source4/libcli/security/security_token.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    security descriptor utility functions
   5
   6    Copyright (C) Andrew Tridgell                2004
   7    Copyright (C) Stefan Metzmacher              2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/security/security.h"
  25 #include "auth/session.h"
  26
  27 /*
  28   return a blank security token
  29 */
  30 struct security_token *security_token_initialise(TALLOC_CTX *mem_ctx)
  31 {
  32         struct security_token *st;
  33
  34         st = talloc(mem_ctx, struct security_token);
  35         if (!st) {
  36                 return NULL;
  37         }
  38
  39         st->num_sids = 0;
  40         st->sids = NULL;
  41         st->privilege_mask = 0;
  42
  43         return st;
  44 }
  45
  46 /****************************************************************************
  47  prints a struct security_token to debug output.
  48 ****************************************************************************/
  49 void security_token_debug(int dbg_lev, const struct security_token *token)
  50 {
  51         TALLOC_CTX *mem_ctx;
  52         int i;
  53
  54         if (!token) {
  55                 DEBUG(dbg_lev, ("Security token: (NULL)\n"));
  56                 return;
  57         }
  58
  59         mem_ctx = talloc_init("security_token_debug()");
  60         if (!mem_ctx) {
  61                 return;
  62         }
  63
  64         DEBUG(dbg_lev, ("Security token SIDs (%lu):\n",
  65                                        (unsigned long)token->num_sids));
  66         for (i = 0; i < token->num_sids; i++) {
  67                 DEBUGADD(dbg_lev, ("  SID[%3lu]: %s\n", (unsigned long)i,
  68                            dom_sid_string(mem_ctx, &token->sids[i])));
  69         }
  70
  71         security_token_debug_privileges(dbg_lev, token);
  72
  73         talloc_free(mem_ctx);
  74 }
  75
  76 /* These really should be cheaper... */
  77
  78 bool security_token_is_sid(const struct security_token *token, const struct dom_sid *sid)
  79 {
  80         if (token->sids && dom_sid_equal(&token->sids[PRIMARY_USER_SID_INDEX], sid)) {
  81                 return true;
  82         }
  83         return false;
  84 }
  85
  86 bool security_token_is_sid_string(const struct security_token *token, const char *sid_string)
  87 {
  88         bool ret;
  89         struct dom_sid *sid = dom_sid_parse_talloc(NULL, sid_string);
  90         if (!sid) return false;
  91
  92         ret = security_token_is_sid(token, sid);
  93
  94         talloc_free(sid);
  95         return ret;
  96 }
  97
  98 bool security_token_is_system(const struct security_token *token)
  99 {
 100         return security_token_is_sid_string(token, SID_NT_SYSTEM);
 101 }
 102
 103 bool security_token_is_anonymous(const struct security_token *token)
 104 {
 105         return security_token_is_sid_string(token, SID_NT_ANONYMOUS);
 106 }
 107
 108 bool security_token_has_sid(const struct security_token *token, const struct dom_sid *sid)
 109 {
 110         int i;
 111         for (i = 0; i < token->num_sids; i++) {
 112                 if (dom_sid_equal(&token->sids[i], sid)) {
 113                         return true;
 114                 }
 115         }
 116         return false;
 117 }
 118
 119 bool security_token_has_sid_string(const struct security_token *token, const char *sid_string)
 120 {
 121         bool ret;
 122         struct dom_sid *sid = dom_sid_parse_talloc(NULL, sid_string);
 123         if (!sid) return false;
 124
 125         ret = security_token_has_sid(token, sid);
 126
 127         talloc_free(sid);
 128         return ret;
 129 }
 130
 131 bool security_token_has_builtin_administrators(const struct security_token *token)
 132 {
 133         return security_token_has_sid_string(token, SID_BUILTIN_ADMINISTRATORS);
 134 }
 135
 136 bool security_token_has_nt_authenticated_users(const struct security_token *token)
 137 {
 138         return security_token_has_sid_string(token, SID_NT_AUTHENTICATED_USERS);
 139 }
 140
 141 bool security_token_has_enterprise_dcs(const struct security_token *token)
 142 {
 143         return security_token_has_sid_string(token, SID_NT_ENTERPRISE_DCS);
 144 }
 145
 146 enum security_user_level security_session_user_level(struct auth_session_info *session_info,
 147                                                      const struct dom_sid *domain_sid)
 148 {
 149         if (!session_info) {
 150                 return SECURITY_ANONYMOUS;
 151         }
 152
 153         if (security_token_is_system(session_info->security_token)) {
 154                 return SECURITY_SYSTEM;
 155         }
 156
 157         if (security_token_is_anonymous(session_info->security_token)) {
 158                 return SECURITY_ANONYMOUS;
 159         }
 160
 161         if (security_token_has_builtin_administrators(session_info->security_token)) {
 162                 return SECURITY_ADMINISTRATOR;
 163         }
 164
 165         if (domain_sid) {
 166                 struct dom_sid *rodc_dcs;
 167                 rodc_dcs = dom_sid_add_rid(session_info, domain_sid, DOMAIN_RID_READONLY_DCS);
 168                 if (security_token_has_sid(session_info->security_token, rodc_dcs)) {
 169                         talloc_free(rodc_dcs);
 170                         return SECURITY_RO_DOMAIN_CONTROLLER;
 171                 }
 172                 talloc_free(rodc_dcs);
 173         }
 174
 175         if (security_token_has_enterprise_dcs(session_info->security_token)) {
 176                 return SECURITY_DOMAIN_CONTROLLER;
 177         }
 178
 179         if (security_token_has_nt_authenticated_users(session_info->security_token)) {
 180                 return SECURITY_USER;
 181         }
 182
 183         return SECURITY_ANONYMOUS;
 184 }
 185