source: vendor/3.6.9/source3/libads/disp_sec.c

Last change on this file was 740, checked in by Silvan Scherrer, 13 years ago

Samba Server: update vendor to 3.6.0
File size: 6.8 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Samba utility functions. ADS stuff
4 Copyright (C) Alexey Kotovich 2002
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18*/
19
20#include "includes.h"
21#include "ads.h"
22#include "libads/ldap_schema.h"
23#include "../libcli/security/secace.h"
24#include "../librpc/ndr/libndr.h"
25
26/* for ADS */
27#define SEC_RIGHTS_FULL_CTRL 0xf01ff
28
29#ifdef HAVE_LDAP
30
31static struct perm_mask_str {
32 uint32 mask;
33 const char *str;
34} perms[] = {
35 {SEC_RIGHTS_FULL_CTRL, "[Full Control]"},
36
37 {SEC_ADS_LIST, "[List Contents]"},
38 {SEC_ADS_LIST_OBJECT, "[List Object]"},
39
40 {SEC_ADS_READ_PROP, "[Read All Properties]"},
41 {SEC_STD_READ_CONTROL, "[Read Permissions]"},
42
43 {SEC_ADS_SELF_WRITE, "[All validate writes]"},
44 {SEC_ADS_WRITE_PROP, "[Write All Properties]"},
45
46 {SEC_STD_WRITE_DAC, "[Modify Permissions]"},
47 {SEC_STD_WRITE_OWNER, "[Modify Owner]"},
48
49 {SEC_ADS_CREATE_CHILD, "[Create All Child Objects]"},
50
51 {SEC_STD_DELETE, "[Delete]"},
52 {SEC_ADS_DELETE_TREE, "[Delete Subtree]"},
53 {SEC_ADS_DELETE_CHILD, "[Delete All Child Objects]"},
54
55 {SEC_ADS_CONTROL_ACCESS, "[Change Password]"},
56 {SEC_ADS_CONTROL_ACCESS, "[Reset Password]"},
57
58 {0, 0}
59};
60
61/* convert a security permissions into a string */
62static void ads_disp_perms(uint32 type)
63{
64 int i = 0;
65 int j = 0;
66
67 printf("Permissions: ");
68
69 if (type == SEC_RIGHTS_FULL_CTRL) {
70 printf("%s\n", perms[j].str);
71 return;
72 }
73
74 for (i = 0; i < 32; i++) {
75 if (type & (1 << i)) {
76 for (j = 1; perms[j].str; j ++) {
77 if (perms[j].mask == (((unsigned) 1) << i)) {
78 printf("\n\t%s (0x%08x)", perms[j].str, perms[j].mask);
79 }
80 }
81 type &= ~(1 << i);
82 }
83 }
84
85 /* remaining bits get added on as-is */
86 if (type != 0) {
87 printf("[%08x]", type);
88 }
89 puts("");
90}
91
92static const char *ads_interprete_guid_from_object(ADS_STRUCT *ads,
93 TALLOC_CTX *mem_ctx,
94 const struct GUID *guid)
95{
96 const char *ret = NULL;
97
98 if (!ads || !mem_ctx) {
99 return NULL;
100 }
101
102 ret = ads_get_attrname_by_guid(ads, ads->config.schema_path,
103 mem_ctx, guid);
104 if (ret) {
105 return talloc_asprintf(mem_ctx, "LDAP attribute: \"%s\"", ret);
106 }
107
108 ret = ads_get_extended_right_name_by_guid(ads, ads->config.config_path,
109 mem_ctx, guid);
110
111 if (ret) {
112 return talloc_asprintf(mem_ctx, "Extended right: \"%s\"", ret);
113 }
114
115 return ret;
116}
117
118static void ads_disp_sec_ace_object(ADS_STRUCT *ads,
119 TALLOC_CTX *mem_ctx,
120 struct security_ace_object *object)
121{
122 if (object->flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
123 printf("Object type: SEC_ACE_OBJECT_TYPE_PRESENT\n");
124 printf("Object GUID: %s (%s)\n", GUID_string(mem_ctx,
125 &object->type.type),
126 ads_interprete_guid_from_object(ads, mem_ctx,
127 &object->type.type));
128 }
129 if (object->flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT) {
130 printf("Object type: SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT\n");
131 printf("Object GUID: %s (%s)\n", GUID_string(mem_ctx,
132 &object->inherited_type.inherited_type),
133 ads_interprete_guid_from_object(ads, mem_ctx,
