source: trunk/server/libgpo/gpo_sec.c@ 434

Last change on this file since 434 was 414, checked in by Herwig Bauernfeind, 16 years ago

Samba 3.5.0: Initial import
File size: 5.5 KB
Line 
1/*
2 * Unix SMB/CIFS implementation.
3 * Group Policy Object Support
4 * Copyright (C) Guenther Deschner 2007
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20#include "includes.h"
21#include "libcli/security/dom_sid.h"
22#if _SAMBA_BUILD_ == 4
23#include "libgpo/ads_convenience.h"
24#include "librpc/gen_ndr/security.h"
25#include "librpc/gen_ndr/ndr_misc.h"
26#include "../libcli/security/secace.h"
27#include "../libgpo/gpo.h"
28#endif
29
30/****************************************************************
31****************************************************************/
32
33static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
34{
35 struct GUID ext_right_apg_guid;
36 NTSTATUS status;
37
38 if (!object) {
39 return false;
40 }
41
42 status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
43 &ext_right_apg_guid);
44 if (!NT_STATUS_IS_OK(status)) {
45 return false;
46 }
47
48 switch (object->flags) {
49 case SEC_ACE_OBJECT_TYPE_PRESENT:
50 if (GUID_equal(&object->type.type,
51 &ext_right_apg_guid)) {
52 return true;
53 }
54 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
55 if (GUID_equal(&object->inherited_type.inherited_type,
56 &ext_right_apg_guid)) {
57 return true;
58 }
59 default:
60 break;
61 }
62
63 return false;
64}
65
66/****************************************************************
67****************************************************************/
68
69static bool gpo_sd_check_agp_object(const struct security_ace *ace)
70{
71 if (!sec_ace_object(ace->type)) {
72 return false;
73 }
74
75 return gpo_sd_check_agp_object_guid(&ace->object.object);
76}
77
78/****************************************************************
79****************************************************************/
80
81static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
82{
83 return (access_mask & SEC_ADS_CONTROL_ACCESS);
84}
85
86#if 0
87/****************************************************************
88****************************************************************/
89
90static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
91{
92 uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
93 SEC_RIGHTS_READ_ALL_PROP |
94 SEC_RIGHTS_READ_PERMS;
95
96 return (read_bits == (access_mask & read_bits));
97}
98#endif
99
100/****************************************************************
101****************************************************************/
102
103static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
104 const NT_USER_TOKEN *token)
105{
106 char *sid_str;
107
108 if (gpo_sd_check_agp_object(ace) &&
109 gpo_sd_check_agp_access_bits(ace->access_mask) &&
110 nt_token_check_sid(&ace->trustee, token)) {
111 sid_str = dom_sid_string(NULL, &ace->trustee);
112 DEBUG(10,("gpo_sd_check_ace_denied_object: "
113 "Access denied as of ace for %s\n",
114 sid_str));
115 talloc_free(sid_str);
116 return NT_STATUS_ACCESS_DENIED;
117 }
118
119 return STATUS_MORE_ENTRIES;
120}
121
122/****************************************************************
123****************************************************************/
124
125static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
126 const NT_USER_TOKEN *token)
127{
128 char *sid_str;
129
130 if (gpo_sd_check_agp_object(ace) &&
131 gpo_sd_check_agp_access_bits(ace->access_mask) &&
132 nt_token_check_sid(&ace->trustee, token)) {
133 sid_str = dom_sid_string(NULL, &ace->trustee);
134 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
135 "Access granted as of ace for %s\n",
136 sid_str));
137 talloc_free(sid_str);
138
139 return NT_STATUS_OK;
140 }
141
142 return STATUS_MORE_ENTRIES;
143}
144
145/****************************************************************
146****************************************************************/
147
148static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
149 const NT_USER_TOKEN *token)
150{
151 switch (ace->type) {
152 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
153 return gpo_sd_check_ace_denied_object(ace, token);
154 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
155 return gpo_sd_check_ace_allowed_object(ace, token);
156 default:
157 return STATUS_MORE_ENTRIES;
158 }
159}
160
161/****************************************************************
162****************************************************************/
163
164NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
165 const NT_USER_TOKEN *token)
166{
167 struct security_descriptor *sd = gpo->security_descriptor;
168 struct security_acl *dacl = NULL;
169 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
170 int i;
171
172 if (!token) {
173 return NT_STATUS_INVALID_USER_BUFFER;
174 }
175
176 if (!sd) {
177 return NT_STATUS_INVALID_SECURITY_DESCR;
178 }
179
180 dacl = sd->dacl;
181 if (!dacl) {
182 return NT_STATUS_INVALID_SECURITY_DESCR;
183 }
184
185 /* check all aces and only return NT_STATUS_OK (== Access granted) or
186 * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
187 * deny access */
188
189 for (i = 0; i < dacl->num_aces; i ++) {
190
191 status = gpo_sd_check_ace(&dacl->aces[i], token);
192
193 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
194 return status;
195 } else if (NT_STATUS_IS_OK(status)) {
196 return status;
197 }
198
199 continue;
200 }
201
202 return NT_STATUS_ACCESS_DENIED;
203}
Note: See TracBrowser for help on using the repository browser.