| 1 | /*
|
|---|
| 2 | * Unix SMB/CIFS implementation.
|
|---|
| 3 | * Group Policy Support
|
|---|
| 4 | * Copyright (C) Guenther Deschner 2005-2008
|
|---|
| 5 | *
|
|---|
| 6 | * This program is free software; you can redistribute it and/or modify
|
|---|
| 7 | * it under the terms of the GNU General Public License as published by
|
|---|
| 8 | * the Free Software Foundation; either version 3 of the License, or
|
|---|
| 9 | * (at your option) any later version.
|
|---|
| 10 | *
|
|---|
| 11 | * This program is distributed in the hope that it will be useful,
|
|---|
| 12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|---|
| 13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|---|
| 14 | * GNU General Public License for more details.
|
|---|
| 15 | *
|
|---|
| 16 | * You should have received a copy of the GNU General Public License
|
|---|
| 17 | * along with this program; if not, see <http://www.gnu.org/licenses/>.
|
|---|
| 18 | */
|
|---|
| 19 |
|
|---|
| 20 | #include "includes.h"
|
|---|
| 21 | #include "libgpo/gpo_ini.h"
|
|---|
| 22 |
|
|---|
| 23 | #define GP_EXT_NAME "security"
|
|---|
| 24 |
|
|---|
| 25 | #define GPTTMPL_UNIX_PATH "Microsoft/Windows NT/SecEdit/GptTmpl.inf"
|
|---|
| 26 |
|
|---|
| 27 | #define GPTTMPL_SECTION_UNICODE "Unicode"
|
|---|
| 28 | #define GPTTMPL_SECTION_VERSION "Version"
|
|---|
| 29 |
|
|---|
| 30 | #define GPTTMPL_SECTION_REGISTRY_VALUES "Registry Values"
|
|---|
| 31 | #define GPTTMPL_SECTION_SYSTEM_ACCESS "System Access"
|
|---|
| 32 | #define GPTTMPL_SECTION_KERBEROS_POLICY "Kerberos Policy"
|
|---|
| 33 | #define GPTTMPL_SECTION_EVENT_AUDIT "Event Audit"
|
|---|
| 34 | #define GPTTMPL_SECTION_PRIVILEGE_RIGHTS "Privilege Rights"
|
|---|
| 35 | #define GPTTMPL_SECTION_APPLICATION_LOG "Application Log"
|
|---|
| 36 | #define GPTTMPL_SECTION_SECURITY_LOG "Security Log"
|
|---|
| 37 | #define GPTTMPL_SECTION_SYSTEM_LOG "System Log"
|
|---|
| 38 | #define GPTTMPL_SECTION_GROUP_MEMBERSHIP "Group Membership"
|
|---|
| 39 | #define GPTTMPL_SECTION_FILE_SECURITY "File Security"
|
|---|
| 40 | #define GPTTMPL_SECTION_SERVICE_GENERAL_SETTING "Service General Setting"
|
|---|
| 41 |
|
|---|
| 42 | static TALLOC_CTX *ctx = NULL;
|
|---|
| 43 |
|
|---|
| 44 | struct gpttmpl_table {
|
|---|
| 45 | const char *section;
|
|---|
| 46 | const char *parameter;
|
|---|
| 47 | enum winreg_Type type;
|
|---|
| 48 | };
|
|---|
| 49 |
|
|---|
| 50 | /****************************************************************
|
|---|
| 51 | parse the Version section from gpttmpl file
|
|---|
| 52 | ****************************************************************/
|
|---|
| 53 |
|
|---|
| 54 | #define GPTTMPL_PARAMETER_REVISION "Revision"
|
|---|
| 55 | #define GPTTMPL_PARAMETER_SIGNATURE "signature"
|
|---|
| 56 | #define GPTTMPL_VALUE_CHICAGO "$CHICAGO$" /* whatever this is good for... */
|
|---|
| 57 | #define GPTTMPL_PARAMETER_UNICODE "Unicode"
