->Groups[i].Sid );
++
++        sids = RtlAllocateHeap( GetProcessHeap(), 0, sids_len );
++        if (!sids) return STATUS_NO_MEMORY;
++
++        for (i = 0, tmp = (BYTE *)sids; i < disable_sids->GroupCount; i++, tmp += len)
++        {
++            len = RtlLengthSid( disable_sids->Groups[i].Sid );
++            memcpy( tmp, disable_sids->Groups[i].Sid, len );
++        }
++    }
++
++    SERVER_START_REQ( filter_token )
++    {
++        req->handle          = wine_server_obj_handle( token );
++        req->flags           = flags;
++        req->privileges_size = privileges_len;
++        wine_server_add_data( req, privileges->Privileges, privileges_len );
++        wine_server_add_data( req, sids, sids_len );
++        status = wine_server_call( req );
++        if (!status) *new_token = wine_server_ptr_handle( reply->new_handle );
++    }
++    SERVER_END_REQ;
++
++    RtlFreeHeap( GetProcessHeap(), 0, sids );
++    return status;
++}
++
++/******************************************************************************
+  *  NtOpenProcessToken		[NTDLL.@]
+  *  ZwOpenProcessToken		[NTDLL.@]
+  */
+diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
+index 4f7ee496437..275fda57970 100644
+--- a/dlls/ntdll/ntdll.spec
++++ b/dlls/ntdll/ntdll.spec
+@@ -179,7 +179,7 @@
+ # @ stub NtEnumerateSystemEnvironmentValuesEx
+ @ stdcall NtEnumerateValueKey(long long long ptr long ptr)
+ @ stub NtExtendSection
+-# @ stub NtFilterToken
++@ stdcall NtFilterToken(long long ptr ptr ptr ptr)
+ @ stdcall NtFindAtom(ptr long ptr)
+ @ stdcall NtFlushBuffersFile(long ptr)
+ @ stdcall NtFlushInstructionCache(long ptr long)
+diff --git a/include/winnt.h b/include/winnt.h
+index f91f81eb559..891c9b6d4bb 100644
+--- a/include/winnt.h
++++ b/include/winnt.h
+@@ -3844,6 +3844,11 @@ typedef enum _TOKEN_INFORMATION_CLASS {
+ 					TOKEN_ADJUST_SESSIONID | \
+ 					TOKEN_ADJUST_DEFAULT )
+ 
++#define DISABLE_MAX_PRIVILEGE 0x1
++#define SANDBOX_INERT         0x2
++#define LUA_TOKEN             0x4
++#define WRITE_RESTRICTED      0x8
++
+ #ifndef _SECURITY_DEFINED
+ #define _SECURITY_DEFINED
+ 
+diff --git a/include/winternl.h b/include/winternl.h
+index 140669b0105..899e8324d67 100644
+--- a/include/winternl.h
++++ b/include/winternl.h
+@@ -2348,6 +2348,7 @@ NTSYSAPI NTSTATUS  WINAPI NtDuplicateToken(HANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES
+ NTSYSAPI NTSTATUS  WINAPI NtEnumerateKey(HANDLE,ULONG,KEY_INFORMATION_CLASS,void *,DWORD,DWORD *);
+ NTSYSAPI NTSTATUS  WINAPI NtEnumerateValueKey(HANDLE,ULONG,KEY_VALUE_INFORMATION_CLASS,PVOID,ULONG,PULONG);
+ NTSYSAPI NTSTATUS  WINAPI NtExtendSection(HANDLE,PLARGE_INTEGER);
++NTSYSAPI NTSTATUS  WINAPI NtFilterToken(HANDLE,ULONG,TOKEN_GROUPS*,TOKEN_PRIVILEGES*,TOKEN_GROUPS*,HANDLE*);
+ NTSYSAPI NTSTATUS  WINAPI NtFindAtom(const WCHAR*,ULONG,RTL_ATOM*);
+ NTSYSAPI NTSTATUS  WINAPI NtFlushBuffersFile(HANDLE,IO_STATUS_BLOCK*);
+ NTSYSAPI NTSTATUS  WINAPI NtFlushInstructionCache(HANDLE,LPCVOID,SIZE_T);
+diff --git a/server/process.c b/server/process.c
+index cbe726afe81..f0f60edcd3f 100644
+--- a/server/process.c
++++ b/server/process.c
+@@ -571,7 +571,7 @@ struct thread *create_process( int fd, struct thread *parent_thread, int inherit
+                                        : alloc_handle_table( process, 0 );
+         /* Note: for security reasons, starting a new process does not attempt
+          * to use the current impersonation token for the new process */
+-        process->token = token_duplicate( parent->token, TRUE, 0, NULL );
++        process->token = token_duplicate( parent->token, TRUE, 0, NULL, NULL, 0, NULL, 0 );
+         process->affinity = parent->affinity;
+     }
+     if (!process->handles || !process->token) goto error;
+diff --git a/server/protocol.def b/server/protocol.def
+index fc6e343af52..b3dce66eb9c 100644
+--- a/server/protocol.def
++++ b/server/protocol.def
+@@ -3391,6 +3391,16 @@ enum caret_state
+     obj_handle_t  new_handle; /* duplicated handle */
+ @END
+ 
++@REQ(filter_token)
++    obj_handle_t  handle;          /* handle to the token to duplicate */
++    unsigned int  flags;           /* flags */
++    data_size_t   privileges_size; /* size of privileges */
++    VARARG(privileges,LUID_AND_ATTRIBUTES,privileges_size); /* privileges to remove from new token */
++    VARARG(disable_sids,SID);      /* array of groups to remove from new token */
++@REPLY
++    obj_handle_t  new_handle;      /* filtered handle */
++@END
++
+ @REQ(access_check)
+     obj_handle_t    handle; /* handle to the token */
+     unsigned int    desired_access; /* desired access to the object */
+diff --git a/server/security.h b/server/security.h
+index 606dbb2ab2c..6c337143c3d 100644
+--- a/server/security.h
++++ b/server/security.h
+@@ -56,7 +56,9 @@ extern const PSID security_high_label_sid;
+ extern struct token *token_create_admin(void);
+ extern int token_assign_label( struct token *token, PSID label );
+ extern struct token *token_duplicate( struct token *src_token, unsigned primary,
+-                                      int impersonation_level, const struct security_descriptor *sd );
++                                      int impersonation_level, const struct security_descriptor *sd,
++                                      const LUID_AND_ATTRIBUTES *filter_privileges, unsigned int priv_count,
++                                      const SID *filter_groups, unsigned int group_count );
+ extern int token_check_privileges( struct token *token, int all_required,
+                                    const LUID_AND_ATTRIBUTES *reqprivs,
+                                    unsigned int count, LUID_AND_ATTRIBUTES *usedprivs);
+diff --git a/server/token.c b/server/token.c
+index 74db66e1e24..acd7a4dedb5 100644
+--- a/server/token.c
++++ b/server/token.c
+@@ -299,6 +299,19 @@ static int acl_is_valid( const ACL *acl, data_size_t size )
+     return TRUE;
+ }
+ 
++static unsigned int get_sid_count( const SID *sid, data_size_t size )
++{
++    unsigned int count;
++
++    for (count = 0; size >= sizeof(SID) && security_sid_len( sid ) <= size; count++)
++    {
++        size -= security_sid_len( sid );
++        sid = (const SID *)((char *)sid + security_sid_len( sid ));
++    }
++
++    return count;
++}
++
+ /* checks whether all members of a security descriptor fit inside the size
+  * of memory specified */
+ int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
+@@ -639,8 +652,36 @@ static struct token *create_token( unsigned primary, const SID *user,
+     return token;
+ }
+ 
++static int filter_group( struct group *group, const SID *filter, unsigned int count )
++{
++    unsigned int i;
++
++    for (i = 0; i < count; i++)
++    {
++        if (security_equal_sid( &group->sid, filter )) return 1;
++        filter = (const SID *)((char *)filter + security_sid_len( filter ));
++    }
++
++    return 0;
++}
++
++static int filter_privilege( struct privilege *privilege, const LUID_AND_ATTRIBUTES *filter, unsigned int count )
++{
++    unsigned int i;
++
++    for (i = 0; i < count; i++)
++    {
++        if (!memcmp( &privilege->luid, &filter[i].Luid, sizeof(LUID) ))
++            return 1;
++    }
++
++    return 0;
++}
++
+ struct token *token_duplicate( struct token *src_token, unsigned primary,
+-                               int impersonation_level, const struct security_descriptor *sd )
++                               int impersonation_level, const struct security_descriptor *sd,
++                               const LUID_AND_ATTRIBUTES *filter_privileges, unsigned int priv_count,
++                               const SID *filter_groups, unsigned int group_count)
+ {
+     const luid_t *modified_id =
+         primary || (impersonation_level == src_token->impersonation_level) ?
