← Back to branch summary

~lefteris-nikoltsios/+junk/samba-lp1016895

« back to all changes in this revision

Viewing changes to source4/dsdb/samdb/ldb_modules/acl_util.c

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2011-12-21 13:18:04 UTC
  • mfrom: (0.39.21 sid)
  • Revision ID: package-import@ubuntu.com-20111221131804-xtlr39wx6njehxxr
Tags: 2:3.6.1-3ubuntu1
* Merge from Debian testing.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/patches/error-trans.fix-276472:
    - Add the translation of Unix Error code -ENOTSUP to NT Error Code
    - NT_STATUS_NOT_SUPPORTED to prevent the Permission denied error.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/control:
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
  + debian/samba.logrotate, debian/samba-common.dhcp, debian/samba.if-up:
    - Make them upstart compatible
  + debian/samba.postinst: 
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/patches/fix-debuglevel-name-conflict.patch: don't use 'debug_level'
    as a global variable name in an NSS module 
  + Dropped:
    - debian/patches/error-trans.fix-276472
    - debian/patches/fix-debuglevel-name-conflict.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
source4/dsdb/samdb/ldb_modules/acl_util.c
 
1
/*
 
2
  ACL utility functions
 
3
 
 
4
  Copyright (C) Nadezhda Ivanova 2010
 
5
 
 
6
  This program is free software; you can redistribute it and/or modify
 
7
  it under the terms of the GNU General Public License as published by
 
8
  the Free Software Foundation; either version 3 of the License, or
 
9
  (at your option) any later version.
 
10
 
 
11
  This program is distributed in the hope that it will be useful,
 
12
  but WITHOUT ANY WARRANTY; without even the implied warranty of
 
13
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
14
  GNU General Public License for more details.
 
15
 
 
16
  You should have received a copy of the GNU General Public License
 
17
  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
18
*/
 
19
 
 
20
/*
 
21
 *  Name: acl_util
 
22
 *
 
23
 *  Component: ldb ACL modules
 
24
 *
 
25
 *  Description: Some auxiliary functions used for access checking
 
26
 *
 
27
 *  Author: Nadezhda Ivanova
 
28
 */
 
29
#include "includes.h"
 
30
#include "ldb_module.h"
 
31
#include "auth/auth.h"
 
32
#include "libcli/security/security.h"
 
33
#include "dsdb/samdb/samdb.h"
 
34
#include "librpc/gen_ndr/ndr_security.h"
 
35
#include "param/param.h"
 
36
#include "dsdb/samdb/ldb_modules/util.h"
 
37
 
 
38
struct security_token *acl_user_token(struct ldb_module *module)
 
39
{
 
40
        struct ldb_context *ldb = ldb_module_get_ctx(module);
 
41
        struct auth_session_info *session_info
 
42
                = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
 
43
        if(!session_info) {
 
44
                return NULL;
 
45
        }
 
46
        return session_info->security_token;
 
47
}
 
48
 
 
49
/* performs an access check from inside the module stack
 
50
 * given the dn of the object to be checked, the required access
 
51
 * guid is either the guid of the extended right, or NULL
 
52
 */
 
53
 
 
54
int dsdb_module_check_access_on_dn(struct ldb_module *module,
 
55
                                   TALLOC_CTX *mem_ctx,
 
56
                                   struct ldb_dn *dn,
 
57
                                   uint32_t access_mask,
 
58
                                   const struct GUID *guid,
 
59
                                   struct ldb_request *parent)
 
60
{
 
61
        int ret;
 
62
        struct ldb_result *acl_res;
 
63
        static const char *acl_attrs[] = {
 
64
                "nTSecurityDescriptor",
 
65
                "objectSid",
 
66
                NULL
 
67
        };
 
68
        struct ldb_context *ldb = ldb_module_get_ctx(module);
 
69
        struct auth_session_info *session_info
 
70
                = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
 
71
        if(!session_info) {
 
72
                return ldb_operr(ldb);
 
73
        }
 
74
        ret = dsdb_module_search_dn(module, mem_ctx, &acl_res, dn,
 
75
                                    acl_attrs,
 
76
                                    DSDB_FLAG_NEXT_MODULE |
 
77
                                    DSDB_SEARCH_SHOW_RECYCLED,
 
78
                                    parent);
 
79
        if (ret != LDB_SUCCESS) {
 
80
                DEBUG(0,("access_check: failed to find object %s\n", ldb_dn_get_linearized(dn)));
 
81
                return ret;
 
82
        }
 
83
        return dsdb_check_access_on_dn_internal(ldb, acl_res,
 
84
                                                mem_ctx,
 
85
                                                session_info->security_token,
 
86
                                                dn,
 
87
                                                access_mask,
 
88
                                                guid);
 
89
}
 
90
 
 
91
int dsdb_module_check_access_on_guid(struct ldb_module *module,
 
92
                                     TALLOC_CTX *mem_ctx,
 
93
                                     struct GUID *guid,
 
94
                                     uint32_t access_mask,
 
95
                                     const struct GUID *oc_guid,
 
96
                                     struct ldb_request *parent)
 
97
{
 
98
        int ret;
 
99
        struct ldb_result *acl_res;
 
100
        static const char *acl_attrs[] = {
 
101
                "nTSecurityDescriptor",
 
102
                "objectSid",
 
103
                NULL
 
104
        };
 
105
        struct ldb_context *ldb = ldb_module_get_ctx(module);
 
106
        struct auth_session_info *session_info
 
107
                = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
 
108
        if(!session_info) {
 
109
                return ldb_operr(ldb);
 
