2 Unix SMB/CIFS implementation.
3 Privileges handling functions
4 Copyright (C) Jean François Micouleau 1998-2001
5 Copyright (C) Simo Sorce 2002-2003
6 Copyright (C) Gerald (Jerry) Carter 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #define PRIVPREFIX "PRIV_"
28 #define GENERATE_LUID_LOW(x) (x)+1;
30 static SE_PRIV se_priv_all = SE_ALL_PRIVS;
31 static SE_PRIV se_priv_end = SE_END;
32 static SE_PRIV se_priv_none = SE_NONE;
35 #define ALLOC_CHECK(ptr, err, label, str) do { if ((ptr) == NULL) \
36 { DEBUG(0, ("%s: out of memory!\n", str)); err = NT_STATUS_NO_MEMORY; goto label; } } while(0)
39 {SE_NETWORK_LOGON, "SeNetworkLogonRight", "Access this computer from the network"},
40 {SE_INTERACTIVE_LOGON, "SeInteractiveLogonRight", "Log on locally"},
41 {SE_BATCH_LOGON, "SeBatchLogonRight", "Log on as a batch job"},
42 {SE_SERVICE_LOGON, "SeServiceLogonRight", "Log on as a service"},
44 {SE_MACHINE_ACCOUNT, "SeMachineAccountPrivilege", "Add machines to domain"},
45 {SE_PRINT_OPERATOR, "SePrintOperatorPrivilege", "Printer Admin"},
46 {SE_ADD_USERS, "SeAddUsersPrivilege", "Add users and groups to the domain"},
52 #if 0 /* not needed currently */
54 {SE_ASSIGN_PRIMARY_TOKEN, "SeAssignPrimaryTokenPrivilege", "Assign Primary Token"},
55 {SE_CREATE_TOKEN, "SeCreateTokenPrivilege", "Create Token"},
56 {SE_LOCK_MEMORY, "SeLockMemoryPrivilege", "Lock Memory"},
57 {SE_INCREASE_QUOTA, "SeIncreaseQuotaPrivilege", "Increase Quota"},
58 {SE_UNSOLICITED_INPUT, "SeUnsolicitedInputPrivilege", "Unsolicited Input"},
59 {SE_MACHINE_ACCOUNT, "SeMachineAccountPrivilege", "Can add Machine Accounts to the Domain"},
60 {SE_TCB, "SeTcbPrivilege", "Act as part of the operating system"},
61 {SE_SECURITY, "SeSecurityPrivilege", "Security Privilege"},
62 {SE_TAKE_OWNERSHIP, "SeTakeOwnershipPrivilege", "Take Ownership Privilege"},
63 {SE_LOAD_DRIVER, "SeLocalDriverPrivilege", "Local Driver Privilege"},
64 {SE_SYSTEM_PROFILE, "SeSystemProfilePrivilege", "System Profile Privilege"},
65 {SE_SYSTEM_TIME, "SeSystemtimePrivilege", "System Time"},
66 {SE_PROF_SINGLE_PROCESS, "SeProfileSingleProcessPrivilege", "Profile Single Process Privilege"},
67 {SE_INC_BASE_PRIORITY, "SeIncreaseBasePriorityPrivilege", "Increase Base Priority Privilege"},
68 {SE_CREATE_PAGEFILE, "SeCreatePagefilePrivilege", "Create Pagefile Privilege"},
69 {SE_CREATE_PERMANENT, "SeCreatePermanentPrivilege", "Create Permanent"},
70 {SE_BACKUP, "SeBackupPrivilege", "Backup Privilege"},
71 {SE_RESTORE, "SeRestorePrivilege", "Restore Privilege"},
72 {SE_SHUTDOWN, "SeShutdownPrivilege", "Shutdown Privilege"},
73 {SE_DEBUG, "SeDebugPrivilege", "Debug Privilege"},
74 {SE_AUDIT, "SeAuditPrivilege", "Audit"},
75 {SE_SYSTEM_ENVIRONMENT, "SeSystemEnvironmentPrivilege", "System Environment Privilege"},
76 {SE_CHANGE_NOTIFY, "SeChangeNotifyPrivilege", "Change Notify"},
77 {SE_REMOTE_SHUTDOWN, "SeRemoteShutdownPrivilege", "Remote Shutdown Privilege"},
78 {SE_UNDOCK, "SeUndockPrivilege", "Undock"},
79 {SE_SYNC_AGENT, "SeSynchronizationAgentPrivilege", "Synchronization Agent"},
80 {SE_ENABLE_DELEGATION, "SeEnableDelegationPrivilege", "Enable Delegation"},
81 {SE_PRINT_OPERATOR, "SePrintOperatorPrivilege", "Printer Operator"},
82 {SE_ADD_USERS, "SeAddUsersPrivilege", "Add Users"},
83 {SE_ALL_PRIVS, "SeAllPrivileges", "All Privileges"}
88 typedef struct priv_sid_list {
94 /***************************************************************************
95 copy an SE_PRIV structure