|
|---|
| 58 |
|
|---|
| 59 | static NTSTATUS gpttmpl_parse_header(struct gp_inifile_context *ini_ctx,
|
|---|
| 60 | uint32_t *version_out)
|
|---|
| 61 | {
|
|---|
| 62 | char *signature = NULL;
|
|---|
| 63 | NTSTATUS result;
|
|---|
| 64 | int version;
|
|---|
| 65 | int is_unicode;
|
|---|
| 66 |
|
|---|
| 67 | if (!ini_ctx) {
|
|---|
| 68 | return NT_STATUS_INVALID_PARAMETER;
|
|---|
| 69 | }
|
|---|
| 70 |
|
|---|
| 71 | result = gp_inifile_getstring(ini_ctx, GPTTMPL_SECTION_VERSION
|
|---|
| 72 | ":"GPTTMPL_PARAMETER_SIGNATURE, &signature);
|
|---|
| 73 | if (!NT_STATUS_IS_OK(result)) {
|
|---|
| 74 | return NT_STATUS_INTERNAL_DB_CORRUPTION;
|
|---|
| 75 | }
|
|---|
| 76 |
|
|---|
| 77 | if (!strequal(signature, GPTTMPL_VALUE_CHICAGO)) {
|
|---|
| 78 | return NT_STATUS_INTERNAL_DB_CORRUPTION;
|
|---|
| 79 | }
|
|---|
| 80 | result = gp_inifile_getint(ini_ctx, GPTTMPL_SECTION_VERSION
|
|---|
| 81 | ":"GPTTMPL_PARAMETER_REVISION, &version);
|
|---|
| 82 | if (!NT_STATUS_IS_OK(result)) {
|
|---|
| 83 | return NT_STATUS_INTERNAL_DB_CORRUPTION;
|
|---|
| 84 | }
|
|---|
| 85 |
|
|---|
| 86 | if (version_out) {
|
|---|
| 87 | *version_out = version;
|
|---|
| 88 | }
|
|---|
| 89 |
|
|---|
| 90 | result = gp_inifile_getint(ini_ctx, GPTTMPL_SECTION_UNICODE
|
|---|
| 91 | ":"GPTTMPL_PARAMETER_UNICODE, &is_unicode);
|
|---|
| 92 | if (!NT_STATUS_IS_OK(result) || !is_unicode) {
|
|---|
| 93 | return NT_STATUS_INTERNAL_DB_CORRUPTION;
|
|---|
| 94 | }
|
|---|
| 95 |
|
|---|
| 96 | return NT_STATUS_OK;
|
|---|
| 97 | }
|
|---|
| 98 |
|
|---|
| 99 | /****************************************************************
|
|---|
| 100 | ****************************************************************/
|
|---|
| 101 |
|
|---|
| 102 | static NTSTATUS gpttmpl_init_context(TALLOC_CTX *mem_ctx,
|
|---|
| 103 | uint32_t flags,
|
|---|
| 104 | const char *unix_path,
|
|---|
| 105 | struct gp_inifile_context **ini_ctx)
|
|---|
| 106 | {
|
|---|
| 107 | NTSTATUS status;
|
|---|
| 108 | uint32_t version;
|
|---|
| 109 | struct gp_inifile_context *tmp_ctx = NULL;
|
|---|
| 110 |
|
|---|
| 111 | status = gp_inifile_init_context(mem_ctx, flags, unix_path,
|
|---|
| 112 | GPTTMPL_UNIX_PATH, &tmp_ctx);
|
|---|
| 113 | NT_STATUS_NOT_OK_RETURN(status);
|
|---|
| 114 |
|
|---|
| 115 | status = gpttmpl_parse_header(tmp_ctx, &version);
|
|---|
| 116 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 117 | DEBUG(1,("gpttmpl_init_context: failed: %s\n",
|
|---|
| 118 | nt_errstr(status)));
|
|---|
| 119 | TALLOC_FREE(tmp_ctx);
|
|---|
| 120 | return status;
|
|---|
| 121 | }
|
|---|
| 122 |
|
|---|
| 123 | *ini_ctx = tmp_ctx;
|
|---|
| 124 |
|
|---|
| 125 | return NT_STATUS_OK;
|
|---|
| 126 | }
|
|---|
| 127 |
|
|---|
| 128 | /****************************************************************
|
|---|
| 129 | ****************************************************************/