+@@ -676,6 +717,12 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
+             return NULL;
+         }
+         memcpy( newgroup, group, size );
++        if (filter_group( group, filter_groups, group_count ))
++        {
++            newgroup->enabled = 0;
++            newgroup->def = 0;
++            newgroup->deny_only = 1;
++        }
+         list_add_tail( &token->groups, &newgroup->entry );
+         if (src_token->primary_group == &group->sid)
+             token->primary_group = &newgroup->sid;
+@@ -684,11 +731,14 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
+ 
+     /* copy privileges */
+     LIST_FOR_EACH_ENTRY( privilege, &src_token->privileges, struct privilege, entry )
++    {
++        if (filter_privilege( privilege, filter_privileges, priv_count )) continue;
+         if (!privilege_add( token, &privilege->luid, privilege->enabled ))
+         {
+             release_object( token );
+             return NULL;
+         }
++    }
+ 
+     if (sd) default_set_sd( &token->obj, sd, OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION |
+                             DACL_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION );
+@@ -1322,7 +1372,7 @@ DECL_HANDLER(duplicate_token)
+                                                      TOKEN_DUPLICATE,
+                                                      &token_ops )))
+     {
+-        struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd );
++        struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd, NULL, 0, NULL, 0 );
+         if (token)
+         {
+             reply->new_handle = alloc_handle_no_access_check( current->process, token, req->access, objattr->attributes );
+@@ -1332,6 +1382,36 @@ DECL_HANDLER(duplicate_token)
+     }
+ }
+ 
++/* creates a restricted version of a token */
++DECL_HANDLER(filter_token)
++{
++    struct token *src_token;
++
++    if ((src_token = (struct token *)get_handle_obj( current->process, req->handle,
++                                                     TOKEN_DUPLICATE,
++                                                     &token_ops )))
++    {
++        const LUID_AND_ATTRIBUTES *filter_privileges = get_req_data();
++        unsigned int priv_count, group_count;
++        const SID *filter_groups;
++        struct token *token;
++
++        priv_count = min( req->privileges_size, get_req_data_size() ) / sizeof(LUID_AND_ATTRIBUTES);
++        filter_groups = (const SID *)((char *)filter_privileges + priv_count * sizeof(LUID_AND_ATTRIBUTES));
++        group_count = get_sid_count( filter_groups, get_req_data_size() - priv_count * sizeof(LUID_AND_ATTRIBUTES) );
++
++        token = token_duplicate( src_token, src_token->primary, src_token->impersonation_level, NULL,
++                                 filter_privileges, priv_count, filter_groups, group_count );
++        if (token)
++        {
++            unsigned int access = get_handle_access( current->process, req->handle );
++            reply->new_handle = alloc_handle_no_access_check( current->process, token, access, 0 );
++            release_object( token );
++        }
++        release_object( src_token );
++    }
++}
++
+ /* checks the specified privileges are held by the token */
+ DECL_HANDLER(check_token_privileges)
+ {
+-- 
+2.13.1
+

patches/advapi32-CreateRestrictedToken/0002-advapi32-Implement-CreateRestrictedToken.patch

@@ -0,0 +1,271 @@
+From 2a1064c5f90beac2bd709ab5d1c454c90a16189b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Fri, 4 Aug 2017 02:51:57 +0200
+Subject: advapi32: Implement CreateRestrictedToken.
