← Back to branch summary

~zulcss/samba/server-dailies-3.4

« back to all changes in this revision

Viewing changes to source3/libgpo/gpo_sec.c

  • Committer: Chuck Short
  • Date: 2010-09-28 20:38:39 UTC
  • Revision ID: zulcss@ubuntu.com-20100928203839-pgjulytsi9ue63x1
Initial version

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/libgpo/gpo_sec.c
 
1
/*
 
2
 *  Unix SMB/CIFS implementation.
 
3
 *  Group Policy Object Support
 
4
 *  Copyright (C) Guenther Deschner 2007
 
5
 *
 
6
 *  This program is free software; you can redistribute it and/or modify
 
7
 *  it under the terms of the GNU General Public License as published by
 
8
 *  the Free Software Foundation; either version 3 of the License, or
 
9
 *  (at your option) any later version.
 
10
 *
 
11
 *  This program is distributed in the hope that it will be useful,
 
12
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 
13
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
14
 *  GNU General Public License for more details.
 
15
 *
 
16
 *  You should have received a copy of the GNU General Public License
 
17
 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
 
18
 */
 
19
 
 
20
#include "includes.h"
 
21
 
 
22
/****************************************************************
 
23
****************************************************************/
 
24
 
 
25
static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
 
26
{
 
27
        struct GUID ext_right_apg_guid;
 
28
        NTSTATUS status;
 
29
 
 
30
        if (!object) {
 
31
                return false;
 
32
        }
 
33
 
 
34
        status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
 
35
                                  &ext_right_apg_guid);
 
36
        if (!NT_STATUS_IS_OK(status)) {
 
37
                return false;
 
38
        }
 
39
 
 
40
        switch (object->flags) {
 
41
                case SEC_ACE_OBJECT_TYPE_PRESENT:
 
42
                        if (GUID_equal(&object->type.type,
 
43
                                       &ext_right_apg_guid)) {
 
44
                                return True;
 
45
                        }
 
46
                case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
 
47
                        if (GUID_equal(&object->inherited_type.inherited_type,
 
48
                                       &ext_right_apg_guid)) {
 
49
                                return True;
 
50
                        }
 
51
                default:
 
52
                        break;
 
53
        }
 
54
 
 
55
        return false;
 
56
}
 
57
 
 
58
/****************************************************************
 
59
****************************************************************/
 
60
 
 
61
static bool gpo_sd_check_agp_object(const SEC_ACE *ace)
 
62
{
 
63
        if (!sec_ace_object(ace->type)) {
 
64
                return false;
 
65
        }
 
66
 
 
67
        return gpo_sd_check_agp_object_guid(&ace->object.object);
 
68
}
 
69
 
 
70
/****************************************************************
 
71
****************************************************************/
 
72
 
 
73
static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
 
74
{
 
75
        return (access_mask & SEC_RIGHTS_EXTENDED);
 
76
}
 
77
 
 
78
#if 0
 
79
/****************************************************************
 
80
****************************************************************/
 
81
 
 
82
static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
 
83
{
 
84
        uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
 
85
                           SEC_RIGHTS_READ_ALL_PROP |
 
86
                           SEC_RIGHTS_READ_PERMS;
 
87
 
 
88
        return (read_bits == (access_mask & read_bits));
 
89
}
 
90
#endif
 
91
 
 
92
/****************************************************************
 
93
****************************************************************/
 
94
 
 
95
static NTSTATUS gpo_sd_check_ace_denied_object(const SEC_ACE *ace,
 
96
                                               const struct nt_user_token *token)
 
97
{
 
98
        if (gpo_sd_check_agp_object(ace) &&
 
99
            gpo_sd_check_agp_access_bits(ace->access_mask) &&
 
100
            nt_token_check_sid(&ace->trustee, token)) {
 
101
                DEBUG(10,("gpo_sd_check_ace_denied_object: "
 
102
                        "Access denied as of ace for %s\n",
 
103
                        sid_string_dbg(&ace->trustee)));
 
104
                return NT_STATUS_ACCESS_DENIED;
 
105
        }
 
106
 
 
107
        return STATUS_MORE_ENTRIES;
 
108
}
 
109
 
 
110
/****************************************************************
 
111
****************************************************************/
 
112
 
 
113
static NTSTATUS gpo_sd_check_ace_allowed_object(const SEC_ACE *ace,
 
114
                                                const struct nt_user_token *token)
 
115
{
 
116
        if (gpo_sd_check_agp_object(ace) &&
 
117
            gpo_sd_check_agp_access_bits(ace->access_mask) &&
 
118
            nt_token_check_sid(&ace->trustee, token)) {
 
119
                DEBUG(10,("gpo_sd_check_ace_allowed_object: "
 
120
                        "Access granted as of ace for %s\n",
 
121
                        sid_string_dbg(&ace->trustee)));
 
122
                return NT_STATUS_OK;
 
123
        }
 
124
 
 
125
        return STATUS_MORE_ENTRIES;
 
126
}
 
127
 
 
128
/****************************************************************
 
129
****************************************************************/
 
130
 
 
131
static NTSTATUS gpo_sd_check_ace(const SEC_ACE *ace,
 
132
                                 const struct nt_user_token *token)
 
133
{
 
134
        switch (ace->type) {
 
135
                case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 
136
                        return gpo_sd_check_ace_denied_object(ace, token);
 
137
                case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 
138
                        return gpo_sd_check_ace_allowed_object(ace, token);
 
139
                default:
 
140
                        return STATUS_MORE_ENTRIES;
 
141
        }
 
142
}
 
143
 
 
144
/****************************************************************
 
145
****************************************************************/
 
146
 
 
147
NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
 
148
                                      const struct nt_user_token *token)
 
149
{
 
150
        SEC_DESC *sd = gpo->security_descriptor;
 
151
        SEC_ACL *dacl = NULL;
 
152
        NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 
153
        int i;
 
154
 
 
155
        if (!token) {
 
156
                return NT_STATUS_INVALID_USER_BUFFER;
 
157
        }
 
158
 
 
159
        if (!sd) {
 
160
                return NT_STATUS_INVALID_SECURITY_DESCR;
 
161
        }
 
162
 
 
163
        dacl = sd->dacl;
 
164
        if (!dacl) {
 
165
                return NT_STATUS_INVALID_SECURITY_DESCR;
 
166
        }
 
167
 
 
168
        /* check all aces and only return NT_STATUS_OK (== Access granted) or
 
169
         * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
 
170
         * deny access */
 
171
 
 
172
        for (i = 0; i < dacl->num_aces; i ++) {
 
173
 
 
174
                status = gpo_sd_check_ace(&dacl->aces[i], token);
 
175
 
 
176
                if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 
177
                        return status;
 
178
                } else if (NT_STATUS_IS_OK(status)) {
 
179
                        return status;
 
180
                }
 
181
 
 
182
                continue;
 
183
        }
 
184
 
 
185
        return NT_STATUS_ACCESS_DENIED;
 
186
}