I am trying to extend Windows AppLocker behavior to add custom rule which checks owner of executables in Program Files and Windows folders. This would help us patch folders that are writable by default and more importantly control legacy apps that need to write in their installation folders. The following code is a part of KMDF (Kernel Mode Driver Framework) driver. This is my first c code basically so I would like to know if I am taking the correct approach to this or if you see any fundamental flaws in the code./*++Module Name:    driver.cAbstract:    This file contains the driver entry points and callbacks.Environment:    Kernel-mode Driver Framework--*/#include <ntifs.h>#include <ntddk.h>#include <wdf.h>#include driver.h//ignore the 4090 (constant related) warning#pragma warning (disable: 4090)#ifdef ALLOC_PRAGMA#pragma alloc_text (INIT, DriverEntry)#pragma alloc_text (PAGE, ProgramLockerEvtDeviceAdd)#pragma alloc_text (PAGE, ProgramLockerEvtDriverContextCleanup)#endifVOID CreateProcessNotifyEx(    __inout   PEPROCESS Process,    __in      HANDLE ProcessId,    __in_opt  PPS_CREATE_NOTIFY_INFO CreateInfo    );VOID CreateProcessNotifyEx(    __inout   PEPROCESS Process,    __in      HANDLE ProcessId,    __in_opt  PPS_CREATE_NOTIFY_INFO CreateInfo    ){    //these parameters are not used, I could disable the warning with pragma directive, but this is more specific     UNREFERENCED_PARAMETER(Process);#if !DBG    //mark this parameter as not used, only in release builds, in debug build the parameter is used in KdPrintEx    UNREFERENCED_PARAMETER(ProcessId);#endif    if (!CreateInfo)    {        //the process is exiting, just return        return;    }    //KdPrintEx prints only in debug builds, parameters that are used only in output must be marked as UNREFERENCED_PARAMETER in Release builds    KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Executing PID : 0x%X  ImageName :%wZ, %wZ \n, ProcessId, CreateInfo->ImageFileName, CreateInfo->FileObject->FileName));    //apply the filter only to files that are in \Program Files    //file name is in format \Windows\notepad.exe, there is no drive nor double \\ for UNC    //TODO: this will match anything\someOtherPath\Program Files as well!    if (wcsstr(CreateInfo->FileObject->FileName.Buffer, L\\Program Files) != NULL) {        KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, The called executable is running from  Windows));    }    if (wcsstr(CreateInfo->FileObject->FileName.Buffer, L\\Windows) == NULL) {        KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, The called executable is running from  Programfiles));    }    if (wcsstr(CreateInfo->FileObject->FileName.Buffer, L\\Program Files) == NULL &&        wcsstr(CreateInfo->FileObject->FileName.Buffer, L\\Windows) == NULL)    {        KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, The called executable is not running from Program Files or Windows, skipping it.));        return;    }    //Crate the attributes object that describes the executable file we are about to open    // code from here http://support.microsoft.com/kb/891805/en-us    OBJECT_ATTRIBUTES objectAttributes;    InitializeObjectAttributes(&objectAttributes, CreateInfo->ImageFileName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);    HANDLE handle;    BOOLEAN shouldRun = 0;    IO_STATUS_BLOCK ioStatusBlock;    if (NT_SUCCESS(ZwOpenFile(&handle, GENERIC_READ, &objectAttributes, &ioStatusBlock, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_NON_DIRECTORY_FILE)))    {        KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Successfully opened handle to file %wZ., CreateInfo->FileObject->FileName));        SECURITY_DESCRIPTOR securityDescriptor;        ULONG bufferSize = 65 * 1024;        if (NT_SUCCESS(ZwQuerySecurityObject(handle, OWNER_SECURITY_INFORMATION, &securityDescriptor, bufferSize, &bufferSize)))        {            KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Successfully loaded security descriptor of file %wZ., CreateInfo->FileObject->FileName));            if (RtlValidSecurityDescriptor(&securityDescriptor))            {                KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Successfully validated security descriptor of file %wZ., CreateInfo->FileObject->FileName));                PSID powner = NULL;                BOOLEAN defaulted;                if (NT_SUCCESS(RtlGetOwnerSecurityDescriptor(&securityDescriptor, &powner, &defaulted)))                {                    KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Successfully loaded owner descriptor of file %wZ., CreateInfo->FileObject->FileName));                    /*well known SIDs                    System: S-1-5-18                    Administrators group: S-1-5-32-544                    Trusted Installer: S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464                    */                    if (NT_SUCCESS(RtlValidSid(powner)))                    {                        KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Successfully validated owner SID of file %wZ., CreateInfo->FileObject->FileName));                        UNICODE_STRING sid;                        if (NT_SUCCESS(RtlConvertSidToUnicodeString(&sid, powner, TRUE)))                        {                            KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, %wZ is the owner SID of file %wZ., sid, CreateInfo->FileObject->FileName));                            if ((wcsstr(sid.Buffer, LS-1-5-18) != NULL ||                                wcsstr(sid.Buffer, LS-1-5-32-544) != NULL ||                                