+
+---
+ dlls/advapi32/security.c       | 88 +++++++++++++++++++++++++++++++++++-------
+ dlls/advapi32/tests/security.c | 88 +++++++++++++++++++++++++++++++++++++++---
+ 2 files changed, 157 insertions(+), 19 deletions(-)
+
+diff --git a/dlls/advapi32/security.c b/dlls/advapi32/security.c
+index 82bb6689d43..c531e45c9a0 100644
+--- a/dlls/advapi32/security.c
++++ b/dlls/advapi32/security.c
+@@ -840,6 +840,60 @@ BOOL WINAPI SetThreadToken(PHANDLE thread, HANDLE token)
+                                                  ThreadImpersonationToken, &token, sizeof token ));
+ }
+ 
++static BOOL allocate_groups(TOKEN_GROUPS **groups_ret, SID_AND_ATTRIBUTES *sids, DWORD count)
++{
++    TOKEN_GROUPS *groups;
++    DWORD i;
++
++    if (!count)
++    {
++        *groups_ret = NULL;
++        return TRUE;
++    }
++
++    groups = (TOKEN_GROUPS *)heap_alloc(FIELD_OFFSET(TOKEN_GROUPS, Groups) +
++                                        count * sizeof(SID_AND_ATTRIBUTES));
++    if (!groups)
++    {
++        SetLastError(ERROR_OUTOFMEMORY);
++        return FALSE;
++    }
++
++    groups->GroupCount = count;
++    for (i = 0; i < count; i++)
++        groups->Groups[i] = sids[i];
++
++    *groups_ret = groups;
++    return TRUE;
++}
++
++static BOOL allocate_privileges(TOKEN_PRIVILEGES **privileges_ret, LUID_AND_ATTRIBUTES *privs, DWORD count)
++{
++    TOKEN_PRIVILEGES *privileges;
++    DWORD i;
++
++    if (!count)
++    {
++        *privileges_ret = NULL;
++        return TRUE;
++    }
++
++    privileges = (TOKEN_PRIVILEGES *)heap_alloc(FIELD_OFFSET(TOKEN_PRIVILEGES, Privileges) +
++                                                count * sizeof(LUID_AND_ATTRIBUTES));
++    if (!privileges)
++    {
++        SetLastError(ERROR_OUTOFMEMORY);
++        return FALSE;
++    }
++
++    privileges->PrivilegeCount = count;
++    for (i = 0; i < count; i++)
++        privileges->Privileges[i] = privs[i];
++
++    *privileges_ret = privileges;
++    return TRUE;
++}
++
+ /*************************************************************************
+  * CreateRestrictedToken [ADVAPI32.@]
+  *
+@@ -871,25 +925,33 @@ BOOL WINAPI CreateRestrictedToken(
+     PSID_AND_ATTRIBUTES restrictSids,
+     PHANDLE newToken)
+ {
+-    TOKEN_TYPE type;
+-    SECURITY_IMPERSONATION_LEVEL level = SecurityAnonymous;
+-    DWORD size;
++    TOKEN_PRIVILEGES *delete_privs = NULL;
++    TOKEN_GROUPS *disable_groups = NULL;
++    TOKEN_GROUPS *restrict_sids = NULL;
++    BOOL ret = FALSE;
+ 
+-    FIXME("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p): stub\n",
++    TRACE("(%p, 0x%x, %u, %p, %u, %p, %u, %p, %p)\n",
+           baseToken, flags, nDisableSids, disableSids,
+           nDeletePrivs, deletePrivs,
+           nRestrictSids, restrictSids,
+           newToken);
+ 
+-    size = sizeof(type);
+-    if (!GetTokenInformation( baseToken, TokenType, &type, size, &size )) return FALSE;
+-    if (type == TokenImpersonation)
+-    {
+-        size = sizeof(level);
+-        if (!GetTokenInformation( baseToken, TokenImpersonationLevel, &level, size, &size ))
+-            return FALSE;
+-    }
+-    return DuplicateTokenEx( baseToken, MAXIMUM_ALLOWED, NULL, level, type, newToken );
++    if (!allocate_groups(&disable_groups, disableSids, nDisableSids))
++        goto done;
++
++    if (!allocate_privileges(&delete_privs, deletePrivs, nDeletePrivs))
++        goto done;
++
++    if (!allocate_groups(&restrict_sids, restrictSids, nRestrictSids))
++        goto done;
++
++    ret = set_ntstatus(NtFilterToken(baseToken, flags, disable_groups, delete_privs, restrict_sids, newToken));
++
++done:
++    heap_free(disable_groups);
++    heap_free(delete_privs);
++    heap_free(restrict_sids);
++    return ret;
+ }
+ 
+ /*	##############################
+diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c
+index a1ecc409b73..0fd41fe82fa 100644
+--- a/dlls/advapi32/tests/security.c
++++ b/dlls/advapi32/tests/security.c
+@@ -5292,10 +5292,13 @@ static void test_GetUserNameW(void)
+ 
+ static void test_CreateRestrictedToken(void)
+ {
++    TOKEN_PRIMARY_GROUP *primary_group, *primary_group2;
+     HANDLE process_token, token, r_token;
+     PTOKEN_GROUPS token_groups, groups2;
+     SID_AND_ATTRIBUTES sattr;
+     SECURITY_IMPERSONATION_LEVEL level;
++    TOKEN_PRIVILEGES *privs;
++    PRIVILEGE_SET privset;
+     TOKEN_TYPE type;
+     BOOL is_member;
+     DWORD size;
+@@ -5311,7 +5314,7 @@ static void test_CreateRestrictedToken(void)
+     ret = OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE|TOKEN_QUERY, &process_token);
+     ok(ret, "got error %d\n", GetLastError());
+ 
+-    ret = DuplicateTokenEx(process_token, TOKEN_DUPLICATE|TOKEN_ADJUST_GROUPS|TOKEN_QUERY,
++    ret = DuplicateTokenEx(process_token, TOKEN_DUPLICATE|TOKEN_ADJUST_GROUPS|TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,
+         NULL, SecurityImpersonation, TokenImpersonation, &token);
+     ok(ret, "got error %d\n", GetLastError());
+ 
+@@ -5342,11 +5345,21 @@ static void test_CreateRestrictedToken(void)
+     ok(ret, "got error %d\n", GetLastError());
+     ok(is_member, "not a member\n");
+ 
+-    /* disable a SID in new token */
++    privset.PrivilegeCount = 1;
++    privset.Control = PRIVILEGE_SET_ALL_NECESSARY;
++    ret = LookupPrivilegeValueA(NULL, "SeChangeNotifyPrivilege", &privset.Privilege[0].Luid);
++    ok(ret, "got error %d\n", GetLastError());
++
++    is_member = FALSE;
++    ret = PrivilegeCheck(token, &privset, &is_member);
++    ok(ret, "got error %d\n", GetLastError());
++    ok(is_member, "Expected SeChangeNotifyPrivilege to be enabled\n");
++
++    /* disable a SID and a privilege in new token */
+     sattr.Sid = token_groups->Groups[i].Sid;
+     sattr.Attributes = 0;
+     r_token = NULL;
+-    ret = pCreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token);
++    ret = pCreateRestrictedToken(token, 0, 1, &sattr, 1, &privset.Privilege[0], 0, NULL, &r_token);