96 ****************************************************************************/
98 BOOL se_priv_copy( SE_PRIV *dst, SE_PRIV *src )
103 memcpy( dst, src, sizeof(SE_PRIV) );
108 /***************************************************************************
109 combine 2 SE_PRIV structures and store the resulting set in mew_mask
110 ****************************************************************************/
112 static void se_priv_add( SE_PRIV *mask, SE_PRIV *addpriv )
116 for ( i=0; i<SE_PRIV_MASKSIZE; i++ ) {
117 mask->mask[i] |= addpriv->mask[i];
121 /***************************************************************************
122 remove one SE_PRIV sytucture from another and store the resulting set
124 ****************************************************************************/
126 static void se_priv_remove( SE_PRIV *mask, SE_PRIV *removepriv )
130 for ( i=0; i<SE_PRIV_MASKSIZE; i++ ) {
131 mask->mask[i] &= ~removepriv->mask[i];
135 /***************************************************************************
136 invert a given SE_PRIV and store the set in new_mask
137 ****************************************************************************/
139 static void se_priv_invert( SE_PRIV *new_mask, SE_PRIV *mask )
143 se_priv_copy( &allprivs, &se_priv_all );
144 se_priv_remove( &allprivs, mask );
145 se_priv_copy( new_mask, &allprivs );
148 /***************************************************************************
149 check if 2 SE_PRIV structure are equal
150 ****************************************************************************/
152 static BOOL se_priv_equal( SE_PRIV *mask1, SE_PRIV *mask2 )
154 return ( memcmp(mask1, mask2, sizeof(SE_PRIV)) == 0 );
158 /***************************************************************************
159 dump an SE_PRIV structure to the log files
160 ****************************************************************************/
162 void dump_se_priv( int dbg_cl, int dbg_lvl, SE_PRIV *mask )
166 DEBUGADDC( dbg_cl, dbg_lvl,("SE_PRIV "));
168 for ( i=0; i<SE_PRIV_MASKSIZE; i++ ) {
169 DEBUGADDC( dbg_cl, dbg_lvl,(" 0x%x", mask->mask[i] ));
172 DEBUGADDC( dbg_cl, dbg_lvl, ("\n"));
175 /***************************************************************************
176 Retrieve the privilege mask (set) for a given SID
177 ****************************************************************************/
179 static BOOL get_privileges( const DOM_SID *sid, SE_PRIV *mask )
181 TDB_CONTEXT *tdb = get_account_pol_tdb();
188 /* PRIV_<SID> (NULL terminated) as the key */
190 fstr_sprintf( keystr, "%s%s", PRIVPREFIX, sid_string_static(sid) );
192 key.dsize = strlen(keystr) + 1;
194 data = tdb_fetch( tdb, key );
197 DEBUG(3,("get_privileges: No privileges assigned to SID [%s]\n",
198 sid_string_static(sid)));
202 SMB_ASSERT( data.dsize == sizeof( SE_PRIV ) );
204 se_priv_copy( mask, (SE_PRIV*)data.dptr );
209 /***************************************************************************
210 Store the privilege mask (set) for a given SID
211 ****************************************************************************/
213 static BOOL set_privileges( const DOM_SID *sid, SE_PRIV *mask )
215 TDB_CONTEXT *tdb = get_account_pol_tdb();
222 /* PRIV_<SID> (NULL terminated) as the key */
224 fstr_sprintf( keystr, "%s%s", PRIVPREFIX, sid_string_static(sid) );
226 key.dsize = strlen(keystr) + 1;
228 /* no packing. static size structure, just write it out */
230 data.dptr = (char*)mask;
231 data.dsize = sizeof(SE_PRIV);
233 return ( tdb_store(tdb, key, data, TDB_REPLACE) != -1 );
