source4/dsdb/samdb/ldb_modules/schema.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions
   4
   5    Copyright (C) Andrew Tridgell 2009
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "ldb.h"
  24 #include "ldb_module.h"
  25 #include "librpc/ndr/libndr.h"
  26 #include "dsdb/samdb/ldb_modules/util.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "dsdb/common/util.h"
  29 #include "libcli/security/security.h"
  30 #include "dsdb/samdb/ldb_modules/schema.h"
  31
  32
  33 const struct dsdb_class * get_last_structural_class(const struct dsdb_schema *schema,const struct ldb_message_element *element,
  34                                                     struct ldb_request *parent)
  35 {
  36         const struct dsdb_class *last_class = NULL;
  37         unsigned int i;
  38
  39         for (i = 0; i < element->num_values; i++){
  40                 const struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &element->values[i]);
  41
  42                 if(tmp_class == NULL) {
  43                         continue;
  44                 }
  45
  46                 if(tmp_class->objectClassCategory > 1) {
  47                         continue;
  48                 }
  49
  50                 if (!last_class) {
  51                         last_class = tmp_class;
  52                 } else {
  53                         if (tmp_class->subClass_order > last_class->subClass_order)
  54                                 last_class = tmp_class;
  55                 }
  56         }
  57
  58         return last_class;
  59 }
  60
  61 int acl_check_access_on_class(struct ldb_module *module,
  62                               const struct dsdb_schema *schema,
  63                               TALLOC_CTX *mem_ctx,
  64                               struct security_descriptor *sd,
  65                               struct dom_sid *rp_sid,
  66                               uint32_t access_mask,
  67                               const char *class_name)
  68 {
  69         int ret;
  70         NTSTATUS status;
  71         uint32_t access_granted;
  72         struct object_tree *root = NULL;
  73         struct object_tree *new_node = NULL;
  74         const struct GUID *guid;
  75         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
  76         struct security_token *token = acl_user_token(module);
  77         if (class_name) {
  78                 guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
  79                 if (!guid) {
  80                         DEBUG(10, ("acl_search: cannot find class %s\n",
  81                                    class_name));
  82                         goto fail;
  83                 }
  84                 if (!insert_in_object_tree(tmp_ctx,
  85                                            guid, access_mask,
  86                                            &root, &new_node)) {
  87                         DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
  88                         goto fail;
  89                 }
  90         }
  91         status = sec_access_check_ds(sd, token,
  92                                      access_mask,
  93                                      &access_granted,
  94                                      root,
  95                                      rp_sid);
  96         if (!NT_STATUS_IS_OK(status)) {
  97                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
  98         }
  99         else {
 100                 ret = LDB_SUCCESS;
 101         }
 102         return ret;
 103 fail:
 104         return ldb_operr(ldb_module_get_ctx(module));
 105 }
 106
 107 const struct GUID *get_oc_guid_from_message(struct ldb_module *module,
 108                                                    const struct dsdb_schema *schema,
 109                                                    struct ldb_message *msg)
 110 {
 111         struct ldb_message_element *oc_el;
 112
 113         oc_el = ldb_msg_find_element(msg, "objectClass");
 114         if (!oc_el) {
 115                 return NULL;
 116         }
 117
 118         return class_schemaid_guid_by_lDAPDisplayName(schema,
 119                                                       (char *)oc_el->values[oc_el->num_values-1].data);
 120 }
 121
 122