+     ok(ret, "got error %d\n", GetLastError());
+ 
+     if (ret)
+@@ -5355,7 +5368,7 @@ static void test_CreateRestrictedToken(void)
+         is_member = TRUE;
+         ret = pCheckTokenMembership(r_token, token_groups->Groups[i].Sid, &is_member);
+         ok(ret, "got error %d\n", GetLastError());
+-        todo_wine ok(!is_member, "not a member\n");
++        ok(!is_member, "not a member\n");
+ 
+         ret = GetTokenInformation(r_token, TokenGroups, NULL, 0, &size);
+         ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n",
+@@ -5370,9 +5383,9 @@ static void test_CreateRestrictedToken(void)
+                 break;
+         }
+ 
+-        todo_wine ok(groups2->Groups[j].Attributes & SE_GROUP_USE_FOR_DENY_ONLY,
++        ok(groups2->Groups[j].Attributes & SE_GROUP_USE_FOR_DENY_ONLY,
+             "got wrong attributes\n");
+-        todo_wine ok((groups2->Groups[j].Attributes & SE_GROUP_ENABLED) == 0,
++        ok((groups2->Groups[j].Attributes & SE_GROUP_ENABLED) == 0,
+             "got wrong attributes\n");
+ 
+         HeapFree(GetProcessHeap(), 0, groups2);
+@@ -5386,10 +5399,73 @@ static void test_CreateRestrictedToken(void)
+         ret = GetTokenInformation(r_token, TokenImpersonationLevel, &level, size, &size);
+         ok(ret, "got error %d\n", GetLastError());
+         ok(level == SecurityImpersonation, "got level %u\n", type);
++
++        is_member = TRUE;
++        ret = PrivilegeCheck(r_token, &privset, &is_member);
++        ok(ret, "got error %d\n", GetLastError());
++        ok(!is_member, "Expected SeChangeNotifyPrivilege not to be enabled\n");
++
++        ret = GetTokenInformation(r_token, TokenPrivileges, NULL, 0, &size);
++        ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n",
++            ret, GetLastError());
++        privs = HeapAlloc(GetProcessHeap(), 0, size);
++        ret = GetTokenInformation(r_token, TokenPrivileges, privs, size, &size);
++        ok(ret, "got error %d\n", GetLastError());
++
++        is_member = FALSE;
++        for (j = 0; j < privs->PrivilegeCount; j++)
++        {
++            if (RtlEqualLuid(&privs->Privileges[j].Luid, &privset.Privilege[0].Luid))
++            {
++                is_member = TRUE;
++                break;
++            }
++        }
++
++        ok(!is_member, "Expected not to find privilege\n");
++        HeapFree(GetProcessHeap(), 0, privs);
+     }
+ 
+     HeapFree(GetProcessHeap(), 0, token_groups);
+     CloseHandle(r_token);
++
++    ret = GetTokenInformation(token, TokenPrimaryGroup, NULL, 0, &size);
++    ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n",
++        ret, GetLastError());
++    primary_group = HeapAlloc(GetProcessHeap(), 0, size);
++    ret = GetTokenInformation(token, TokenPrimaryGroup, primary_group, size, &size);
++    ok(ret, "got error %d\n", GetLastError());
++
++    /* disable primary group */
++    sattr.Sid = primary_group->PrimaryGroup;
++    sattr.Attributes = 0;
++    r_token = NULL;
++    ret = pCreateRestrictedToken(token, 0, 1, &sattr, 0, NULL, 0, NULL, &r_token);
++    ok(ret, "got error %d\n", GetLastError());
++
++    if (ret)
++    {
++        is_member = TRUE;
++        ret = pCheckTokenMembership(r_token, primary_group->PrimaryGroup, &is_member);
++        ok(ret, "got error %d\n", GetLastError());
++        ok(!is_member, "not a member\n");
++
++        ret = GetTokenInformation(r_token, TokenPrimaryGroup, NULL, 0, &size);
++        ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER, "got %d with error %d\n",
++            ret, GetLastError());
++        primary_group2 = HeapAlloc(GetProcessHeap(), 0, size);
++        ret = GetTokenInformation(r_token, TokenPrimaryGroup, primary_group2, size, &size);
++        ok(ret, "got error %d\n", GetLastError());
++
++        ok(EqualSid(primary_group2->PrimaryGroup, primary_group->PrimaryGroup),
++           "Expected same primary group\n");
++
++        HeapFree(GetProcessHeap(), 0, primary_group2);
++    }
++
++    HeapFree(GetProcessHeap(), 0, primary_group);
++    CloseHandle(r_token);
++
+     CloseHandle(token);
+     CloseHandle(process_token);
+ }
+-- 
+2.13.1
+

patches/advapi32-CreateRestrictedToken/0003-server-Correctly-validate-SID-length-in-sd_is_valid.patch

@@ -0,0 +1,36 @@
+From 22a49dfa50cda9b1f5a5c64eabed2d17b0033896 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Fri, 4 Aug 2017 02:52:50 +0200
+Subject: server: Correctly validate SID length in sd_is_valid.
+
+---
+ server/token.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/server/token.c b/server/token.c
+index acd7a4dedb5..7ab0f634c05 100644
+--- a/server/token.c
++++ b/server/token.c
+@@ -332,8 +332,7 @@ int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
+     owner = sd_get_owner( sd );
+     if (owner)
+     {
+-        size_t needed_size = security_sid_len( owner );
+-        if ((sd->owner_len < sizeof(SID)) || (needed_size > sd->owner_len))
++        if ((sd->owner_len < sizeof(SID)) || (security_sid_len( owner ) > sd->owner_len))
+             return FALSE;
+     }
+     offset += sd->owner_len;
+@@ -344,8 +343,7 @@ int sd_is_valid( const struct security_descriptor *sd, data_size_t size )
+     group = sd_get_group( sd );
+     if (group)
+     {
+-        size_t needed_size = security_sid_len( group );
+-        if ((sd->group_len < sizeof(SID)) || (needed_size > sd->group_len))
++        if ((sd->group_len < sizeof(SID)) || (security_sid_len( group ) > sd->group_len))
+             return FALSE;
+     }
+     offset += sd->group_len;
+-- 
+2.13.1
+

patches/advapi32-CreateRestrictedToken/definition

@@ -0,0 +1 @@
+Fixes: Implement advapi32.CreateRestrictedToken

patches/advapi32-Token_Integrity_Level/0001-advapi32-tests-Extend-security-label-token-integrity.patch

@@ -0,0 +1,456 @@
+From ba50fc98ee4690e62899d48efc856c2bc910536c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Mon, 7 Aug 2017 01:25:02 +0200
+Subject: advapi32/tests: Extend security label / token integrity tests.
