source: vendor/3.6.0/source3/lib/util_sid.c

Last change on this file was 740, checked in by Silvan Scherrer, 13 years ago

Samba Server: update vendor to 3.6.0
File size: 6.5 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Samba utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
6 Copyright (C) Jeremy Allison 1999
7 Copyright (C) Stefan (metze) Metzmacher 2002
8 Copyright (C) Simo Sorce 2002
9 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23*/
24
25#include "includes.h"
26#include "../librpc/gen_ndr/ndr_security.h"
27#include "../librpc/gen_ndr/netlogon.h"
28#include "../libcli/security/security.h"
29
30
31/*****************************************************************
32 Convert a SID to an ascii string.
33*****************************************************************/
34
35char *sid_to_fstring(fstring sidstr_out, const struct dom_sid *sid)
36{
37 dom_sid_string_buf(sid, sidstr_out, sizeof(fstring));
38 return sidstr_out;
39}
40
41/*****************************************************************
42 Essentially a renamed dom_sid_string from
43 ../libcli/security/dom_sid.c with a panic if it didn't work.
44*****************************************************************/
45
46char *sid_string_talloc(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
47{
48 char *result = dom_sid_string(mem_ctx, sid);
49 SMB_ASSERT(result != NULL);
50 return result;
51}
52
53/*****************************************************************
54 Useful function for debug lines.
55*****************************************************************/
56
57char *sid_string_dbg(const struct dom_sid *sid)
58{
59 return sid_string_talloc(talloc_tos(), sid);
60}
61
62/*****************************************************************
63 Use with care!
64*****************************************************************/
65
66char *sid_string_tos(const struct dom_sid *sid)
67{
68 return sid_string_talloc(talloc_tos(), sid);
69}
70
71/*****************************************************************
72 Write a sid out into on-the-wire format.
73*****************************************************************/
74
75bool sid_linearize(char *outbuf, size_t len, const struct dom_sid *sid)
76{
77 size_t i;
78
79 if (len < ndr_size_dom_sid(sid, 0))
80 return False;
81
82 SCVAL(outbuf,0,sid->sid_rev_num);
83 SCVAL(outbuf,1,sid->num_auths);
84 memcpy(&outbuf[2], sid->id_auth, 6);
85 for(i = 0; i < sid->num_auths; i++)
86 SIVAL(outbuf, 8 + (i*4), sid->sub_auths[i]);
87
88 return True;
89}
90
91/*****************************************************************
92 Returns true if SID is internal (and non-mappable).
93*****************************************************************/
94
95bool non_mappable_sid(struct dom_sid *sid)
96{
97 struct dom_sid dom;
98
99 sid_copy(&dom, sid);
100 sid_split_rid(&dom, NULL);
101
102 if (dom_sid_equal(&dom, &global_sid_Builtin))
103 return True;
104
105 if (dom_sid_equal(&dom, &global_sid_NT_Authority))
106 return True;
107
108 return False;
109}
110
111/*****************************************************************
112 Return the binary string representation of a struct dom_sid.
113 Caller must free.
114*****************************************************************/
115
116char *sid_binstring_hex(const struct dom_sid *sid)
117{
118 char *buf, *s;
119 int len = ndr_size_dom_sid(sid, 0);
120 buf = (char *)SMB_MALLOC(len);
121 if (!buf)
122 return NULL;
123 sid_linearize(buf, len, sid);
124 hex_encode((const unsigned char *)buf, len, &s);
125 free(buf);
126 return s;
127}
128
129NTSTATUS sid_array_from_info3(TALLOC_CTX *mem_ctx,
130 const struct netr_SamInfo3 *info3,
131 struct dom_sid **user_sids,
132 uint32_t *num_user_sids,
133 bool include_user_group_rid,
134 bool skip_ressource_groups)
135{
136 NTSTATUS status;
137 struct dom_sid sid;
138 struct dom_sid *sid_array = NULL;
139 uint32_t num_sids = 0;
140 int i;
141
142 if (include_user_group_rid) {
143 if (!sid_compose(&sid, info3->base.domain_sid, info3->base.rid)) {
144 DEBUG(3, ("could not compose user SID from rid 0x%x\n",
145 info3->base.rid));
146 return NT_STATUS_INVALID_PARAMETER;
147 }
148 status = add_sid_to_array(mem_ctx, &sid, &sid_array, &num_sids);
149 if (!NT_STATUS_IS_OK(status)) {
150 DEBUG(3, ("could not append user SID from rid 0x%x\n",
151 info3->base.rid));
152 return status;
153 }
154 }
155
156 if (!sid_compose(&sid, info3->base.domain_sid, info3->base.primary_gid)) {
157 DEBUG(3, ("could not compose group SID from rid 0x%x\n",
158 info3->base.primary_gid));
159 return NT_STATUS_INVALID_PARAMETER;
160 }
161 status = add_sid_to_array(mem_ctx, &sid, &sid_array, &num_sids);
162 if (!NT_STATUS_IS_OK(status)) {
163 DEBUG(3, ("could not append group SID from rid 0x%x\n",
164 info3->base.rid));
165 return status;
166 }
167
168 for (i = 0; i < info3->base.groups.count; i++) {
169 /* Don't add the primary group sid twice. */
170 if (info3->base.primary_gid == info3->base.groups.rids[i].rid) {
171 continue;
172 }
173 if (!sid_compose(&sid, info3->base.domain_sid,
174 info3->base.groups.rids[i].rid)) {
175 DEBUG(3, ("could not compose SID from additional group "
176 "rid 0x%x\n", info3->base.groups.rids[i].rid));
177 return NT_STATUS_INVALID_PARAMETER;
178 }
179 status = add_sid_to_array(mem_ctx, &sid, &sid_array, &num_sids);
180 if (!NT_STATUS_IS_OK(status)) {
181 DEBUG(3, ("could not append SID from additional group "
182 "rid 0x%x\n", info3->base.groups.rids[i].rid));
183 return status;
184 }
185 }
186
187 /* Copy 'other' sids. We need to do sid filtering here to
188 prevent possible elevation of privileges. See:
189
190 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
191 */
192
193 for (i = 0; i < info3->sidcount; i++) {
194
195 if (skip_ressource_groups &&
196 (info3->sids[i].attributes & SE_GROUP_RESOURCE)) {
197 continue;
198 }
199
200 status = add_sid_to_array(mem_ctx, info3->sids[i].sid,
201 &sid_array, &num_sids);
202 if (!NT_STATUS_IS_OK(status)) {
203 DEBUG(3, ("could not add SID to array: %s\n",
204 sid_string_dbg(info3->sids[i].sid)));
205 return status;
206 }
207 }
208
209 *user_sids = sid_array;
210 *num_user_sids = num_sids;
211
212 return NT_STATUS_OK;
213}
Note: See TracBrowser for help on using the repository browser.