source: trunk/server/source4/dsdb/samdb/samdb_privilege.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 3.6 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 manipulate privilege records in samdb
5
6 Copyright (C) Andrew Tridgell 2004
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20*/
21
22#include "includes.h"
23#include "libcli/ldap/ldap_ndr.h"
24#include "dsdb/samdb/samdb.h"
25#include "auth/auth.h"
26#include "libcli/security/security.h"
27#include "../lib/util/util_ldb.h"
28#include "param/param.h"
29#include "ldb_wrap.h"
30
31/* connect to the privilege database */
32struct ldb_context *privilege_connect(TALLOC_CTX *mem_ctx,
33 struct loadparm_context *lp_ctx)
34{
35 return ldb_wrap_connect(mem_ctx, NULL, lp_ctx, "privilege.ldb",
36 NULL, NULL, 0);
37}
38
39/*
40 add privilege bits for one sid to a security_token
41*/
42static NTSTATUS samdb_privilege_setup_sid(struct ldb_context *pdb, TALLOC_CTX *mem_ctx,
43 struct security_token *token,
44 const struct dom_sid *sid)
45{
46 const char * const attrs[] = { "privilege", NULL };
47 struct ldb_message **res = NULL;
48 struct ldb_message_element *el;
49 unsigned int i;
50 int ret;
51 char *sidstr;
52
53 sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
54 NT_STATUS_HAVE_NO_MEMORY(sidstr);
55
56 ret = gendb_search(pdb, mem_ctx, NULL, &res, attrs, "objectSid=%s", sidstr);
57 talloc_free(sidstr);
58 if (ret != 1) {
59 /* not an error to not match */
60 return NT_STATUS_OK;
61 }
62
63 el = ldb_msg_find_element(res[0], "privilege");
64 if (el == NULL) {
65 return NT_STATUS_OK;
66 }
67
68 for (i=0;i<el->num_values;i++) {
69 const char *priv_str = (const char *)el->values[i].data;
70 enum sec_privilege privilege = sec_privilege_id(priv_str);
71 if (privilege == SEC_PRIV_INVALID) {
72 uint32_t right_bit = sec_right_bit(priv_str);
73 security_token_set_right_bit(token, right_bit);
74 if (right_bit == 0) {
75 DEBUG(1,("Unknown privilege '%s' in samdb\n",
76 priv_str));
77 }
78 continue;
79 }
80 security_token_set_privilege(token, privilege);
81 }
82
83 return NT_STATUS_OK;
84}
85
86/*
87 setup the privilege mask for this security token based on our
88 local SAM
89*/
90NTSTATUS samdb_privilege_setup(struct loadparm_context *lp_ctx, struct security_token *token)
91{
92 struct ldb_context *pdb;
93 TALLOC_CTX *mem_ctx;
94 unsigned int i;
95 NTSTATUS status;
96
97 /* Shortcuts to prevent recursion and avoid lookups */
98 if (token->sids == NULL) {
99 token->privilege_mask = 0;
100 return NT_STATUS_OK;
101 }
102
103 if (security_token_is_system(token)) {
104 token->privilege_mask = ~0;
105 return NT_STATUS_OK;
106 }
107
108 if (security_token_is_anonymous(token)) {
109 token->privilege_mask = 0;
110 return NT_STATUS_OK;
111 }
112
113 mem_ctx = talloc_new(token);
114 pdb = privilege_connect(mem_ctx, lp_ctx);
115 if (pdb == NULL) {
116 talloc_free(mem_ctx);
117 return NT_STATUS_INTERNAL_DB_CORRUPTION;
118 }
119
120 token->privilege_mask = 0;
121
122 for (i=0;i<token->num_sids;i++) {
123 status = samdb_privilege_setup_sid(pdb, mem_ctx,
124 token, &token->sids[i]);
125 if (!NT_STATUS_IS_OK(status)) {
126 talloc_free(mem_ctx);
127 return status;
128 }
129 }
130
131 talloc_free(mem_ctx);
132
133 return NT_STATUS_OK;
134}
Note: See TracBrowser for help on using the repository browser.