+
+---
+ dlls/advapi32/tests/Makefile.in |   2 +-
+ dlls/advapi32/tests/security.c  | 389 +++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 387 insertions(+), 4 deletions(-)
+
+diff --git a/dlls/advapi32/tests/Makefile.in b/dlls/advapi32/tests/Makefile.in
+index 36ce031ef62..4437e6e5de7 100644
+--- a/dlls/advapi32/tests/Makefile.in
++++ b/dlls/advapi32/tests/Makefile.in
+@@ -1,5 +1,5 @@
+ TESTDLL   = advapi32.dll
+-IMPORTS   = ole32 advapi32
++IMPORTS   = ole32 user32 advapi32
+ 
+ C_SRCS = \
+ 	cred.c \
+diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c
+index 0fd41fe82fa..4a03db27e69 100644
+--- a/dlls/advapi32/tests/security.c
++++ b/dlls/advapi32/tests/security.c
+@@ -7191,13 +7191,19 @@ static void test_token_security_descriptor(void)
+ {
+     static SID low_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
+                             {SECURITY_MANDATORY_LOW_RID}};
++    static SID medium_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
++                               {SECURITY_MANDATORY_MEDIUM_RID}};
++    static SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
++                             {SECURITY_MANDATORY_HIGH_RID}};
+     char buffer_sd[SECURITY_DESCRIPTOR_MIN_LENGTH];
+-    SECURITY_DESCRIPTOR *sd = (SECURITY_DESCRIPTOR *)&buffer_sd, *sd2;
++    SECURITY_DESCRIPTOR *sd = (SECURITY_DESCRIPTOR *)&buffer_sd, *sd2, *sd3;
+     char buffer_acl[256], buffer[MAX_PATH];
+-    ACL *acl = (ACL *)&buffer_acl, *acl2, *acl_child;
++    ACL *acl = (ACL *)&buffer_acl, *acl2, *acl_child, *sacl;
+     BOOL defaulted, present, ret, found;
+-    HANDLE token, token2, token3;
++    HANDLE token, token2, token3, token4, token5, token6;
+     EXPLICIT_ACCESSW exp_access;
++    TOKEN_MANDATORY_LABEL *tml;
++    BYTE buffer_integrity[64];
+     PROCESS_INFORMATION info;
+     DWORD size, index, retd;
+     ACCESS_ALLOWED_ACE *ace;
+@@ -7347,6 +7353,185 @@ static void test_token_security_descriptor(void)
+     /* The security label is also not inherited */
+     if (pAddMandatoryAce)
+     {
++        memset(buffer_integrity, 0, sizeof(buffer_integrity));
++        ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size);
++        ok(ret, "GetTokenInformation failed with error %u\n", GetLastError());
++        tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity;
++        ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level),
++           "Expected medium or high integrity level\n");
++
++        if (EqualSid(tml->Label.Sid, &high_level))
++        {
++            DWORD process_id;
++            HANDLE process;
++            HWND shell;
++
++            /* This test tries to get a medium token and then impersonates this token. The
++             * idea is to check whether the sd label of a newly created token depends on the
++             * current active token or the integrity level of the newly created token. */
++
++             /* Steal process token of the explorer.exe process */
++            shell = GetShellWindow();
++            todo_wine ok(shell != NULL, "Failed to get shell window\n");
++            if (!shell) shell = GetDesktopWindow();  /* FIXME: Workaround for Wine */
++            ok(GetWindowThreadProcessId(shell, &process_id),
++               "Failed to get process id of shell window: %u\n", GetLastError());
++            process = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, process_id);
++            ok(process != NULL, "Failed to open process: %u\n", GetLastError());
++            ok(OpenProcessToken(process, TOKEN_ALL_ACCESS, &token4),
++               "Failed to open process token: %u\n", GetLastError());
++            CloseHandle(process);
++
++            /* Check TokenIntegrityLevel and LABEL_SECURITY_INFORMATION of explorer.exe token */
++            memset(buffer_integrity, 0, sizeof(buffer_integrity));
++            ret = GetTokenInformation(token4, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size);
++            ok(ret, "GetTokenInformation failed with error %u\n", GetLastError());
++            tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity;
++            todo_wine ok(EqualSid(tml->Label.Sid, &medium_level), "Expected medium integrity level\n");
++
++            size = 0;
++            ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size);
++            ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
++               "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError());
++
++            sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size);
++            ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, sd3, size, &size);
++            ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
++
++            sacl = NULL;
++            ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted);
++            ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
++            ok(present, "No SACL in the security descriptor\n");
++            ok(sacl != NULL, "NULL SACL in the security descriptor\n");
++
++            if (sacl)
++            {
++                ret = pGetAce(sacl, 0, (void **)&ace);
++                ok(ret, "GetAce failed with error %u\n", GetLastError());
++                ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
++                   "Unexpected ACE type %#x\n", ace->Header.AceType);
++                todo_wine ok(EqualSid(&ace->SidStart, &medium_level),
++                   "Expected medium integrity level\n");
++            }
++
++            HeapFree(GetProcessHeap(), 0, sd3);
++
++            /* Start child process with the explorer.exe token */
++            memset(&startup, 0, sizeof(startup));
++            startup.cb = sizeof(startup);
++            startup.dwFlags = STARTF_USESHOWWINDOW;
++            startup.wShowWindow = SW_SHOWNORMAL;
++
++            sprintf(buffer, "%s tests/security.c test_token_sd_medium", myARGV[0]);
++            ret = CreateProcessAsUserA(token4, NULL, buffer, NULL, NULL, FALSE, 0, NULL, NULL, &startup, &info);
++            ok(ret || GetLastError() == ERROR_PRIVILEGE_NOT_HELD,
++                "CreateProcess failed with error %u\n", GetLastError());
++            if (ret)
++            {
++                winetest_wait_child_process(info.hProcess);
++                CloseHandle(info.hProcess);
++                CloseHandle(info.hThread);
++            }
++            else
++                win_skip("Skipping test for creating process with medium level token\n");
++
++            ret = DuplicateTokenEx(token4, 0, NULL, SecurityImpersonation, TokenImpersonation, &token5);
++            ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError());
++            ret = SetThreadToken(NULL, token5);
++            todo_wine ok(ret, "SetThreadToken failed with error %u\n", GetLastError());
++            CloseHandle(token4);
++
++            /* Restrict current process token while impersonating a medium integrity token */
++            ret = CreateRestrictedToken(token, 0, 0, NULL, 0, NULL, 0, NULL, &token6);
++            ok(ret, "CreateRestrictedToken failed with error %u\n", GetLastError());
++
++            memset(buffer_integrity, 0, sizeof(buffer_integrity));
++            ret = GetTokenInformation(token6, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size);
++            ok(ret, "GetTokenInformation failed with error %u\n", GetLastError());
++            tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity;
++            ok(EqualSid(tml->Label.Sid, &high_level), "Expected high integrity level\n");
++
++            size = 0;
++            ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, NULL, 0, &size);
++            ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
++               "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError());
++
++            sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size);
++            ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, sd3, size, &size);
