libcli/security/security_descriptor.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    security descriptror utility functions
   5
   6    Copyright (C) Andrew Tridgell                2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/security/security.h"
  24
  25 /*
  26   return a blank security descriptor (no owners, dacl or sacl)
  27 */
  28 struct security_descriptor *security_descriptor_initialise(TALLOC_CTX *mem_ctx)
  29 {
  30         struct security_descriptor *sd;
  31
  32         sd = talloc(mem_ctx, struct security_descriptor);
  33         if (!sd) {
  34                 return NULL;
  35         }
  36
  37         sd->revision = SD_REVISION;
  38         /* we mark as self relative, even though it isn't while it remains
  39            a pointer in memory because this simplifies the ndr code later.
  40            All SDs that we store/emit are in fact SELF_RELATIVE
  41         */
  42         sd->type = SEC_DESC_SELF_RELATIVE;
  43
  44         sd->owner_sid = NULL;
  45         sd->group_sid = NULL;
  46         sd->sacl = NULL;
  47         sd->dacl = NULL;
  48
  49         return sd;
  50 }
  51
  52 struct security_acl *security_acl_dup(TALLOC_CTX *mem_ctx,
  53                                              const struct security_acl *oacl)
  54 {
  55         struct security_acl *nacl;
  56
  57         if (oacl == NULL) {
  58                 return NULL;
  59         }
  60
  61         if (oacl->aces == NULL && oacl->num_aces > 0) {
  62                 return NULL;
  63         }
  64
  65         nacl = talloc (mem_ctx, struct security_acl);
  66         if (nacl == NULL) {
  67                 return NULL;
  68         }
  69
  70         *nacl = (struct security_acl) {
  71                 .revision = oacl->revision,
  72                 .size     = oacl->size,
  73                 .num_aces = oacl->num_aces,
  74         };
  75         if (nacl->num_aces == 0) {
  76                 return nacl;
  77         }
  78
  79         nacl->aces = (struct security_ace *)talloc_memdup (nacl, oacl->aces, sizeof(struct security_ace) * oacl->num_aces);
  80         if (nacl->aces == NULL) {
  81                 goto failed;
  82         }
  83
  84         return nacl;
  85
  86  failed:
  87         talloc_free (nacl);
  88         return NULL;
  89
  90 }
  91
  92 struct security_acl *security_acl_concatenate(TALLOC_CTX *mem_ctx,
  93                                               const struct security_acl *acl1,
  94                                               const struct security_acl *acl2)
  95 {
  96         struct security_acl *nacl;
  97         uint32_t i;
  98
  99         if (!acl1 && !acl2)
 100                 return NULL;
 101
 102         if (!acl1){
 103                 nacl = security_acl_dup(mem_ctx, acl2);
 104                 return nacl;
 105         }
 106
 107         if (!acl2){
 108                 nacl = security_acl_dup(mem_ctx, acl1);
 109                 return nacl;
 110         }
 111
 112         nacl = talloc (mem_ctx, struct security_acl);
 113         if (nacl == NULL) {
 114                 return NULL;
 115         }
 116
 117         nacl->revision = acl1->revision;
 118         nacl->size = acl1->size + acl2->size;
 119         nacl->num_aces = acl1->num_aces + acl2->num_aces;
 120
 121         if (nacl->num_aces == 0)
 122                 return nacl;
 123
 124         nacl->aces = (struct security_ace *)talloc_array (mem_ctx, struct security_ace, acl1->num_aces+acl2->num_aces);
 125         if ((nacl->aces == NULL) && (nacl->num_aces > 0)) {
 126                 goto failed;
 127         }
 128
 129         for (i = 0; i < acl1->num_aces; i++)
 130                 nacl->aces[i] = acl1->aces[i];
 131         for (i = 0; i < acl2->num_aces; i++)
 132                 nacl->aces[i + acl1->num_aces] = acl2->aces[i];
 133
 134         return nacl;
 135
 136  failed:
 137         talloc_free (nacl);
 138         return NULL;
 139
 140 }
 141
 142 /*
 143    talloc and copy a security descriptor
 144  */
 145 struct security_descriptor *security_descriptor_copy(TALLOC_CTX *mem_ctx,
 146                                                      const struct security_descriptor *osd)
 147 {
 148         struct security_descriptor *nsd;
 149
 150         nsd = talloc_zero(mem_ctx, struct security_descriptor);
 151         if (!nsd) {
 152                 return NULL;
 153         }
 154
 155         if (osd->owner_sid) {