134 &object->inherited_type.inherited_type));
135 }
136}
137
138/* display ACE */
139static void ads_disp_ace(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct security_ace *sec_ace)
140{
141 const char *access_type = "UNKNOWN";
142
143 if (!sec_ace_object(sec_ace->type)) {
144 printf("------- ACE (type: 0x%02x, flags: 0x%02x, size: 0x%02x, mask: 0x%x)\n",
145 sec_ace->type,
146 sec_ace->flags,
147 sec_ace->size,
148 sec_ace->access_mask);
149 } else {
150 printf("------- ACE (type: 0x%02x, flags: 0x%02x, size: 0x%02x, mask: 0x%x, object flags: 0x%x)\n",
151 sec_ace->type,
152 sec_ace->flags,
153 sec_ace->size,
154 sec_ace->access_mask,
155 sec_ace->object.object.flags);
156 }
157
158 if (sec_ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
159 access_type = "ALLOWED";
160 } else if (sec_ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
161 access_type = "DENIED";
162 } else if (sec_ace->type == SEC_ACE_TYPE_SYSTEM_AUDIT) {
163 access_type = "SYSTEM AUDIT";
164 } else if (sec_ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
165 access_type = "ALLOWED OBJECT";
166 } else if (sec_ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT) {
167 access_type = "DENIED OBJECT";
168 } else if (sec_ace->type == SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT) {
169 access_type = "AUDIT OBJECT";
170 }
171
172 printf("access SID: %s\naccess type: %s\n",
173 sid_string_talloc(mem_ctx, &sec_ace->trustee), access_type);
174
175 if (sec_ace_object(sec_ace->type)) {
176 ads_disp_sec_ace_object(ads, mem_ctx, &sec_ace->object.object);
177 }
178
179 ads_disp_perms(sec_ace->access_mask);
180}
181
182/* display ACL */
183static void ads_disp_acl(struct security_acl *sec_acl, const char *type)
184{
185 if (!sec_acl)
186 printf("------- (%s) ACL not present\n", type);
187 else {
188 printf("------- (%s) ACL (revision: %d, size: %d, number of ACEs: %d)\n",
189 type,
190 sec_acl->revision,
191 sec_acl->size,
192 sec_acl->num_aces);
193 }
194}
195
196/* display SD */
197void ads_disp_sd(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct security_descriptor *sd)
198{
199 int i;
200 char *tmp_path = NULL;
201
202 if (!sd) {
203 return;
204 }
205
206 if (ads && !ads->config.schema_path) {
207 if (ADS_ERR_OK(ads_schema_path(ads, mem_ctx, &tmp_path))) {
208 ads->config.schema_path = SMB_STRDUP(tmp_path);
209 }
210 }
211
212 if (ads && !ads->config.config_path) {
213 if (ADS_ERR_OK(ads_config_path(ads, mem_ctx, &tmp_path))) {
214 ads->config.config_path = SMB_STRDUP(tmp_path);
215 }
216 }
217
218 printf("-------------- Security Descriptor (revision: %d, type: 0x%02x)\n",
219 sd->revision,
220 sd->type);
221
222 printf("owner SID: %s\n", sd->owner_sid ?
223 sid_string_talloc(mem_ctx, sd->owner_sid) : "(null)");
224 printf("group SID: %s\n", sd->group_sid ?
225 sid_string_talloc(mem_ctx, sd->group_sid) : "(null)");
226
227 ads_disp_acl(sd->sacl, "system");
228 if (sd->sacl) {
229 for (i = 0; i < sd->sacl->num_aces; i ++) {
230 ads_disp_ace(ads, mem_ctx, &sd->sacl->aces[i]);
231 }
232 }
233
234 ads_disp_acl(sd->dacl, "user");
235 if (sd->dacl) {
236 for (i = 0; i < sd->dacl->num_aces; i ++) {
237 ads_disp_ace(ads, mem_ctx, &sd->dacl->aces[i]);
238 }
239 }
240
241 printf("-------------- End Of Security Descriptor\n");
242}
243
244#endif
Note: See TracBrowser for help on using the repository browser.