|
|---|
| 130 |
|
|---|
| 131 | static NTSTATUS gpttmpl_process(struct gp_inifile_context *ini_ctx,
|
|---|
| 132 | struct registry_key *root_key,
|
|---|
| 133 | uint32_t flags)
|
|---|
| 134 | {
|
|---|
| 135 | return NT_STATUS_OK;
|
|---|
| 136 | }
|
|---|
| 137 |
|
|---|
| 138 | /****************************************************************
|
|---|
| 139 | ****************************************************************/
|
|---|
| 140 |
|
|---|
| 141 | static NTSTATUS security_process_group_policy(ADS_STRUCT *ads,
|
|---|
| 142 | TALLOC_CTX *mem_ctx,
|
|---|
| 143 | uint32_t flags,
|
|---|
| 144 | struct registry_key *root_key,
|
|---|
| 145 | const struct nt_user_token *token,
|
|---|
| 146 | struct GROUP_POLICY_OBJECT *gpo,
|
|---|
| 147 | const char *extension_guid,
|
|---|
| 148 | const char *snapin_guid)
|
|---|
| 149 | {
|
|---|
| 150 | NTSTATUS status;
|
|---|
| 151 | char *unix_path = NULL;
|
|---|
| 152 | struct gp_inifile_context *ini_ctx = NULL;
|
|---|
| 153 |
|
|---|
| 154 | debug_gpext_header(0, "security_process_group_policy", flags, gpo,
|
|---|
| 155 | extension_guid, snapin_guid);
|
|---|
| 156 |
|
|---|
| 157 | /* this handler processes the gpttmpl files and merge output to the
|
|---|
| 158 | * registry */
|
|---|
| 159 |
|
|---|
| 160 | status = gpo_get_unix_path(mem_ctx, cache_path(GPO_CACHE_DIR), gpo, &unix_path);
|
|---|
| 161 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 162 | goto out;
|
|---|
| 163 | }
|
|---|
| 164 |
|
|---|
| 165 | status = gpttmpl_init_context(mem_ctx, flags, unix_path, &ini_ctx);
|
|---|
| 166 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 167 | goto out;
|
|---|
| 168 | }
|
|---|
| 169 |
|
|---|
| 170 | status = gpttmpl_process(ini_ctx, root_key, flags);
|
|---|
| 171 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 172 | goto out;
|
|---|
| 173 | }
|
|---|
| 174 |
|
|---|
| 175 | out:
|
|---|
| 176 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 177 | DEBUG(0,("security_process_group_policy: %s\n",
|
|---|
| 178 | nt_errstr(status)));
|
|---|
| 179 | }
|
|---|
| 180 | TALLOC_FREE(ini_ctx);
|
|---|
| 181 |
|
|---|
| 182 | return status;
|
|---|
| 183 | }
|
|---|
| 184 |
|
|---|
| 185 | /****************************************************************
|
|---|
| 186 | ****************************************************************/
|
|---|
| 187 |
|
|---|
| 188 | static NTSTATUS security_get_reg_config(TALLOC_CTX *mem_ctx,
|
|---|
| 189 | struct gp_extension_reg_info **reg_info)
|
|---|
| 190 | {
|
|---|
| 191 | NTSTATUS status;
|
|---|
| 192 | struct gp_extension_reg_info *info = NULL;
|
|---|
| 193 |
|
|---|
| 194 | struct gp_extension_reg_table table[] = {
|
|---|
| 195 | /* FIXME: how can we store the "(Default)" value ??? */
|
|---|
| 196 | /* { "", REG_SZ, "Security" }, */
|
|---|
| 197 | { "ProcessGroupPolicy", REG_SZ, "security_process_group_policy" },