 156                 nsd->owner_sid = dom_sid_dup(nsd, osd->owner_sid);
 157                 if (nsd->owner_sid == NULL) {
 158                         goto failed;
 159                 }
 160         }
 161
 162         if (osd->group_sid) {
 163                 nsd->group_sid = dom_sid_dup(nsd, osd->group_sid);
 164                 if (nsd->group_sid == NULL) {
 165                         goto failed;
 166                 }
 167         }
 168
 169         if (osd->sacl) {
 170                 nsd->sacl = security_acl_dup(nsd, osd->sacl);
 171                 if (nsd->sacl == NULL) {
 172                         goto failed;
 173                 }
 174         }
 175
 176         if (osd->dacl) {
 177                 nsd->dacl = security_acl_dup(nsd, osd->dacl);
 178                 if (nsd->dacl == NULL) {
 179                         goto failed;
 180                 }
 181         }
 182
 183         nsd->revision = osd->revision;
 184         nsd->type = osd->type;
 185
 186         return nsd;
 187
 188  failed:
 189         talloc_free(nsd);
 190
 191         return NULL;
 192 }
 193
 194 NTSTATUS security_descriptor_for_client(TALLOC_CTX *mem_ctx,
 195                                         const struct security_descriptor *ssd,
 196                                         uint32_t sec_info,
 197                                         uint32_t access_granted,
 198                                         struct security_descriptor **_csd)
 199 {
 200         struct security_descriptor *csd = NULL;
 201         uint32_t access_required = 0;
 202
 203         *_csd = NULL;
 204
 205         if (sec_info & (SECINFO_OWNER|SECINFO_GROUP)) {
 206                 access_required |= SEC_STD_READ_CONTROL;
 207         }
 208         if (sec_info & SECINFO_DACL) {
 209                 access_required |= SEC_STD_READ_CONTROL;
 210         }
 211         if (sec_info & SECINFO_SACL) {
 212                 access_required |= SEC_FLAG_SYSTEM_SECURITY;
 213         }
 214
 215         if (access_required & (~access_granted)) {
 216                 return NT_STATUS_ACCESS_DENIED;
 217         }
 218
 219         /*
 220          * make a copy...
 221          */
 222         csd = security_descriptor_copy(mem_ctx, ssd);
 223         if (csd == NULL) {
 224                 return NT_STATUS_NO_MEMORY;
 225         }
 226
 227         /*
 228          * ... and remove everthing not wanted
 229          */
 230
 231         if (!(sec_info & SECINFO_OWNER)) {
 232                 TALLOC_FREE(csd->owner_sid);
 233                 csd->type &= ~SEC_DESC_OWNER_DEFAULTED;
 234         }
 235         if (!(sec_info & SECINFO_GROUP)) {
 236                 TALLOC_FREE(csd->group_sid);
 237                 csd->type &= ~SEC_DESC_GROUP_DEFAULTED;
 238         }
 239         if (!(sec_info & SECINFO_DACL)) {
 240                 TALLOC_FREE(csd->dacl);
 241                 csd->type &= ~(
 242                         SEC_DESC_DACL_PRESENT |
 243                         SEC_DESC_DACL_DEFAULTED|
 244                         SEC_DESC_DACL_AUTO_INHERIT_REQ |
 245                         SEC_DESC_DACL_AUTO_INHERITED |
 246                         SEC_DESC_DACL_PROTECTED |
 247                         SEC_DESC_DACL_TRUSTED);
 248         }
 249         if (!(sec_info & SECINFO_SACL)) {
 250                 TALLOC_FREE(csd->sacl);
 251                 csd->type &= ~(
 252                         SEC_DESC_SACL_PRESENT |
 253                         SEC_DESC_SACL_DEFAULTED |
 254                         SEC_DESC_SACL_AUTO_INHERIT_REQ |
 255                         SEC_DESC_SACL_AUTO_INHERITED |
 256                         SEC_DESC_SACL_PROTECTED |
 257                         SEC_DESC_SERVER_SECURITY);
 258         }
 259
 260         *_csd = csd;
 261         return NT_STATUS_OK;
 262 }
 263
 264 /*
 265   add an ACE to an ACL of a security_descriptor
 266 */
 267
 268 static NTSTATUS security_descriptor_acl_add(struct security_descriptor *sd,
 269                                             bool add_to_sacl,
 270                                             const struct security_ace *ace)
 271 {
 272         struct security_acl *acl = NULL;
 273
 274         if (add_to_sacl) {
 275                 acl = sd->sacl;
 276         } else {
 277                 acl = sd->dacl;
 278         }
 279
 280         if (acl == NULL) {
 281                 acl = talloc(sd, struct security_acl);
 282                 if (acl == NULL) {
 283                         return NT_STATUS_NO_MEMORY;