++            ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
++
++            sacl = NULL;
++            ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted);
++            ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
++            todo_wine ok(present, "No SACL in the security descriptor\n");
++            todo_wine ok(sacl != NULL, "NULL SACL in the security descriptor\n");
++
++            if (sacl)
++            {
++                ret = pGetAce(sacl, 0, (void **)&ace);
++                ok(ret, "GetAce failed with error %u\n", GetLastError());
++                ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
++                   "Unexpected ACE type %#x\n", ace->Header.AceType);
++                ok(EqualSid(&ace->SidStart, &medium_level),
++                   "Expected medium integrity level\n");
++            }
++
++            HeapFree(GetProcessHeap(), 0, sd3);
++            RevertToSelf();
++            CloseHandle(token5);
++
++            /* Start child process with the restricted token */
++            sprintf(buffer, "%s tests/security.c test_token_sd_restricted", myARGV[0]);
++            ret = CreateProcessAsUserA(token6, NULL, buffer, NULL, NULL, FALSE, 0, NULL, NULL, &startup, &info);
++            ok(ret, "CreateProcess failed with error %u\n", GetLastError());
++            winetest_wait_child_process(info.hProcess);
++            CloseHandle(info.hProcess);
++            CloseHandle(info.hThread);
++            CloseHandle(token6);
++
++            /* DuplicateTokenEx should assign security label even when SA points to empty SD */
++            memset(sd, 0, sizeof(buffer_sd));
++            ret = InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION);
++            ok(ret, "InitializeSecurityDescriptor failed with error %u\n", GetLastError());
++
++            sa.nLength = sizeof(SECURITY_ATTRIBUTES);
++            sa.lpSecurityDescriptor = sd;
++            sa.bInheritHandle = FALSE;
++
++            ret = DuplicateTokenEx(token, 0, &sa, 0, TokenPrimary, &token6);
++            ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError());
++
++            size = 0;
++            ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, NULL, 0, &size);
++            todo_wine ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
++               "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError());
++
++            sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size);
++            ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, sd3, size, &size);
++            todo_wine ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
++
++            sacl = NULL;
++            ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted);
++            todo_wine ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
++            todo_wine ok(present, "No SACL in the security descriptor\n");
++            todo_wine ok(sacl != NULL, "NULL SACL in the security descriptor\n");
++
++            if (sacl)
++            {
++                ret = pGetAce(sacl, 0, (void **)&ace);
++                ok(ret, "GetAce failed with error %u\n", GetLastError());
++                ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
++                   "Unexpected ACE type %#x\n", ace->Header.AceType);
++                ok(EqualSid(&ace->SidStart, &high_level),
++                   "Expected high integrity level\n");
++            }
++
++            HeapFree(GetProcessHeap(), 0, sd3);
++            CloseHandle(token6);
++        }
++        else
++            skip("Skipping test, running without admin rights\n");
++
+         ret = InitializeAcl(acl, 256, ACL_REVISION);
+         ok(ret, "InitializeAcl failed with error %u\n", GetLastError());
+ 
+@@ -7362,6 +7547,90 @@ static void test_token_security_descriptor(void)
+ 
+         ret = SetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd);
+         ok(ret, "SetKernelObjectSecurity failed with error %u\n", GetLastError());
++
++        /* changing the label of the security descriptor does not change the integrity level of the token itself */
++        memset(buffer_integrity, 0, sizeof(buffer_integrity));
++        ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size);
++        ok(ret, "GetTokenInformation failed with error %u\n", GetLastError());
++        tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity;
++        ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level),
++            "Expected medium or high integrity level\n");
++
++        /* restricting / duplicating a token resets the mandatory sd label */
++        ret = CreateRestrictedToken(token, 0, 0, NULL, 0, NULL, 0, NULL, &token4);
++        ok(ret, "CreateRestrictedToken failed with error %u\n", GetLastError());
++
++        memset(buffer_integrity, 0, sizeof(buffer_integrity));
++        ret = GetTokenInformation(token4, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size);
++        ok(ret, "GetTokenInformation failed with error %u\n", GetLastError());
++        tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity;
++        ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level),
++            "Expected medium or high integrity level\n");
++
++        size = 0;
++        ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size);
++        ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
++           "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError());
++
++        sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size);
++        ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, sd3, size, &size);
++        ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
++
++        ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted);
++        ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
++        todo_wine ok(present, "No SACL in the security descriptor\n");
++        todo_wine ok(sacl != NULL, "NULL SACL in the security descriptor\n");
++
++        if (sacl)
++        {
++            ret = pGetAce(sacl, 0, (void **)&ace);
++            ok(ret, "GetAce failed with error %u\n", GetLastError());
++            ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
++               "Unexpected ACE type %#x\n", ace->Header.AceType);
++            ok(EqualSid(&ace->SidStart, &medium_level) || EqualSid(&ace->SidStart, &high_level),
++               "Low integrity level should not have been inherited\n");
++        }
++
++        HeapFree(GetProcessHeap(), 0, sd3);
++        CloseHandle(token4);
++
++        ret = DuplicateTokenEx(token, 0, NULL, 0, TokenPrimary, &token4);
++        ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError());
++
++        memset(buffer_integrity, 0, sizeof(buffer_integrity));
++        ret = GetTokenInformation(token4, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size);
++        ok(ret, "GetTokenInformation failed with error %u\n", GetLastError());
++        tml = (TOKEN_MANDATORY_LABEL*) buffer_integrity;
++        ok(EqualSid(tml->Label.Sid, &medium_level) || EqualSid(tml->Label.Sid, &high_level),
++            "Expected medium or high integrity level\n");
++
++        size = 0;
++        ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size);
++        todo_wine ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
++           "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError());
++
++        sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size);
++        ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, sd3, size, &size);
++        todo_wine ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
++
++        sacl = NULL;
++        ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted);
++        todo_wine ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
++        todo_wine ok(present, "No SACL in the security descriptor\n");
++        todo_wine ok(sacl != NULL, "NULL SACL in the security descriptor\n");
