source: vendor/current/source3/libgpo/gpext/security.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 8.2 KB
Line 
1/*
2 * Unix SMB/CIFS implementation.
3 * Group Policy Support
4 * Copyright (C) Guenther Deschner 2005-2008
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20#include "includes.h"
21#include "../libgpo/gpo_ini.h"
22#include "../libgpo/gpo.h"
23#include "libgpo/gpo_proto.h"
24#include "libgpo/gpext/gpext.h"
25
26#define GP_EXT_NAME "security"
27
28#define GPTTMPL_UNIX_PATH "Microsoft/Windows NT/SecEdit/GptTmpl.inf"
29
30#define GPTTMPL_SECTION_UNICODE "Unicode"
31#define GPTTMPL_SECTION_VERSION "Version"
32
33#define GPTTMPL_SECTION_REGISTRY_VALUES "Registry Values"
34#define GPTTMPL_SECTION_SYSTEM_ACCESS "System Access"
35#define GPTTMPL_SECTION_KERBEROS_POLICY "Kerberos Policy"
36#define GPTTMPL_SECTION_EVENT_AUDIT "Event Audit"
37#define GPTTMPL_SECTION_PRIVILEGE_RIGHTS "Privilege Rights"
38#define GPTTMPL_SECTION_APPLICATION_LOG "Application Log"
39#define GPTTMPL_SECTION_SECURITY_LOG "Security Log"
40#define GPTTMPL_SECTION_SYSTEM_LOG "System Log"
41#define GPTTMPL_SECTION_GROUP_MEMBERSHIP "Group Membership"
42#define GPTTMPL_SECTION_FILE_SECURITY "File Security"
43#define GPTTMPL_SECTION_SERVICE_GENERAL_SETTING "Service General Setting"
44
45static TALLOC_CTX *ctx = NULL;
46
47struct gpttmpl_table {
48 const char *section;
49 const char *parameter;
50 enum winreg_Type type;
51};
52
53/****************************************************************
54 parse the Version section from gpttmpl file
55****************************************************************/
56
57#define GPTTMPL_PARAMETER_REVISION "Revision"
58#define GPTTMPL_PARAMETER_SIGNATURE "signature"
59#define GPTTMPL_VALUE_CHICAGO "\"$CHICAGO$\"" /* whatever this is good for... */
60#define GPTTMPL_PARAMETER_UNICODE "Unicode"
61
62static NTSTATUS gpttmpl_parse_header(struct gp_inifile_context *ini_ctx,
63 uint32_t *version_out)
64{
65 char *signature = NULL;
66 NTSTATUS result;
67 int version;
68 bool is_unicode = false;
69
70 if (!ini_ctx) {
71 return NT_STATUS_INVALID_PARAMETER;
72 }
73
74 result = gp_inifile_getstring(ini_ctx, GPTTMPL_SECTION_VERSION
75 ":"GPTTMPL_PARAMETER_SIGNATURE, &signature);
76 if (!NT_STATUS_IS_OK(result)) {
77 return NT_STATUS_INTERNAL_DB_CORRUPTION;
78 }
79
80 if (!strequal(signature, GPTTMPL_VALUE_CHICAGO)) {
81 return NT_STATUS_INTERNAL_DB_CORRUPTION;
82 }
83 result = gp_inifile_getint(ini_ctx, GPTTMPL_SECTION_VERSION
84 ":"GPTTMPL_PARAMETER_REVISION, &version);
85 if (!NT_STATUS_IS_OK(result)) {
86 return NT_STATUS_INTERNAL_DB_CORRUPTION;
87 }
88
89 if (version_out) {
90 *version_out = version;
91 }
92
93 result = gp_inifile_getbool(ini_ctx, GPTTMPL_SECTION_UNICODE
94 ":"GPTTMPL_PARAMETER_UNICODE, &is_unicode);
95 if (!NT_STATUS_IS_OK(result) || !is_unicode) {
96 return NT_STATUS_INTERNAL_DB_CORRUPTION;
97 }
98
99 return NT_STATUS_OK;
100}
101
102/****************************************************************
103****************************************************************/
104
105static NTSTATUS gpttmpl_init_context(TALLOC_CTX *mem_ctx,
106 uint32_t flags,
107 const char *unix_path,
108 struct gp_inifile_context **ini_ctx)
109{
110 NTSTATUS status;
111 uint32_t version;
112 struct gp_inifile_context *tmp_ctx = NULL;
113
114 status = gp_inifile_init_context(mem_ctx, flags, unix_path,
115 GPTTMPL_UNIX_PATH, &tmp_ctx);
116 NT_STATUS_NOT_OK_RETURN(status);
117
118 status = gpttmpl_parse_header(tmp_ctx, &version);
119 if (!NT_STATUS_IS_OK(status)) {
120 DEBUG(1,("gpttmpl_init_context: failed: %s\n",
121 nt_errstr(status)));
122 TALLOC_FREE(tmp_ctx);
123 return status;
124 }
125
126 *ini_ctx = tmp_ctx;
127
128 return NT_STATUS_OK;
129}
130
131/****************************************************************
132****************************************************************/
133
134static NTSTATUS gpttmpl_process(struct gp_inifile_context *ini_ctx,
135 struct registry_key *root_key,
136 uint32_t flags)
137{
138 return NT_STATUS_OK;
139}
140
141/****************************************************************
142****************************************************************/
143
144static NTSTATUS security_process_group_policy(TALLOC_CTX *mem_ctx,
145 uint32_t flags,