 284                 }
 285                 acl->revision = SECURITY_ACL_REVISION_NT4;
 286                 acl->size     = 0;
 287                 acl->num_aces = 0;
 288                 acl->aces     = NULL;
 289         }
 290
 291         acl->aces = talloc_realloc(acl, acl->aces,
 292                                    struct security_ace, acl->num_aces+1);
 293         if (acl->aces == NULL) {
 294                 return NT_STATUS_NO_MEMORY;
 295         }
 296
 297         acl->aces[acl->num_aces] = *ace;
 298
 299         switch (acl->aces[acl->num_aces].type) {
 300         case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 301         case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 302         case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
 303         case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
 304                 acl->revision = SECURITY_ACL_REVISION_ADS;
 305                 break;
 306         default:
 307                 break;
 308         }
 309
 310         acl->num_aces++;
 311
 312         if (add_to_sacl) {
 313                 sd->sacl = acl;
 314                 sd->type |= SEC_DESC_SACL_PRESENT;
 315         } else {
 316                 sd->dacl = acl;
 317                 sd->type |= SEC_DESC_DACL_PRESENT;
 318         }
 319
 320         return NT_STATUS_OK;
 321 }
 322
 323 /*
 324   add an ACE to the SACL of a security_descriptor
 325 */
 326
 327 NTSTATUS security_descriptor_sacl_add(struct security_descriptor *sd,
 328                                       const struct security_ace *ace)
 329 {
 330         return security_descriptor_acl_add(sd, true, ace);
 331 }
 332
 333 /*
 334   add an ACE to the DACL of a security_descriptor
 335 */
 336
 337 NTSTATUS security_descriptor_dacl_add(struct security_descriptor *sd,
 338                                       const struct security_ace *ace)
 339 {
 340         return security_descriptor_acl_add(sd, false, ace);
 341 }
 342
 343 /*
 344   delete the ACE corresponding to the given trustee in an ACL of a
 345   security_descriptor
 346 */
 347
 348 static NTSTATUS security_descriptor_acl_del(struct security_descriptor *sd,
 349                                             bool sacl_del,
 350                                             const struct dom_sid *trustee)
 351 {
 352         uint32_t i;
 353         bool found = false;
 354         struct security_acl *acl = NULL;
 355
 356         if (sacl_del) {
 357                 acl = sd->sacl;
 358         } else {
 359                 acl = sd->dacl;
 360         }
 361
 362         if (acl == NULL) {
 363                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 364         }
 365
 366         /* there can be multiple ace's for one trustee */
 367         for (i=0;i<acl->num_aces;i++) {
 368                 if (dom_sid_equal(trustee, &acl->aces[i].trustee)) {
 369                         ARRAY_DEL_ELEMENT(acl->aces, i, acl->num_aces);
 370                         acl->num_aces--;
 371                         if (acl->num_aces == 0) {
 372                                 acl->aces = NULL;
 373                         }
 374                         found = true;
 375                 }
 376         }
 377
 378         if (!found) {
 379                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 380         }
 381
 382         acl->revision = SECURITY_ACL_REVISION_NT4;
 383
 384         for (i=0;i<acl->num_aces;i++) {
 385                 switch (acl->aces[i].type) {
 386                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 387                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 388                 case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
 389                 case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
 390                         acl->revision = SECURITY_ACL_REVISION_ADS;
 391                         return NT_STATUS_OK;
 392                 default:
 393                         break; /* only for the switch statement */
 394                 }
 395         }
 396
 397         return NT_STATUS_OK;
 398 }
 399
 400 /*
 401   delete the ACE corresponding to the given trustee in the DACL of a
 402   security_descriptor
 403 */
 404
 405 NTSTATUS security_descriptor_dacl_del(struct security_descriptor *sd,
 406                                       const struct dom_sid *trustee)
 407 {
 408         return security_descriptor_acl_del(sd, false, trustee);
