source: branches/samba-3.3.x/source/libgpo/gpext/security.c

Last change on this file was 206, checked in by Herwig Bauernfeind, 16 years ago

Import Samba 3.3 branch at 3.0.0 level (psmedley's port)
File size: 7.5 KB
Line 
1/*
2 * Unix SMB/CIFS implementation.
3 * Group Policy Support
4 * Copyright (C) Guenther Deschner 2005-2008
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20#include "includes.h"
21#include "libgpo/gpo_ini.h"
22
23#define GP_EXT_NAME "security"
24
25#define GPTTMPL_UNIX_PATH "Microsoft/Windows NT/SecEdit/GptTmpl.inf"
26
27#define GPTTMPL_SECTION_UNICODE "Unicode"
28#define GPTTMPL_SECTION_VERSION "Version"
29
30#define GPTTMPL_SECTION_REGISTRY_VALUES "Registry Values"
31#define GPTTMPL_SECTION_SYSTEM_ACCESS "System Access"
32#define GPTTMPL_SECTION_KERBEROS_POLICY "Kerberos Policy"
33#define GPTTMPL_SECTION_EVENT_AUDIT "Event Audit"
34#define GPTTMPL_SECTION_PRIVILEGE_RIGHTS "Privilege Rights"
35#define GPTTMPL_SECTION_APPLICATION_LOG "Application Log"
36#define GPTTMPL_SECTION_SECURITY_LOG "Security Log"
37#define GPTTMPL_SECTION_SYSTEM_LOG "System Log"
38#define GPTTMPL_SECTION_GROUP_MEMBERSHIP "Group Membership"
39#define GPTTMPL_SECTION_FILE_SECURITY "File Security"
40#define GPTTMPL_SECTION_SERVICE_GENERAL_SETTING "Service General Setting"
41
42static TALLOC_CTX *ctx = NULL;
43
44struct gpttmpl_table {
45 const char *section;
46 const char *parameter;
47 enum winreg_Type type;
48};
49
50/****************************************************************
51 parse the Version section from gpttmpl file
52****************************************************************/
53
54#define GPTTMPL_PARAMETER_REVISION "Revision"
55#define GPTTMPL_PARAMETER_SIGNATURE "signature"
56#define GPTTMPL_VALUE_CHICAGO "$CHICAGO$" /* whatever this is good for... */
57#define GPTTMPL_PARAMETER_UNICODE "Unicode"
58
59static NTSTATUS gpttmpl_parse_header(dictionary *dict,
60 uint32_t *version_out)
61{
62 const char *signature = NULL;
63 uint32_t version;
64
65 if (!dict) {
66 return NT_STATUS_INVALID_PARAMETER;
67 }
68
69 if ((signature = iniparser_getstring(dict, GPTTMPL_SECTION_VERSION
70 ":"GPTTMPL_PARAMETER_SIGNATURE, NULL)) == NULL) {
71 return NT_STATUS_INTERNAL_DB_CORRUPTION;
72 }
73
74 if (!strequal(signature, GPTTMPL_VALUE_CHICAGO)) {
75 return NT_STATUS_INTERNAL_DB_CORRUPTION;
76 }
77
78 if ((version = iniparser_getint(dict, GPTTMPL_SECTION_VERSION
79 ":"GPTTMPL_PARAMETER_REVISION, Undefined)) == Undefined) {
80 return NT_STATUS_INTERNAL_DB_CORRUPTION;
81 }
82
83 if (version_out) {
84 *version_out = version;
85 }
86
87 /* treat that as boolean */
88 if ((!iniparser_getboolean(dict, GPTTMPL_SECTION_UNICODE
89 ":"GPTTMPL_PARAMETER_UNICODE, Undefined)) == Undefined) {
90 return NT_STATUS_INTERNAL_DB_CORRUPTION;
91 }
92
93 return NT_STATUS_OK;
94}
95
96/****************************************************************
97****************************************************************/
98
99static NTSTATUS gpttmpl_init_context(TALLOC_CTX *mem_ctx,
100 uint32_t flags,
101 const char *unix_path,
102 struct gp_inifile_context **ini_ctx)
103{
104 NTSTATUS status;
105 uint32_t version;
106 struct gp_inifile_context *tmp_ctx = NULL;
107
108 status = gp_inifile_init_context(mem_ctx, flags, unix_path,
109 GPTTMPL_UNIX_PATH, &tmp_ctx);
110 NT_STATUS_NOT_OK_RETURN(status);
111
112 status = gpttmpl_parse_header(tmp_ctx->dict, &version);
113 if (!NT_STATUS_IS_OK(status)) {
114 DEBUG(1,("gpttmpl_init_context: failed: %s\n",
115 nt_errstr(status)));
116 TALLOC_FREE(tmp_ctx);
117 return status;
118 }
119
120 *ini_ctx = tmp_ctx;
121
122 return NT_STATUS_OK;
123}
124
125/****************************************************************
126****************************************************************/
127
128static NTSTATUS gpttmpl_process(struct gp_inifile_context *ini_ctx,
129 struct registry_key *root_key,
130 uint32_t flags)
131{