++
++        if (sacl)
++        {
++            ret = pGetAce(sacl, 0, (void **)&ace);
++            ok(ret, "GetAce failed with error %u\n", GetLastError());
++            ok(ace->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
++               "Unexpected ACE type %#x\n", ace->Header.AceType);
++            ok(EqualSid(&ace->SidStart, &medium_level) || EqualSid(&ace->SidStart, &high_level),
++               "Low integrity level should not have been inherited\n");
++        }
++
++        HeapFree(GetProcessHeap(), 0, sd3);
++        CloseHandle(token4);
+     }
+     else
+         win_skip("SYSTEM_MANDATORY_LABEL not supported\n");
+@@ -7467,6 +7736,116 @@ static void test_child_token_sd(void)
+     HeapFree(GetProcessHeap(), 0, sd);
+ }
+ 
++static void test_child_token_sd_restricted(void)
++{
++    static SID high_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
++                             {SECURITY_MANDATORY_HIGH_RID}};
++    SYSTEM_MANDATORY_LABEL_ACE *ace_label;
++    BOOL ret, present, defaulted;
++    TOKEN_MANDATORY_LABEL *tml;
++    BYTE buffer_integrity[64];
++    SECURITY_DESCRIPTOR *sd;
++    HANDLE token;
++    DWORD size;
++    ACL *acl;
++
++    if (!pAddMandatoryAce)
++    {
++        win_skip("SYSTEM_MANDATORY_LABEL not supported\n");
++        return;
++    }
++
++    ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &token);
++    ok(ret, "OpenProcessToken failed with error %u\n", GetLastError());
++
++    ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, NULL, 0, &size);
++    ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
++       "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError());
++
++    sd = HeapAlloc(GetProcessHeap(), 0, size);
++    ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd, size, &size);
++    ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
++
++    acl = NULL;
++    present = FALSE;
++    defaulted = TRUE;
++    ret = GetSecurityDescriptorSacl(sd, &present, &acl, &defaulted);
++    ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
++    ok(present, "SACL not present\n");
++    ok(acl && acl != (void *)0xdeadbeef, "Got invalid SACL\n");
++    ok(!defaulted, "SACL defaulted\n");
++    ok(acl->AceCount == 1, "Expected exactly one ACE\n");
++    ret = pGetAce(acl, 0, (void **)&ace_label);
++    ok(ret, "GetAce failed with error %u\n", GetLastError());
++    ok(ace_label->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
++       "Unexpected ACE type %#x\n", ace_label->Header.AceType);
++    ok(EqualSid(&ace_label->SidStart, &high_level),
++       "Expected high integrity level\n");
++
++    memset(buffer_integrity, 0, sizeof(buffer_integrity));
++    ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size);
++    ok(ret, "GetTokenInformation failed with error %u\n", GetLastError());
++    tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity;
++    ok(EqualSid(tml->Label.Sid, &high_level), "Expected high integrity level\n");
++
++    HeapFree(GetProcessHeap(), 0, sd);
++}
++
++static void test_child_token_sd_medium(void)
++{
++    static SID medium_level = {SID_REVISION, 1, {SECURITY_MANDATORY_LABEL_AUTHORITY},
++                               {SECURITY_MANDATORY_MEDIUM_RID}};
++    SYSTEM_MANDATORY_LABEL_ACE *ace_label;
++    BOOL ret, present, defaulted;
++    TOKEN_MANDATORY_LABEL *tml;
++    BYTE buffer_integrity[64];
++    SECURITY_DESCRIPTOR *sd;
++    HANDLE token;
++    DWORD size;
++    ACL *acl;
++
++    if (!pAddMandatoryAce)
++    {
++        win_skip("SYSTEM_MANDATORY_LABEL not supported\n");
++        return;
++    }
++
++    ret = OpenProcessToken(GetCurrentProcess(), MAXIMUM_ALLOWED, &token);
++    ok(ret, "OpenProcessToken failed with error %u\n", GetLastError());
++
++    ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, NULL, 0, &size);
++    ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
++       "Unexpected GetKernelObjectSecurity return value %d, error %u\n", ret, GetLastError());
++
++    sd = HeapAlloc(GetProcessHeap(), 0, size);
++    ret = GetKernelObjectSecurity(token, LABEL_SECURITY_INFORMATION, sd, size, &size);
++    ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
++
++    acl = NULL;
++    present = FALSE;
++    defaulted = TRUE;
++    ret = GetSecurityDescriptorSacl(sd, &present, &acl, &defaulted);
++    ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
++    ok(present, "SACL not present\n");
++    ok(acl && acl != (void *)0xdeadbeef, "Got invalid SACL\n");
++    ok(!defaulted, "SACL defaulted\n");
++    ok(acl->AceCount == 1, "Expected exactly one ACE\n");
++    ret = pGetAce(acl, 0, (void **)&ace_label);
++    ok(ret, "GetAce failed with error %u\n", GetLastError());
++    ok(ace_label->Header.AceType == SYSTEM_MANDATORY_LABEL_ACE_TYPE,
++       "Unexpected ACE type %#x\n", ace_label->Header.AceType);
++    todo_wine ok(EqualSid(&ace_label->SidStart, &medium_level),
++       "Expected medium integrity level\n");
++
++    memset(buffer_integrity, 0, sizeof(buffer_integrity));
++    ret = GetTokenInformation(token, TokenIntegrityLevel, buffer_integrity, sizeof(buffer_integrity), &size);
++    ok(ret, "GetTokenInformation failed with error %u\n", GetLastError());
++    tml = (TOKEN_MANDATORY_LABEL *)buffer_integrity;
++    todo_wine ok(EqualSid(tml->Label.Sid, &medium_level), "Expected medium integrity level\n");
++
++    HeapFree(GetProcessHeap(), 0, sd);
++}
++
+ static void test_GetExplicitEntriesFromAclW(void)
+ {
+     static const WCHAR wszCurrentUser[] = { 'C','U','R','R','E','N','T','_','U','S','E','R','\0'};
+@@ -7653,6 +8032,10 @@ START_TEST(security)
+     {
+         if (!strcmp(myARGV[2], "test_token_sd"))
+             test_child_token_sd();
++        else if (!strcmp(myARGV[2], "test_token_sd_restricted"))
++            test_child_token_sd_restricted();
++        else if (!strcmp(myARGV[2], "test_token_sd_medium"))
++            test_child_token_sd_medium();
+         else
+             test_process_security_child();
+         return;
+-- 
+2.13.1
+

patches/advapi32-Token_Integrity_Level/0002-server-Implement-token-elevation-information.patch

@@ -0,0 +1,136 @@
+From 4b428e09733605affb987d369f56ec09d2525858 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Sat, 5 Aug 2017 00:26:03 +0200
+Subject: server: Implement token elevation information.
+
+---
+ dlls/ntdll/nt.c     | 16 ++++++++++++----
+ server/protocol.def |  8 ++++++++
+ server/token.c      | 22 +++++++++++++++++++---
+ 3 files changed, 39 insertions(+), 7 deletions(-)
+
+diff --git a/dlls/ntdll/nt.c b/dlls/ntdll/nt.c
+index 5822dec9b15..dda6cabe1cf 100644
+--- a/dlls/ntdll/nt.c
++++ b/dlls/ntdll/nt.c
+@@ -597,18 +597,26 @@ NTSTATUS WINAPI NtQueryInformationToken(
+         SERVER_END_REQ;
+         break;
+     case TokenElevationType:
++        SERVER_START_REQ( get_token_elevation_type )
+         {
+             TOKEN_ELEVATION_TYPE *elevation_type = tokeninfo;
+-            FIXME("QueryInformationToken( ..., TokenElevationType, ...) semi-stub\n");
+-            *elevation_type = TokenElevationTypeFull;
++            req->handle = wine_server_obj_handle( token );
++            status = wine_server_call( req );
++            if (status == STATUS_SUCCESS)
++                *elevation_type = reply->elevation;
+         }
++        SERVER_END_REQ;
+         break;
+     case TokenElevation:
++        SERVER_START_REQ( get_token_elevation_type )
+         {
+             TOKEN_ELEVATION *elevation = tokeninfo;
+-            FIXME("QueryInformationToken( ..., TokenElevation, ...) semi-stub\n");
+-            elevation->TokenIsElevated = TRUE;
++            req->handle = wine_server_obj_handle( token );
++            status = wine_server_call( req );
++            if (status == STATUS_SUCCESS)
++                elevation->TokenIsElevated = (reply->elevation == TokenElevationTypeFull);
+         }
++        SERVER_END_REQ;
+         break;
+     case TokenSessionId:
+         {