|
|---|
| 198 | { "NoUserPolicy", REG_DWORD, "1" },
|
|---|
| 199 | { "ExtensionDebugLevel", REG_DWORD, "1" },
|
|---|
| 200 | { NULL, REG_NONE, NULL }
|
|---|
| 201 | };
|
|---|
| 202 |
|
|---|
| 203 | info = TALLOC_ZERO_P(mem_ctx, struct gp_extension_reg_info);
|
|---|
| 204 | NT_STATUS_HAVE_NO_MEMORY(info);
|
|---|
| 205 |
|
|---|
| 206 | status = gp_ext_info_add_entry(mem_ctx, GP_EXT_NAME,
|
|---|
| 207 | GP_EXT_GUID_SECURITY,
|
|---|
| 208 | table, info);
|
|---|
| 209 | NT_STATUS_NOT_OK_RETURN(status);
|
|---|
| 210 |
|
|---|
| 211 | *reg_info = info;
|
|---|
| 212 |
|
|---|
| 213 | return NT_STATUS_OK;
|
|---|
| 214 | }
|
|---|
| 215 |
|
|---|
| 216 |
|
|---|
| 217 | /****************************************************************
|
|---|
| 218 | ****************************************************************/
|
|---|
| 219 |
|
|---|
| 220 | static NTSTATUS security_initialize(TALLOC_CTX *mem_ctx)
|
|---|
| 221 | {
|
|---|
| 222 | return NT_STATUS_OK;
|
|---|
| 223 | }
|
|---|
| 224 |
|
|---|
| 225 | /****************************************************************
|
|---|
| 226 | ****************************************************************/
|
|---|
| 227 |
|
|---|
| 228 | static NTSTATUS security_shutdown(void)
|
|---|
| 229 | {
|
|---|
| 230 | NTSTATUS status;
|
|---|
| 231 |
|
|---|
| 232 | status = unregister_gp_extension(GP_EXT_NAME);
|
|---|
| 233 | if (NT_STATUS_IS_OK(status)) {
|
|---|
| 234 | return status;
|
|---|
| 235 | }
|
|---|
| 236 |
|
|---|
| 237 | TALLOC_FREE(ctx);
|
|---|
| 238 |
|
|---|
| 239 | return NT_STATUS_OK;
|
|---|
| 240 | }
|
|---|
| 241 |
|
|---|
| 242 | /****************************************************************
|
|---|
| 243 | ****************************************************************/
|
|---|
| 244 |
|
|---|
| 245 | static struct gp_extension_methods security_methods = {
|
|---|
| 246 | .initialize = security_initialize,
|
|---|
| 247 | .process_group_policy = security_process_group_policy,
|
|---|
| 248 | .get_reg_config = security_get_reg_config,
|
|---|
| 249 | .shutdown = security_shutdown
|
|---|
| 250 | };
|
|---|
| 251 |
|
|---|
| 252 | /****************************************************************
|
|---|
| 253 | ****************************************************************/
|
|---|
| 254 |
|
|---|
| 255 | NTSTATUS gpext_security_init(void)
|
|---|
| 256 | {
|
|---|
| 257 | NTSTATUS status;
|
|---|
| 258 |
|
|---|
| 259 | ctx = talloc_init("gpext_security_init");
|
|---|
| 260 | NT_STATUS_HAVE_NO_MEMORY(ctx);
|
|---|
| 261 |
|
|---|
| 262 | status = register_gp_extension(ctx, SMB_GPEXT_INTERFACE_VERSION,
|
|---|
| 263 | GP_EXT_NAME, GP_EXT_GUID_SECURITY,
|
|---|
| 264 | &security_methods);
|
|---|
| 265 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 266 | TALLOC_FREE(ctx);
|
|---|
| 267 | }
|
|---|
| 268 |
|
|---|
| 269 | return status;
|
|---|
| 270 | }
|
|---|