146 struct registry_key *root_key,
147 const struct security_token *token,
148 const struct GROUP_POLICY_OBJECT *deleted_gpo_list,
149 const struct GROUP_POLICY_OBJECT *changed_gpo_list)
150{
151 NTSTATUS status;
152 char *unix_path = NULL;
153 struct gp_inifile_context *ini_ctx = NULL;
154 const struct GROUP_POLICY_OBJECT *gpo;
155 char *gpo_cache_path = cache_path(GPO_CACHE_DIR);
156 if (gpo_cache_path == NULL) {
157 return NT_STATUS_NO_MEMORY;
158 }
159
160 /* implementation of the policy callback function, see
161 * http://msdn.microsoft.com/en-us/library/aa373494%28v=vs.85%29.aspx
162 * for details - gd */
163
164 /* for now do not process the list of deleted group policies
165
166 for (gpo = deleted_gpo_list; gpo; gpo = gpo->next) {
167 }
168
169 */
170
171 for (gpo = changed_gpo_list; gpo; gpo = gpo->next) {
172
173 gpext_debug_header(0, "security_process_group_policy", flags,
174 gpo, GP_EXT_GUID_SECURITY, NULL);
175
176 /* this handler processes the gpttmpl files and merge output to the
177 * registry */
178
179 status = gpo_get_unix_path(mem_ctx, gpo_cache_path,
180 gpo, &unix_path);
181 if (!NT_STATUS_IS_OK(status)) {
182 goto out;
183 }
184
185 status = gpttmpl_init_context(mem_ctx, flags, unix_path,
186 &ini_ctx);
187 if (!NT_STATUS_IS_OK(status)) {
188 goto out;
189 }
190
191 status = gpttmpl_process(ini_ctx, root_key, flags);
192 if (!NT_STATUS_IS_OK(status)) {
193 goto out;
194 }
195
196 TALLOC_FREE(ini_ctx);
197 }
198
199 out:
200 if (!NT_STATUS_IS_OK(status)) {
201 DEBUG(0,("security_process_group_policy: %s\n",
202 nt_errstr(status)));
203 }
204 TALLOC_FREE(ini_ctx);
205 talloc_free(gpo_cache_path);
206
207 return status;
208}
209
210/****************************************************************
211****************************************************************/
212
213static NTSTATUS security_get_reg_config(TALLOC_CTX *mem_ctx,
214 struct gp_extension_reg_info **reg_info)
215{
216 NTSTATUS status;
217 struct gp_extension_reg_info *info = NULL;
218
219 struct gp_extension_reg_table table[] = {
220 /* FIXME: how can we store the "(Default)" value ??? */
221 /* { "", REG_SZ, "Security" }, */
222 { "ProcessGroupPolicy", REG_SZ, "security_process_group_policy" },
223 { "NoUserPolicy", REG_DWORD, "1" },
224 { "ExtensionDebugLevel", REG_DWORD, "1" },
225 { NULL, REG_NONE, NULL }
226 };
227
228 info = talloc_zero(mem_ctx, struct gp_extension_reg_info);
229 NT_STATUS_HAVE_NO_MEMORY(info);
230
231 status = gpext_info_add_entry(mem_ctx, GP_EXT_NAME,
232 GP_EXT_GUID_SECURITY,
233 table, info);
234 NT_STATUS_NOT_OK_RETURN(status);
235
236 *reg_info = info;
237
238 return NT_STATUS_OK;
239}
240
241
242/****************************************************************
243****************************************************************/
244
245static NTSTATUS security_initialize(TALLOC_CTX *mem_ctx)
246{
247 return NT_STATUS_OK;
248}
249
250/****************************************************************
251****************************************************************/
252
253static NTSTATUS security_shutdown(void)
254{
255 NTSTATUS status;
256
257 status = gpext_unregister_gp_extension(GP_EXT_NAME);
258 if (NT_STATUS_IS_OK(status)) {
259 return status;
260 }
261
262 TALLOC_FREE(ctx);
263
264 return NT_STATUS_OK;
265}
266
267/****************************************************************
268****************************************************************/
269
270static struct gp_extension_methods security_methods = {
271 .initialize = security_initialize,
272 .process_group_policy = security_process_group_policy,
273 .get_reg_config = security_get_reg_config,
274 .shutdown = security_shutdown
275};
276
277/****************************************************************
278****************************************************************/
279
280NTSTATUS gpext_security_init(void)
281{
282 NTSTATUS status;
283
284 ctx = talloc_init("gpext_security_init");
285 NT_STATUS_HAVE_NO_MEMORY(ctx);
286
287 status = gpext_register_gp_extension(ctx, SMB_GPEXT_INTERFACE_VERSION,
288 GP_EXT_NAME, GP_EXT_GUID_SECURITY,
289 &security_methods);
290 if (!NT_STATUS_IS_OK(status)) {
291 TALLOC_FREE(ctx);
292 }
293
294 return status;
295}
Note: See TracBrowser for help on using the repository browser.