 409 }
 410
 411 /*
 412   delete the ACE corresponding to the given trustee in the SACL of a
 413   security_descriptor
 414 */
 415
 416 NTSTATUS security_descriptor_sacl_del(struct security_descriptor *sd,
 417                                       const struct dom_sid *trustee)
 418 {
 419         return security_descriptor_acl_del(sd, true, trustee);
 420 }
 421
 422 /*
 423   delete the given ACE in the SACL or DACL of a security_descriptor
 424 */
 425 static NTSTATUS security_descriptor_acl_del_ace(struct security_descriptor *sd,
 426                                                 bool sacl_del,
 427                                                 const struct security_ace *ace)
 428 {
 429         uint32_t i;
 430         bool found = false;
 431         struct security_acl *acl = NULL;
 432
 433         if (sacl_del) {
 434                 acl = sd->sacl;
 435         } else {
 436                 acl = sd->dacl;
 437         }
 438
 439         if (acl == NULL) {
 440                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 441         }
 442
 443         for (i=0;i<acl->num_aces;i++) {
 444                 if (security_ace_equal(ace, &acl->aces[i])) {
 445                         ARRAY_DEL_ELEMENT(acl->aces, i, acl->num_aces);
 446                         acl->num_aces--;
 447                         if (acl->num_aces == 0) {
 448                                 acl->aces = NULL;
 449                         }
 450                         found = true;
 451                         i--;
 452                 }
 453         }
 454
 455         if (!found) {
 456                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 457         }
 458
 459         acl->revision = SECURITY_ACL_REVISION_NT4;
 460
 461         for (i=0;i<acl->num_aces;i++) {
 462                 switch (acl->aces[i].type) {
 463                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 464                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 465                 case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
 466                 case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
 467                         acl->revision = SECURITY_ACL_REVISION_ADS;
 468                         return NT_STATUS_OK;
 469                 default:
 470                         break; /* only for the switch statement */
 471                 }
 472         }
 473
 474         return NT_STATUS_OK;
 475 }
 476
 477 NTSTATUS security_descriptor_dacl_del_ace(struct security_descriptor *sd,
 478                                           const struct security_ace *ace)
 479 {
 480         return security_descriptor_acl_del_ace(sd, false, ace);
 481 }
 482
 483 NTSTATUS security_descriptor_sacl_del_ace(struct security_descriptor *sd,
 484                                           const struct security_ace *ace)
 485 {
 486         return security_descriptor_acl_del_ace(sd, true, ace);
 487 }
 488 /*
 489   compare two security ace structures
 490 */
 491 bool security_ace_equal(const struct security_ace *ace1,
 492                         const struct security_ace *ace2)
 493 {
 494         if (ace1 == ace2) {
 495                 return true;
 496         }
 497         if ((ace1 == NULL) || (ace2 == NULL)) {
 498                 return false;
 499         }
 500         if (ace1->type != ace2->type) {
 501                 return false;
 502         }
 503         if (ace1->flags != ace2->flags) {
 504                 return false;
 505         }
 506         if (ace1->access_mask != ace2->access_mask) {
 507                 return false;
 508         }
 509         if (!dom_sid_equal(&ace1->trustee, &ace2->trustee)) {
 510                 return false;
 511         }
 512
 513         return true;
 514 }
 515
 516
 517 /*
 518   compare two security acl structures
 519 */
 520 bool security_acl_equal(const struct security_acl *acl1,
 521                         const struct security_acl *acl2)
 522 {
 523         uint32_t i;
 524
 525         if (acl1 == acl2) return true;
 526         if (!acl1 || !acl2) return false;
 527         if (acl1->revision != acl2->revision) return false;
 528         if (acl1->num_aces != acl2->num_aces) return false;
 529
 530         for (i=0;i<acl1->num_aces;i++) {
 531                 if (!security_ace_equal(&acl1->aces[i], &acl2->aces[i])) return false;
 532         }
 533         return true;
 534 }
 535
 536 /*
 537   compare two security descriptors.