132 return NT_STATUS_OK;
133}
134
135/****************************************************************
136****************************************************************/
137
138static NTSTATUS security_process_group_policy(ADS_STRUCT *ads,
139 TALLOC_CTX *mem_ctx,
140 uint32_t flags,
141 struct registry_key *root_key,
142 const struct nt_user_token *token,
143 struct GROUP_POLICY_OBJECT *gpo,
144 const char *extension_guid,
145 const char *snapin_guid)
146{
147 NTSTATUS status;
148 char *unix_path = NULL;
149 struct gp_inifile_context *ini_ctx = NULL;
150
151 debug_gpext_header(0, "security_process_group_policy", flags, gpo,
152 extension_guid, snapin_guid);
153
154 /* this handler processes the gpttmpl files and merge output to the
155 * registry */
156
157 status = gpo_get_unix_path(mem_ctx, gpo, &unix_path);
158 if (!NT_STATUS_IS_OK(status)) {
159 goto out;
160 }
161
162 status = gpttmpl_init_context(mem_ctx, flags, unix_path, &ini_ctx);
163 if (!NT_STATUS_IS_OK(status)) {
164 goto out;
165 }
166
167 status = gpttmpl_process(ini_ctx, root_key, flags);
168 if (!NT_STATUS_IS_OK(status)) {
169 goto out;
170 }
171
172 out:
173 if (!NT_STATUS_IS_OK(status)) {
174 DEBUG(0,("security_process_group_policy: %s\n",
175 nt_errstr(status)));
176 }
177 TALLOC_FREE(ini_ctx);
178
179 return status;
180}
181
182/****************************************************************
183****************************************************************/
184
185static NTSTATUS security_get_reg_config(TALLOC_CTX *mem_ctx,
186 struct gp_extension_reg_info **reg_info)
187{
188 NTSTATUS status;
189 struct gp_extension_reg_info *info = NULL;
190
191 struct gp_extension_reg_table table[] = {
192 /* FIXME: how can we store the "(Default)" value ??? */
193 /* { "", REG_SZ, "Security" }, */
194 { "ProcessGroupPolicy", REG_SZ, "security_process_group_policy" },
195 { "NoUserPolicy", REG_DWORD, "1" },
196 { "ExtensionDebugLevel", REG_DWORD, "1" },
197 { NULL, REG_NONE, NULL }
198 };
199
200 info = TALLOC_ZERO_P(mem_ctx, struct gp_extension_reg_info);
201 NT_STATUS_HAVE_NO_MEMORY(info);
202
203 status = gp_ext_info_add_entry(mem_ctx, GP_EXT_NAME,
204 GP_EXT_GUID_SECURITY,
205 table, info);
206 NT_STATUS_NOT_OK_RETURN(status);
207
208 *reg_info = info;
209
210 return NT_STATUS_OK;
211}
212
213
214/****************************************************************
215****************************************************************/
216
217static NTSTATUS security_initialize(TALLOC_CTX *mem_ctx)
218{
219 return NT_STATUS_OK;
220}
221
222/****************************************************************
223****************************************************************/
224
225static NTSTATUS security_shutdown(void)
226{
227 NTSTATUS status;
228
229 status = unregister_gp_extension(GP_EXT_NAME);
230 if (NT_STATUS_IS_OK(status)) {
231 return status;
232 }
233
234 TALLOC_FREE(ctx);
235
236 return NT_STATUS_OK;
237}
238
239/****************************************************************
240****************************************************************/
241
242static struct gp_extension_methods security_methods = {
243 .initialize = security_initialize,
244 .process_group_policy = security_process_group_policy,
245 .get_reg_config = security_get_reg_config,
246 .shutdown = security_shutdown
247};
248
249/****************************************************************
250****************************************************************/
251
252NTSTATUS gpext_security_init(void)
253{
254 NTSTATUS status;
255
256 ctx = talloc_init("gpext_security_init");
257 NT_STATUS_HAVE_NO_MEMORY(ctx);
258
259 status = register_gp_extension(ctx, SMB_GPEXT_INTERFACE_VERSION,
260 GP_EXT_NAME, GP_EXT_GUID_SECURITY,
261 &security_methods);
262 if (!NT_STATUS_IS_OK(status)) {
263 TALLOC_FREE(ctx);
264 }
265
266 return status;
267}
Note: See TracBrowser for help on using the repository browser.