2 Unix SMB/CIFS implementation.
4 Copyright (C) Andrew Tridgell 2004
5 Copyright (C) Gerald Carter 2005
6 Copyright (C) Volker Lendecke 2007
7 Copyright (C) Jeremy Allison 2008
8 Copyright (C) Andrew Bartlett 2010
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "libcli/security/security.h"
27 /* Map generic access rights to object specific rights. This technique is
28 used to give meaning to assigning read, write, execute and all access to
29 objects. Each type of object has its own mapping of generic to object
30 specific access rights. */
32 void se_map_generic(uint32_t *access_mask, const struct generic_mapping *mapping)
34 uint32_t old_mask = *access_mask;
36 if (*access_mask & GENERIC_READ_ACCESS) {
37 *access_mask &= ~GENERIC_READ_ACCESS;
38 *access_mask |= mapping->generic_read;
41 if (*access_mask & GENERIC_WRITE_ACCESS) {
42 *access_mask &= ~GENERIC_WRITE_ACCESS;
43 *access_mask |= mapping->generic_write;
46 if (*access_mask & GENERIC_EXECUTE_ACCESS) {
47 *access_mask &= ~GENERIC_EXECUTE_ACCESS;
48 *access_mask |= mapping->generic_execute;
51 if (*access_mask & GENERIC_ALL_ACCESS) {
52 *access_mask &= ~GENERIC_ALL_ACCESS;
53 *access_mask |= mapping->generic_all;
56 if (old_mask != *access_mask) {
57 DEBUG(10, ("se_map_generic(): mapped mask 0x%08x to 0x%08x\n",
58 old_mask, *access_mask));
62 /* Map generic access rights to object specific rights for all the ACE's
66 void security_acl_map_generic(struct security_acl *sa,
67 const struct generic_mapping *mapping)
75 for (i = 0; i < sa->num_aces; i++) {
76 se_map_generic(&sa->aces[i].access_mask, mapping);
80 /* Map standard access rights to object specific rights. This technique is
81 used to give meaning to assigning read, write, execute and all access to
82 objects. Each type of object has its own mapping of standard to object
83 specific access rights. */
85 void se_map_standard(uint32_t *access_mask, const struct standard_mapping *mapping)
87 uint32_t old_mask = *access_mask;
89 if (*access_mask & SEC_STD_READ_CONTROL) {
90 *access_mask &= ~SEC_STD_READ_CONTROL;
91 *access_mask |= mapping->std_read;
94 if (*access_mask & (SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE)) {
95 *access_mask &= ~(SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE);
96 *access_mask |= mapping->std_all;
99 if (old_mask != *access_mask) {
100 DEBUG(10, ("se_map_standard(): mapped mask 0x%08x to 0x%08x\n",
101 old_mask, *access_mask));
106 perform a SEC_FLAG_MAXIMUM_ALLOWED access check
108 static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
109 const struct security_token *token)
111 uint32_t denied = 0, granted = 0;
114 if (security_token_has_sid(token, sd->owner_sid)) {
115 granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL;
118 if (sd->dacl == NULL) {
119 return granted & ~denied;
122 for (i = 0;i<sd->dacl->num_aces; i++) {
123 struct security_ace *ace = &sd->dacl->aces[i];
125 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
129 if (!security_token_has_sid(token, &ace->trustee)) {
134 case SEC_ACE_TYPE_ACCESS_ALLOWED:
135 granted |= ace->access_mask;
137 case SEC_ACE_TYPE_ACCESS_DENIED:
138 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
139 denied |= ace->access_mask;
141 default: /* Other ACE types not handled/supported */
146 return granted & ~denied;
150 The main entry point for access checking. If returning ACCESS_DENIED
151 this function returns the denied bits in the uint32_t pointed
152 to by the access_granted pointer.
154 NTSTATUS se_access_check(const struct security_descriptor *sd,
155 const struct security_token *token,
156 uint32_t access_desired,
157 uint32_t *access_granted)
160 uint32_t bits_remaining;
161 uint32_t explicitly_denied_bits = 0;
163 * Up until Windows Server 2008, owner always had these rights. Now
164 * we have to use Owner Rights perms if they are on the file.
166 * In addition we have to accumulate these bits and apply them
167 * correctly. See bug #8795
169 uint32_t owner_rights_allowed = 0;
170 uint32_t owner_rights_denied = 0;
171 bool owner_rights_default = true;
173 *access_granted = access_desired;
174 bits_remaining = access_desired;
176 /* handle the maximum allowed flag */
177 if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
178 uint32_t orig_access_desired = access_desired;
180 access_desired |= access_check_max_allowed(sd, token);
181 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
182 *access_granted = access_desired;
183 bits_remaining = access_desired;
185 DEBUG(10,("se_access_check: MAX desired = 0x%x, granted = 0x%x, remaining = 0x%x\n",
191 /* a NULL dacl allows access */
192 if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
193 *access_granted = access_desired;
197 if (sd->dacl == NULL) {
201 /* check each ace in turn. */
202 for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
203 struct security_ace *ace = &sd->dacl->aces[i];
205 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
210 * We need the Owner Rights permissions to ensure we
211 * give or deny the correct permissions to the owner. Replace
212 * owner_rights with the perms here if it is present.
214 * We don't care if we are not the owner because that is taken
215 * care of below when we check if our token has the owner SID.