 538 */
 539 bool security_descriptor_equal(const struct security_descriptor *sd1,
 540                                const struct security_descriptor *sd2)
 541 {
 542         if (sd1 == sd2) return true;
 543         if (!sd1 || !sd2) return false;
 544         if (sd1->revision != sd2->revision) return false;
 545         if (sd1->type != sd2->type) return false;
 546
 547         if (!dom_sid_equal(sd1->owner_sid, sd2->owner_sid)) return false;
 548         if (!dom_sid_equal(sd1->group_sid, sd2->group_sid)) return false;
 549         if (!security_acl_equal(sd1->sacl, sd2->sacl))      return false;
 550         if (!security_acl_equal(sd1->dacl, sd2->dacl))      return false;
 551
 552         return true;
 553 }
 554
 555 /*
 556   compare two security descriptors, but allow certain (missing) parts
 557   to be masked out of the comparison
 558 */
 559 bool security_descriptor_mask_equal(const struct security_descriptor *sd1,
 560                                     const struct security_descriptor *sd2,
 561                                     uint32_t mask)
 562 {
 563         if (sd1 == sd2) return true;
 564         if (!sd1 || !sd2) return false;
 565         if (sd1->revision != sd2->revision) return false;
 566         if ((sd1->type & mask) != (sd2->type & mask)) return false;
 567
 568         if (!dom_sid_equal(sd1->owner_sid, sd2->owner_sid)) return false;
 569         if (!dom_sid_equal(sd1->group_sid, sd2->group_sid)) return false;
 570         if ((mask & SEC_DESC_DACL_PRESENT) && !security_acl_equal(sd1->dacl, sd2->dacl))      return false;
 571         if ((mask & SEC_DESC_SACL_PRESENT) && !security_acl_equal(sd1->sacl, sd2->sacl))      return false;
 572
 573         return true;
 574 }
 575
 576
 577 static struct security_descriptor *security_descriptor_appendv(struct security_descriptor *sd,
 578                                                                bool add_ace_to_sacl,
 579                                                                va_list ap)
 580 {
 581         const char *sidstr;
 582
 583         while ((sidstr = va_arg(ap, const char *))) {
 584                 struct dom_sid *sid;
 585                 struct security_ace *ace = talloc_zero(sd, struct security_ace);
 586                 NTSTATUS status;
 587
 588                 if (ace == NULL) {
 589                         talloc_free(sd);
 590                         return NULL;
 591                 }
 592                 ace->type = va_arg(ap, unsigned int);
 593                 ace->access_mask = va_arg(ap, unsigned int);
 594                 ace->flags = va_arg(ap, unsigned int);
 595                 sid = dom_sid_parse_talloc(ace, sidstr);
 596                 if (sid == NULL) {
 597                         talloc_free(sd);
 598                         return NULL;
 599                 }
 600                 ace->trustee = *sid;
 601                 if (add_ace_to_sacl) {
 602                         status = security_descriptor_sacl_add(sd, ace);
 603                 } else {
 604                         status = security_descriptor_dacl_add(sd, ace);
 605                 }
 606                 /* TODO: check: would talloc_free(ace) here be correct? */
 607                 if (!NT_STATUS_IS_OK(status)) {
 608                         talloc_free(sd);
 609                         return NULL;
 610                 }
 611         }
 612
 613         return sd;
 614 }
 615
 616 static struct security_descriptor *security_descriptor_createv(TALLOC_CTX *mem_ctx,
 617                                                                uint16_t sd_type,
 618                                                                const char *owner_sid,
 619                                                                const char *group_sid,
 620                                                                bool add_ace_to_sacl,
 621                                                                va_list ap)
 622 {
 623         struct security_descriptor *sd;
 624
 625         sd = security_descriptor_initialise(mem_ctx);
 626         if (sd == NULL) {
 627                 return NULL;
 628         }
 629
 630         sd->type |= sd_type;
 631
 632         if (owner_sid) {
 633                 sd->owner_sid = dom_sid_parse_talloc(sd, owner_sid);
 634                 if (sd->owner_sid == NULL) {
 635                         talloc_free(sd);
 636                         return NULL;
 637                 }
 638         }
 639         if (group_sid) {
 640                 sd->group_sid = dom_sid_parse_talloc(sd, group_sid);
 641                 if (sd->group_sid == NULL) {
 642                         talloc_free(sd);
 643                         return NULL;
 644                 }
 645         }
 646
 647         return security_descriptor_appendv(sd, add_ace_to_sacl, ap);
