ntdll: Implement RtlAddMandatoryAce.

dlls/ntdll/ntdll.spec

@@ -423,6 +423,7 @@
 @ stdcall RtlAddAuditAccessAceEx(ptr long long long ptr long long)
 @ stdcall RtlAddAuditAccessObjectAce(ptr long long long ptr ptr ptr long long)
 # @ stub RtlAddCompoundAce
+@ stdcall RtlAddMandatoryAce(ptr long long long long ptr)
 # @ stub RtlAddRange
 @ cdecl -arch=arm,x86_64 RtlAddFunctionTable(ptr long long)
 @ stdcall RtlAddRefActivationContext(ptr)

dlls/ntdll/sec.c

@@ -1379,6 +1379,33 @@ NTSTATUS WINAPI RtlAddAuditAccessObjectAce(
     return STATUS_NOT_IMPLEMENTED;
 }
 
+/**************************************************************************
+ *  RtlAddMandatoryAce     [NTDLL.@]
+ */
+NTSTATUS WINAPI RtlAddMandatoryAce(
+    IN OUT PACL pAcl,
+    IN DWORD dwAceRevision,
+    IN DWORD dwAceFlags,
+    IN DWORD dwMandatoryFlags,
+    IN DWORD dwAceType,
+    IN PSID pSid)
+{
+    static const DWORD valid_flags = SYSTEM_MANDATORY_LABEL_NO_WRITE_UP |
+                                     SYSTEM_MANDATORY_LABEL_NO_READ_UP |
+                                     SYSTEM_MANDATORY_LABEL_NO_EXECUTE_UP;
+
+    TRACE("(%p, %u, 0x%08x, 0x%08x, %u, %p)\n", pAcl, dwAceRevision, dwAceFlags,
+                                                dwMandatoryFlags, dwAceType, pSid);
+
+    if (dwAceType != SYSTEM_MANDATORY_LABEL_ACE_TYPE)
+        return STATUS_INVALID_PARAMETER;
+
+    if (dwMandatoryFlags & ~valid_flags)
+        return STATUS_INVALID_PARAMETER;
+
+    return add_access_ace(pAcl, dwAceRevision, dwAceFlags, dwMandatoryFlags, pSid, dwAceType);
+}
+
 /******************************************************************************
  *  RtlValidAcl		[NTDLL.@]
  */

include/winternl.h

@@ -2421,6 +2421,7 @@ NTSYSAPI NTSTATUS  WINAPI RtlAddAtomToAtomTable(RTL_ATOM_TABLE,const WCHAR*,RTL_
 NTSYSAPI NTSTATUS  WINAPI RtlAddAuditAccessAce(PACL,DWORD,DWORD,PSID,BOOL,BOOL);
 NTSYSAPI NTSTATUS  WINAPI RtlAddAuditAccessAceEx(PACL,DWORD,DWORD,DWORD,PSID,BOOL,BOOL);
 NTSYSAPI NTSTATUS  WINAPI RtlAddAuditAccessObjectAce(PACL,DWORD,DWORD,DWORD,GUID*,GUID*,PSID,BOOL,BOOL);
+NTSYSAPI NTSTATUS  WINAPI RtlAddMandatoryAce(PACL,DWORD,DWORD,DWORD,DWORD,PSID);
 NTSYSAPI void      WINAPI RtlAddRefActivationContext(HANDLE);
 NTSYSAPI PVOID     WINAPI RtlAddVectoredExceptionHandler(ULONG,PVECTORED_EXCEPTION_HANDLER);
 NTSYSAPI NTSTATUS  WINAPI RtlAdjustPrivilege(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);