source: trunk/server/libgpo/gpo_sec.c@ 1010

Last change on this file since 1010 was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 5.8 KB
Line 
1/*
2 * Unix SMB/CIFS implementation.
3 * Group Policy Object Support
4 * Copyright (C) Guenther Deschner 2007
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20#include "includes.h"
21#include "libcli/security/security.h"
22#include "../libgpo/gpo.h"
23#include "auth.h"
24#include "../librpc/ndr/libndr.h"
25#if _SAMBA_BUILD_ == 4
26#include "libgpo/ads_convenience.h"
27#include "librpc/gen_ndr/security.h"
28#include "librpc/gen_ndr/ndr_misc.h"
29#include "../libcli/security/secace.h"
30#endif
31
32/****************************************************************
33****************************************************************/
34
35static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
36{
37 struct GUID ext_right_apg_guid;
38 NTSTATUS status;
39
40 if (!object) {
41 return false;
42 }
43
44 status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
45 &ext_right_apg_guid);
46 if (!NT_STATUS_IS_OK(status)) {
47 return false;
48 }
49
50 switch (object->flags) {
51 case SEC_ACE_OBJECT_TYPE_PRESENT:
52 if (GUID_equal(&object->type.type,
53 &ext_right_apg_guid)) {
54 return true;
55 }
56 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
57 if (GUID_equal(&object->inherited_type.inherited_type,
58 &ext_right_apg_guid)) {
59 return true;
60 }
61 default:
62 break;
63 }
64
65 return false;
66}
67
68/****************************************************************
69****************************************************************/
70
71static bool gpo_sd_check_agp_object(const struct security_ace *ace)
72{
73 if (!sec_ace_object(ace->type)) {
74 return false;
75 }
76
77 return gpo_sd_check_agp_object_guid(&ace->object.object);
78}
79
80/****************************************************************
81****************************************************************/
82
83static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
84{
85 return (access_mask & SEC_ADS_CONTROL_ACCESS);
86}
87
88#if 0
89/****************************************************************
90****************************************************************/
91
92static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
93{
94 uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
95 SEC_RIGHTS_READ_ALL_PROP |
96 SEC_RIGHTS_READ_PERMS;
97
98 return (read_bits == (access_mask & read_bits));
99}
100#endif
101
102/****************************************************************
103****************************************************************/
104
105static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
106 const struct security_token *token)
107{
108 char *sid_str;
109
110 if (gpo_sd_check_agp_object(ace) &&
111 gpo_sd_check_agp_access_bits(ace->access_mask) &&
112 nt_token_check_sid(&ace->trustee, token)) {
113 sid_str = dom_sid_string(NULL, &ace->trustee);
114 DEBUG(10,("gpo_sd_check_ace_denied_object: "
115 "Access denied as of ace for %s\n",
116 sid_str));
117 talloc_free(sid_str);
118 return NT_STATUS_ACCESS_DENIED;
119 }
120
121 return STATUS_MORE_ENTRIES;
122}
123
124/****************************************************************
125****************************************************************/
126
127static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
128 const struct security_token *token)
129{
130 char *sid_str;
131
132 if (gpo_sd_check_agp_object(ace) &&
133 gpo_sd_check_agp_access_bits(ace->access_mask) &&
134 nt_token_check_sid(&ace->trustee, token)) {
135 sid_str = dom_sid_string(NULL, &ace->trustee);
136 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
137 "Access granted as of ace for %s\n",
138 sid_str));
139 talloc_free(sid_str);
140
141 return NT_STATUS_OK;
142 }
143
144 return STATUS_MORE_ENTRIES;
145}
146
147/****************************************************************
148****************************************************************/
149
150static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
151 const struct security_token *token)
152{
153 switch (ace->type) {
154 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
155 return gpo_sd_check_ace_denied_object(ace, token);
156 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
157 return gpo_sd_check_ace_allowed_object(ace, token);
158 default:
159 return STATUS_MORE_ENTRIES;
160 }
161}
162
163/****************************************************************
164****************************************************************/
165
166NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
167 const struct security_token *token)
168{
169 struct security_descriptor *sd = gpo->security_descriptor;
170 struct security_acl *dacl = NULL;
171 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
172 int i;
173
174 if (!token) {
175 return NT_STATUS_INVALID_USER_BUFFER;
176 }
177
178 if (!sd) {
179 return NT_STATUS_INVALID_SECURITY_DESCR;
180 }
181
182 dacl = sd->dacl;
183 if (!dacl) {
184 return NT_STATUS_INVALID_SECURITY_DESCR;
185 }
186
187 /* check all aces and only return NT_STATUS_OK (== Access granted) or
188 * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
189 * deny access */
190
191 for (i = 0; i < dacl->num_aces; i ++) {
192
193 status = gpo_sd_check_ace(&dacl->aces[i], token);
194
195 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
196 return status;
197 } else if (NT_STATUS_IS_OK(status)) {
198 return status;
199 }
200
201 continue;
202 }
203
204 return NT_STATUS_ACCESS_DENIED;
205}
Note: See TracBrowser for help on using the repository browser.