 648 }
 649
 650 /*
 651   create a security descriptor using string SIDs. This is used by the
 652   torture code to allow the easy creation of complex ACLs
 653   This is a varargs function. The list of DACL ACEs ends with a NULL sid.
 654
 655   Each ACE contains a set of 4 parameters:
 656   SID, ACCESS_TYPE, MASK, FLAGS
 657
 658   a typical call would be:
 659
 660     sd = security_descriptor_dacl_create(mem_ctx,
 661                                          sd_type_flags,
 662                                          mysid,
 663                                          mygroup,
 664                                          SID_NT_AUTHENTICATED_USERS,
 665                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
 666                                          SEC_FILE_ALL,
 667                                          SEC_ACE_FLAG_OBJECT_INHERIT,
 668                                          NULL);
 669   that would create a sd with one DACL ACE
 670 */
 671
 672 struct security_descriptor *security_descriptor_dacl_create(TALLOC_CTX *mem_ctx,
 673                                                             uint16_t sd_type,
 674                                                             const char *owner_sid,
 675                                                             const char *group_sid,
 676                                                             ...)
 677 {
 678         struct security_descriptor *sd = NULL;
 679         va_list ap;
 680         va_start(ap, group_sid);
 681         sd = security_descriptor_createv(mem_ctx, sd_type, owner_sid,
 682                                          group_sid, false, ap);
 683         va_end(ap);
 684
 685         return sd;
 686 }
 687
 688 struct security_descriptor *security_descriptor_sacl_create(TALLOC_CTX *mem_ctx,
 689                                                             uint16_t sd_type,
 690                                                             const char *owner_sid,
 691                                                             const char *group_sid,
 692                                                             ...)
 693 {
 694         struct security_descriptor *sd = NULL;
 695         va_list ap;
 696         va_start(ap, group_sid);
 697         sd = security_descriptor_createv(mem_ctx, sd_type, owner_sid,
 698                                          group_sid, true, ap);
 699         va_end(ap);
 700
 701         return sd;
 702 }
 703
 704 struct security_ace *security_ace_create(TALLOC_CTX *mem_ctx,
 705                                          const char *sid_str,
 706                                          enum security_ace_type type,
 707                                          uint32_t access_mask,
 708                                          uint8_t flags)
 709
 710 {
 711         struct security_ace *ace;
 712         bool ok;
 713
 714         ace = talloc_zero(mem_ctx, struct security_ace);
 715         if (ace == NULL) {
 716                 return NULL;
 717         }
 718
 719         ok = dom_sid_parse(sid_str, &ace->trustee);
 720         if (!ok) {
 721                 talloc_free(ace);
 722                 return NULL;
 723         }
 724         ace->type = type;
 725         ace->access_mask = access_mask;
 726         ace->flags = flags;
 727
 728         return ace;
 729 }
 730
 731 /*******************************************************************
 732  Check for MS NFS ACEs in a sd
 733 *******************************************************************/
 734 bool security_descriptor_with_ms_nfs(const struct security_descriptor *psd)
 735 {
 736         uint32_t i;
 737
 738         if (psd->dacl == NULL) {
 739                 return false;
 740         }
 741
 742         for (i = 0; i < psd->dacl->num_aces; i++) {
 743                 if (dom_sid_compare_domain(
 744                             &global_sid_Unix_NFS,
 745                             &psd->dacl->aces[i].trustee) == 0) {
 746                         return true;
 747                 }
 748         }
 749
 750         return false;
 751 }