218 if (dom_sid_equal(&ace->trustee, &global_sid_Owner_Rights)) {
219 if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
220 owner_rights_allowed |= ace->access_mask;
221 owner_rights_default = false;
222 } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
223 owner_rights_denied |= ace->access_mask;
224 owner_rights_default = false;
229 if (!security_token_has_sid(token, &ace->trustee)) {
234 case SEC_ACE_TYPE_ACCESS_ALLOWED:
235 bits_remaining &= ~ace->access_mask;
237 case SEC_ACE_TYPE_ACCESS_DENIED:
238 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
239 explicitly_denied_bits |= (bits_remaining & ace->access_mask);
241 default: /* Other ACE types not handled/supported */
246 /* The owner always gets owner rights as defined above. */
247 if (security_token_has_sid(token, sd->owner_sid)) {
248 if (owner_rights_default) {
250 * Just remove them, no need to check if they are
253 bits_remaining &= ~(SEC_STD_WRITE_DAC |
254 SEC_STD_READ_CONTROL);
256 bits_remaining &= ~owner_rights_allowed;
257 bits_remaining |= owner_rights_denied;
261 /* Explicitly denied bits always override */
262 bits_remaining |= explicitly_denied_bits;
265 * We check privileges here because they override even DENY entries.
268 /* Does the user have the privilege to gain SEC_PRIV_SECURITY? */
269 if (bits_remaining & SEC_FLAG_SYSTEM_SECURITY) {
270 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
271 bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
273 return NT_STATUS_PRIVILEGE_NOT_HELD;
277 if ((bits_remaining & SEC_STD_WRITE_OWNER) &&
278 security_token_has_privilege(token, SEC_PRIV_TAKE_OWNERSHIP)) {
279 bits_remaining &= ~(SEC_STD_WRITE_OWNER);
283 if (bits_remaining != 0) {
284 *access_granted = bits_remaining;
285 return NT_STATUS_ACCESS_DENIED;
292 The main entry point for access checking FOR THE FILE SERVER ONLY !
293 If returning ACCESS_DENIED this function returns the denied bits in
294 the uint32_t pointed to by the access_granted pointer.
296 NTSTATUS se_file_access_check(const struct security_descriptor *sd,
297 const struct security_token *token,
298 bool priv_open_requested,
299 uint32_t access_desired,
300 uint32_t *access_granted)
302 uint32_t bits_remaining;
305 if (!priv_open_requested) {
306 /* Fall back to generic se_access_check(). */
307 return se_access_check(sd,
314 * We need to handle the maximum allowed flag
315 * outside of se_access_check(), as we need to
316 * add in the access allowed by the privileges
320 if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
321 uint32_t orig_access_desired = access_desired;
323 access_desired |= access_check_max_allowed(sd, token);
324 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
326 if (security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
327 access_desired |= SEC_RIGHTS_PRIV_BACKUP;
330 if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
331 access_desired |= SEC_RIGHTS_PRIV_RESTORE;
334 DEBUG(10,("se_file_access_check: MAX desired = 0x%x "
340 status = se_access_check(sd,
345 if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
349 bits_remaining = *access_granted;
351 /* Check if we should override with privileges. */
352 if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
353 security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
354 bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
356 if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
357 security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
358 bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
360 if (bits_remaining != 0) {
361 *access_granted = bits_remaining;
362 return NT_STATUS_ACCESS_DENIED;
368 static const struct GUID *get_ace_object_type(struct security_ace *ace)
372 if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT)
373 type = &ace->object.object.type.type;
381 /* modified access check for the purposes of DS security
382 * Lots of code duplication, it will ve united in just one
383 * function eventually */
385 NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
386 const struct security_token *token,
387 uint32_t access_desired,
388 uint32_t *access_granted,
389 struct object_tree *tree,
390 struct dom_sid *replace_sid)
393 uint32_t bits_remaining;
394 struct object_tree *node;
395 const struct GUID *type;
396 struct dom_sid *ps_sid = dom_sid_parse_talloc(NULL, SID_NT_SELF);
398 *access_granted = access_desired;
399 bits_remaining = access_desired;
401 /* handle the maximum allowed flag */
402 if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
403 access_desired |= access_check_max_allowed(sd, token);
404 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
405 *access_granted = access_desired;
406 bits_remaining = access_desired;
409 if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
410 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
411 bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
414 return NT_STATUS_PRIVILEGE_NOT_HELD;
418 /* the owner always gets SEC_STD_WRITE_DAC and SEC_STD_READ_CONTROL */
419 if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL)) &&
420 security_token_has_sid(token, sd->owner_sid)) {
421 bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL);
424 /* TODO: remove this, as it is file server specific */
425 if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
426 security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
427 bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
429 if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
430 security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
431 bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
434 /* a NULL dacl allows access */
435 if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
436 *access_granted = access_desired;
441 if (sd->dacl == NULL) {
445 /* check each ace in turn. */
446 for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
447 struct dom_sid *trustee;
448 struct security_ace *ace = &sd->dacl->aces[i];
450 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
453 if (dom_sid_equal(&ace->trustee, ps_sid) && replace_sid) {
454 trustee = replace_sid;
458 trustee = &ace->trustee;
460 if (!security_token_has_sid(token, trustee)) {
465 case SEC_ACE_TYPE_ACCESS_ALLOWED:
467 object_tree_modify_access(tree, ace->access_mask);
469 bits_remaining &= ~ace->access_mask;
471 case SEC_ACE_TYPE_ACCESS_DENIED:
472 if (bits_remaining & ace->access_mask) {
474 return NT_STATUS_ACCESS_DENIED;
477 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
478 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
479 /* check only in case we have provided a tree,
480 * the ACE has an object type and that type
482 type = get_ace_object_type(ace);
490 if (!(node = get_object_tree_by_GUID(tree, type)))
493 if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
494 object_tree_modify_access(node, ace->access_mask);
495 if (node->remaining_access == 0) {
500 if (node->remaining_access & ace->access_mask){
502 return NT_STATUS_ACCESS_DENIED;
506 default: /* Other ACE types not handled/supported */
513 if (bits_remaining != 0) {
514 return NT_STATUS_ACCESS_DENIED;