source4/libcli/security/access_check.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    security access checking routines
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24
  25
  26 /*
  27   check if a sid is in the supplied token
  28 */
  29 static BOOL sid_active_in_token(const struct dom_sid *sid,
  30                                 const struct security_token *token)
  31 {
  32         int i;
  33         for (i=0;i<token->num_sids;i++) {
  34                 if (dom_sid_equal(sid, token->sids[i])) {
  35                         return True;
  36                 }
  37         }
  38         return False;
  39 }
  40
  41
  42 /*
  43   perform a SEC_FLAG_MAXIMUM_ALLOWED access check
  44 */
  45 static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
  46                                          const struct security_token *token)
  47 {
  48         uint32_t denied = 0, granted = 0;
  49         unsigned i;
  50
  51         if (sid_active_in_token(sd->owner_sid, token)) {
  52                 granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL | SEC_STD_DELETE;
  53         } else if (sec_privilege_check(token, SEC_PRIV_RESTORE)) {
  54                 granted |= SEC_STD_DELETE;
  55         }
  56
  57         for (i = 0;i<sd->dacl->num_aces; i++) {
  58                 struct security_ace *ace = &sd->dacl->aces[i];
  59
  60                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
  61                         continue;
  62                 }
  63
  64                 if (!sid_active_in_token(&ace->trustee, token)) {
  65                         continue;
  66                 }
  67
  68                 switch (ace->type) {
  69                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
  70                         granted |= ace->access_mask;
  71                         break;
  72                 case SEC_ACE_TYPE_ACCESS_DENIED:
  73                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
  74                         denied |= ace->access_mask;
  75                         break;
  76                 default:        /* Other ACE types not handled/supported */
  77                         break;
  78                 }
  79         }
  80
  81         return granted & ~denied;
  82 }
  83
  84 /*
  85   the main entry point for access checking.
  86 */
  87 NTSTATUS sec_access_check(const struct security_descriptor *sd,
  88                           const struct security_token *token,
  89                           uint32_t access_desired,
  90                           uint32_t *access_granted)
  91 {
  92         int i;
  93         uint32_t bits_remaining;
  94
  95         *access_granted = access_desired;
  96         bits_remaining = access_desired;
  97
  98         /* handle the maximum allowed flag */
  99         if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
 100                 access_desired |= access_check_max_allowed(sd, token);
 101                 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
 102                 *access_granted = access_desired;
 103                 bits_remaining = access_desired & ~SEC_STD_DELETE;
 104         }
 105
 106         if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
 107                 if (sec_privilege_check(token, SEC_PRIV_SECURITY)) {
 108                         bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
 109                 } else {
 110                         return NT_STATUS_ACCESS_DENIED;
 111                 }
 112         }
 113
 114         /* dacl not present allows access */
 115         if (!(sd->type & SEC_DESC_DACL_PRESENT)) {
 116                 *access_granted = access_desired;
 117                 return NT_STATUS_OK;
 118         }
 119
 120         /* empty dacl denies access */
 121         if (sd->dacl == NULL || sd->dacl->num_aces == 0) {
 122                 return NT_STATUS_ACCESS_DENIED;
 123         }
 124
 125         /* the owner always gets SEC_STD_WRITE_DAC, SEC_STD_READ_CONTROL and SEC_STD_DELETE */
 126         if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE)) &&
 127             sid_active_in_token(sd->owner_sid, token)) {
 128                 bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE);
 129         }
 130         if ((bits_remaining & SEC_STD_DELETE) &&
 131             sec_privilege_check(token, SEC_PRIV_RESTORE)) {
 132                 bits_remaining &= ~SEC_STD_DELETE;
 133         }
 134
 135         /* check each ace in turn. */
 136         for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
 137                 struct security_ace *ace = &sd->dacl->aces[i];
 138
 139                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 140                         continue;
 141                 }
 142
 143                 if (!sid_active_in_token(&ace->trustee, token)) {
 144                         continue;
 145                 }
 146
 147                 switch (ace->type) {
 148                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 149                         bits_remaining &= ~ace->access_mask;
 150                         break;
 151                 case SEC_ACE_TYPE_ACCESS_DENIED:
 152                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 153                         if (bits_remaining & ace->access_mask) {
 154                                 return NT_STATUS_ACCESS_DENIED;
 155                         }
 156                         break;
 157                 default:        /* Other ACE types not handled/supported */
 158                         break;
 159                 }
 160         }
 161
 162         if (bits_remaining != 0) {
 163                 return NT_STATUS_ACCESS_DENIED;
 164         }
 165
 166         return NT_STATUS_OK;
 167 }