wcsstr(sid.Buffer, LS-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464) != NULL))                            {                                KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, SID %wZ is a trusted sid and is allowed to run., sid));                                shouldRun = 1;                            }                            else                            {                                KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, SID %wZ is NOT a trusted sid and is not allowed to run., sid));                                shouldRun = 0;                            }                        }                        else                        {                            KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, SID could not be converted to string for file %wZ., sid, CreateInfo->FileObject->FileName));                        }                    }                    else                    {                        KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, Owner SID is invalid on file %wZ., CreateInfo->FileObject->FileName));                    }                }                else                {                    KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, Owner descriptor could not be loaded for file %wZ., CreateInfo->FileObject->FileName));                }            }            else            {                KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, Security descriptor vas not valid for file %wZ., CreateInfo->FileObject->FileName));            }        }        else        {            KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, Security descriptor could not be loaded for file %wZ., CreateInfo->FileObject->FileName));        }        if (NT_SUCCESS(ZwClose(handle)))        {            KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Successfully closed handle to file %wZ., CreateInfo->FileObject->FileName));        }        else        {            KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, Handle could not be closed for file %wZ., CreateInfo->FileObject->FileName));        }    }    else    {        KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Handle could not be opened for file %wZ., CreateInfo->FileObject->FileName));    }    if (!shouldRun)    {        CreateInfo->CreationStatus = STATUS_ACCESS_DISABLED_BY_POLICY_OTHER;    }}NTSTATUSDriverEntry(    _In_ PDRIVER_OBJECT  DriverObject,    _In_ PUNICODE_STRING RegistryPath    )/*++Routine Description:    DriverEntry initializes the driver and is the first routine called by the    system after the driver is loaded. DriverEntry specifies the other entry    points in the function driver, such as EvtDevice and DriverUnload.Parameters Description:    DriverObject - represents the instance of the function driver that is loaded    into memory. DriverEntry must initialize members of DriverObject before it    returns to the caller. DriverObject is allocated by the system before the    driver is loaded, and it is released by the system after the system unloads    the function driver from memory.    RegistryPath - represents the driver specific path in the Registry.    The function driver can use the path to store driver related data between    reboots. The path does not store hardware instance specific data.Return Value:    STATUS_SUCCESS if successful,    STATUS_UNSUCCESSFUL otherwise.--*/{    WDF_DRIVER_CONFIG config;    NTSTATUS status;    WDF_OBJECT_ATTRIBUTES attributes;    //    // Register a cleanup callback so that we can call WPP_CLEANUP when    // the framework driver object is deleted during driver unload.    //    WDF_OBJECT_ATTRIBUTES_INIT(&attributes);    attributes.EvtCleanupCallback = ProgramLockerEvtDriverContextCleanup;    WDF_DRIVER_CONFIG_INIT(&config,                           ProgramLockerEvtDeviceAdd                           );    status = WdfDriverCreate(DriverObject,                             RegistryPath,                             &attributes,                             &config,                             WDF_NO_HANDLE                             );    if (!NT_SUCCESS(status)) {        return status;    }    status = PsSetCreateProcessNotifyRoutineEx((PCREATE_PROCESS_NOTIFY_ROUTINE_EX)CreateProcessNotifyEx, FALSE);    if (!NT_SUCCESS(status))    {        KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, Failed to PsSetCreateProcessNotifyRoutineEx .status : 0x%X \n, status));        return status;    }    return status;}NTSTATUSProgramLockerEvtDeviceAdd(    _In_    WDFDRIVER       Driver,    _Inout_ PWDFDEVICE_INIT DeviceInit    )/*++Routine Description:    EvtDeviceAdd is called by the framework in response to AddDevice    call from the PnP manager. We create and initialize a device object to    represent a new instance of the device.Arguments:    Driver - Handle to a framework driver object created in DriverEntry    DeviceInit - Pointer to a framework-allocated WDFDEVICE_INIT structure.Return Value:    NTSTATUS--*/{    NTSTATUS status;    UNREFERENCED_PARAMETER(Driver);    PAGED_CODE();    status = ProgramLockerCreateDevice(DeviceInit);    return status;}VOIDProgramLockerEvtDriverContextCleanup(    _In_ WDFOBJECT DriverObject    )/*++Routine Description:    Free all the resources allocated in DriverEntry.Arguments:    DriverObject - handle to a WDF Driver object.Return Value:    VOID.--*/{    UNREFERENCED_PARAMETER(DriverObject);    PAGED_CODE ();    PsSetCreateProcessNotifyRoutineEx((PCREATE_PROCESS_NOTIFY_ROUTINE_EX)CreateProcessNotifyEx, TRUE);}
Windows AppLocker extension - Owner rule
c;windows;kernel