+diff --git a/server/protocol.def b/server/protocol.def
+index b3dce66eb9c..33f1d5f0ab8 100644
+--- a/server/protocol.def
++++ b/server/protocol.def
+@@ -3673,6 +3673,14 @@ struct handle_info
+ @END
+ 
+ 
++/* Get elevation level of token */
++@REQ(get_token_elevation_type)
++    obj_handle_t   handle;        /* handle to the object */
++@REPLY
++    unsigned int   elevation;     /* elevation level */
++@END
++
++
+ /* Create I/O completion port */
+ @REQ(create_completion)
+     unsigned int access;          /* desired access to a port */
+diff --git a/server/token.c b/server/token.c
+index 7ab0f634c05..6a1085bae12 100644
+--- a/server/token.c
++++ b/server/token.c
+@@ -126,6 +126,7 @@ struct token
+     ACL           *default_dacl;    /* the default DACL to assign to objects created by this user */
+     TOKEN_SOURCE   source;          /* source of the token */
+     int            impersonation_level; /* impersonation level this token is capable of if non-primary token */
++    TOKEN_ELEVATION_TYPE elevation; /* elevation level */
+ };
+ 
+ struct privilege
+@@ -566,7 +567,7 @@ static struct token *create_token( unsigned primary, const SID *user,
+                                    const LUID_AND_ATTRIBUTES *privs, unsigned int priv_count,
+                                    const ACL *default_dacl, TOKEN_SOURCE source,
+                                    const luid_t *modified_id,
+-                                   int impersonation_level )
++                                   int impersonation_level, TOKEN_ELEVATION_TYPE elevation )
+ {
+     struct token *token = alloc_object( &token_ops );
+     if (token)
+@@ -588,6 +589,7 @@ static struct token *create_token( unsigned primary, const SID *user,
+             token->impersonation_level = impersonation_level;
+         token->default_dacl = NULL;
+         token->primary_group = NULL;
++        token->elevation = elevation;
+ 
+         /* copy user */
+         token->user = memdup( user, security_sid_len( user ));
+@@ -700,7 +702,8 @@ struct token *token_duplicate( struct token *src_token, unsigned primary,
+     token = create_token( primary, src_token->user, NULL, 0,
+                           NULL, 0, src_token->default_dacl,
+                           src_token->source, modified_id,
+-                          impersonation_level );
++                          impersonation_level,
++                          src_token->elevation );
+     if (!token) return token;
+ 
+     /* copy groups */
+@@ -904,7 +907,7 @@ struct token *token_create_admin( void )
+         static const TOKEN_SOURCE admin_source = {"SeMgr", {0, 0}};
+         token = create_token( TRUE, user_sid, admin_groups, sizeof(admin_groups)/sizeof(admin_groups[0]),
+                               admin_privs, sizeof(admin_privs)/sizeof(admin_privs[0]), default_dacl,
+-                              admin_source, NULL, -1 );
++                              admin_source, NULL, -1, TokenElevationTypeFull );
+         /* we really need a primary group */
+         assert( token->primary_group );
+     }
+@@ -1652,6 +1655,19 @@ DECL_HANDLER(get_token_statistics)
+     }
+ }
+ 
++DECL_HANDLER(get_token_elevation_type)
++{
++    struct token *token;
++
++    if ((token = (struct token *)get_handle_obj( current->process, req->handle,
++                                                 TOKEN_QUERY,
++                                                 &token_ops )))
++    {
++        reply->elevation = token->elevation;
++        release_object( token );
++    }
++}
++
+ DECL_HANDLER(get_token_default_dacl)
+ {
+     struct token *token;
+-- 
+2.13.1
+

patches/advapi32-Token_Integrity_Level/0003-server-Correctly-treat-zero-access-mask-in-duplicate.patch

@@ -0,0 +1,81 @@
+From 7e73f449d158f0d6a6b6b421d073dbaf1741e1c7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Mon, 7 Aug 2017 02:22:11 +0200
+Subject: server: Correctly treat zero access mask in duplicate_token
+ wineserver call.
+
+---
+ dlls/advapi32/tests/security.c | 14 +++++++-------
+ server/token.c                 |  3 ++-
+ 2 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c
+index 4a03db27e69..f1a64e29dea 100644
+--- a/dlls/advapi32/tests/security.c
++++ b/dlls/advapi32/tests/security.c
+@@ -7438,7 +7438,7 @@ static void test_token_security_descriptor(void)
+             ret = DuplicateTokenEx(token4, 0, NULL, SecurityImpersonation, TokenImpersonation, &token5);
+             ok(ret, "DuplicateTokenEx failed with error %u\n", GetLastError());
+             ret = SetThreadToken(NULL, token5);
+-            todo_wine ok(ret, "SetThreadToken failed with error %u\n", GetLastError());
++            ok(ret, "SetThreadToken failed with error %u\n", GetLastError());
+             CloseHandle(token4);
+ 
+             /* Restrict current process token while impersonating a medium integrity token */
+@@ -7503,16 +7503,16 @@ static void test_token_security_descriptor(void)
+ 
+             size = 0;
+             ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, NULL, 0, &size);
+-            todo_wine ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
++            ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
+                "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError());
+ 
+             sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size);
+             ret = GetKernelObjectSecurity(token6, LABEL_SECURITY_INFORMATION, sd3, size, &size);
+-            todo_wine ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
++            ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
+ 
+             sacl = NULL;
+             ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted);
+-            todo_wine ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
++            ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
+             todo_wine ok(present, "No SACL in the security descriptor\n");
+             todo_wine ok(sacl != NULL, "NULL SACL in the security descriptor\n");
+ 
+@@ -7606,16 +7606,16 @@ static void test_token_security_descriptor(void)
+ 
+         size = 0;
+         ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, NULL, 0, &size);
+-        todo_wine ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
++        ok(!ret && GetLastError() == ERROR_INSUFFICIENT_BUFFER,
+            "Unexpected GetKernelObjectSecurity return value %u, error %u\n", ret, GetLastError());
+ 
+         sd3 = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size);
+         ret = GetKernelObjectSecurity(token4, LABEL_SECURITY_INFORMATION, sd3, size, &size);
+-        todo_wine ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
++        ok(ret, "GetKernelObjectSecurity failed with error %u\n", GetLastError());
+ 
+         sacl = NULL;
+         ret = GetSecurityDescriptorSacl(sd3, &present, &sacl, &defaulted);
+-        todo_wine ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
++        ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
+         todo_wine ok(present, "No SACL in the security descriptor\n");
+         todo_wine ok(sacl != NULL, "NULL SACL in the security descriptor\n");
+ 
+diff --git a/server/token.c b/server/token.c
+index 6a1085bae12..292e1df80fd 100644
+--- a/server/token.c
++++ b/server/token.c
+@@ -1376,7 +1376,8 @@ DECL_HANDLER(duplicate_token)
+         struct token *token = token_duplicate( src_token, req->primary, req->impersonation_level, sd, NULL, 0, NULL, 0 );
+         if (token)
+         {
+-            reply->new_handle = alloc_handle_no_access_check( current->process, token, req->access, objattr->attributes );
++            unsigned int access = req->access ? req->access : get_handle_access( current->process, req->handle );
++            reply->new_handle = alloc_handle_no_access_check( current->process, token, access, objattr->attributes );
+             release_object( token );
+         }
+         release_object( src_token );
+-- 
+2.13.1
+