110
        }
 
111
        ret = dsdb_module_search(module, mem_ctx, &acl_res, NULL, LDB_SCOPE_SUBTREE,
 
112
                                 acl_attrs,
 
113
                                 DSDB_FLAG_NEXT_MODULE |
 
114
                                 DSDB_SEARCH_SHOW_RECYCLED,
 
115
                                 parent,
 
116
                                 "objectGUID=%s", GUID_string(mem_ctx, guid));
 
117
 
 
118
        if (ret != LDB_SUCCESS || acl_res->count == 0) {
 
119
                DEBUG(0,("access_check: failed to find object %s\n", GUID_string(mem_ctx, guid)));
 
120
                return ret;
 
121
        }
 
122
        return dsdb_check_access_on_dn_internal(ldb, acl_res,
 
123
                                                mem_ctx,
 
124
                                                session_info->security_token,
 
125
                                                acl_res->msgs[0]->dn,
 
126
                                                access_mask,
 
127
                                                oc_guid);
 
128
}
 
129
 
 
130
int acl_check_access_on_attribute(struct ldb_module *module,
 
131
                                  TALLOC_CTX *mem_ctx,
 
132
                                  struct security_descriptor *sd,
 
133
                                  struct dom_sid *rp_sid,
 
134
                                  uint32_t access_mask,
 
135
                                  const struct dsdb_attribute *attr)
 
136
{
 
137
        int ret;
 
138
        NTSTATUS status;
 
139
        uint32_t access_granted;
 
140
        struct object_tree *root = NULL;
 
141
        struct object_tree *new_node = NULL;
 
142
        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 
143
        struct security_token *token = acl_user_token(module);
 
144
        if (attr) {
 
145
                if (!GUID_all_zero(&attr->attributeSecurityGUID)) {
 
146
                        if (!insert_in_object_tree(tmp_ctx,
 
147
                                                   &attr->attributeSecurityGUID,
 
148
                                                   access_mask, &root,
 
149
                                                   &new_node)) {
 
150
                                DEBUG(10, ("acl_search: cannot add to object tree securityGUID\n"));
 
151
                                goto fail;
 
152
                        }
 
153
 
 
154
                        if (!insert_in_object_tree(tmp_ctx,
 
155
                                                   &attr->schemaIDGUID,
 
156
                                                   access_mask, &new_node,
 
157
                                                   &new_node)) {
 
158
                                DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
 
159
                                goto fail;
 
160
                        }
 
161
                }
 
162
                else {
 
163
                        if (!insert_in_object_tree(tmp_ctx,
 
164
                                                   &attr->schemaIDGUID,
 
165
                                                   access_mask, &root,
 
166
                                                   &new_node)) {
 
167
                                DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
 
168
                                goto fail;
 
169
                        }
 
170
                }
 
171
        }
 
172
        status = sec_access_check_ds(sd, token,
 
173
                                     access_mask,
 
174
                                     &access_granted,
 
175
                                     root,
 
176
                                     rp_sid);
 
177
        if (!NT_STATUS_IS_OK(status)) {
 
178
                ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 
179
        }
 
180
        else {
 
181
                ret = LDB_SUCCESS;
 
182
        }
 
183
        talloc_free(tmp_ctx);
 
184
        return ret;
 
185
fail:
 
186
        talloc_free(tmp_ctx);
 
187
        return ldb_operr(ldb_module_get_ctx(module));
 
188
}
 
189
 
 
190
 
 
191
/* checks for validated writes */
 
192
int acl_check_extended_right(TALLOC_CTX *mem_ctx,
 
193
                             struct security_descriptor *sd,
 
194
                             struct security_token *token,
 
195
                             const char *ext_right,
 
196
                             uint32_t right_type,
 
197
                             struct dom_sid *sid)
 
198
{
 
199
        struct GUID right;
 
200
        NTSTATUS status;
 
201
        uint32_t access_granted;
 
202
        struct object_tree *root = NULL;
 
203
        struct object_tree *new_node = NULL;
 
204
        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 
205
 
 
206
        GUID_from_string(ext_right, &right);
 
207
 
 
208
        if (!insert_in_object_tree(tmp_ctx, &right, right_type,
 
209
                                   &root, &new_node)) {
 
210
                DEBUG(10, ("acl_ext_right: cannot add to object tree\n"));
 
211
                talloc_free(tmp_ctx);
 
212
                return LDB_ERR_OPERATIONS_ERROR;
 
213
        }
 
214
        status = sec_access_check_ds(sd, token,
 
215
                                     right_type,
 
216
                                     &access_granted,
 
217
                                     root,
 
218
                                     sid);
 
219
 
 
220
        if (!NT_STATUS_IS_OK(status)) {
 
221
                talloc_free(tmp_ctx);
 
222
                return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 
223
        }
 
224
        talloc_free(tmp_ctx);
 
225
        return LDB_SUCCESS;
 
226
}
 
227
 
 
228
const char *acl_user_name(TALLOC_CTX *mem_ctx, struct ldb_module *module)
 
229
{
 
230
        struct ldb_context *ldb = ldb_module_get_ctx(module);
 
231
        struct auth_session_info *session_info
 
232
                = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
 
233
        if (!session_info) {
 
234
                return "UNKNOWN (NULL)";
 
235
        }
 
236
 
 
237
        return talloc_asprintf(mem_ctx, "%s\\%s",
 
238
                               session_info->info->domain_name,
 
239
                               session_info->info->account_name);
 
240
}