236 /****************************************************************************
237 check if the privilege is in the privilege list
238 ****************************************************************************/
240 static BOOL is_privilege_assigned( SE_PRIV *privileges, SE_PRIV *check )
244 if ( !privileges || !check )
247 se_priv_copy( &p1, check );
249 /* invert the SE_PRIV we want to check for and remove that from the
250 original set. If we are left with the SE_PRIV we are checking
251 for then return True */
253 se_priv_invert( &p1, check );
254 se_priv_copy( &p2, privileges );
255 se_priv_remove( &p2, &p1 );
257 return se_priv_equal( &p2, check );
260 /****************************************************************************
261 add a privilege to a privilege array
262 ****************************************************************************/
264 static BOOL privilege_set_add(PRIVILEGE_SET *priv_set, LUID_ATTR set)
268 /* we can allocate memory to add the new privilege */
270 new_set = TALLOC_REALLOC_ARRAY(priv_set->mem_ctx, priv_set->set, LUID_ATTR, priv_set->count + 1);
272 DEBUG(0,("privilege_set_add: failed to allocate memory!\n"));
276 new_set[priv_set->count].luid.high = set.luid.high;
277 new_set[priv_set->count].luid.low = set.luid.low;
278 new_set[priv_set->count].attr = set.attr;
281 priv_set->set = new_set;
286 /*********************************************************************
287 Generate the LUID_ATTR structure based on a bitmask
288 *********************************************************************/
290 LUID_ATTR get_privilege_luid( SE_PRIV *mask )
296 priv_luid.luid.high = 0;
298 for ( i=0; !se_priv_equal(&privs[i].se_priv, &se_priv_end); i++ ) {
300 /* just use the index+1 (so its non-zero) into the
301 array as the lower portion of the LUID */
303 if ( se_priv_equal( &privs[i].se_priv, mask ) ) {
304 priv_luid.luid.low = GENERATE_LUID_LOW(i);
311 /*********************************************************************
312 Generate the LUID_ATTR structure based on a bitmask
313 *********************************************************************/
315 const char* get_privilege_dispname( const char *name )
319 for ( i=0; !se_priv_equal(&privs[i].se_priv, &se_priv_end); i++ ) {
321 if ( strequal( privs[i].name, name ) ) {
322 return privs[i].description;
329 /*********************************************************************
330 get a list of all privleges for all sids the in list
331 *********************************************************************/
333 BOOL get_privileges_for_sids(SE_PRIV *privileges, DOM_SID *slist, int scount)
339 se_priv_copy( privileges, &se_priv_none );
341 for ( i=0; i<scount; i++ ) {
342 /* don't add unless we actually have a privilege assigned */
344 if ( !get_privileges( &slist[i], &mask ) )
347 DEBUG(5,("get_privileges_for_sids: sid = %s\nPrivilege set:\n",
348 sid_string_static(&slist[i])));
349 dump_se_priv( DBGC_ALL, 5, &mask );
351 se_priv_add( privileges, &mask );
359 /*********************************************************************
360 travseral functions for privilege_enumerate_accounts
361 *********************************************************************/
363 static int priv_traverse_fn(TDB_CONTEXT *t, TDB_DATA key, TDB_DATA data, void *state)
365 PRIV_SID_LIST *priv = state;
366 int prefixlen = strlen(PRIVPREFIX);
370 /* easy check first */
372 if ( data.dsize != sizeof(SE_PRIV) )
375 /* check we have a PRIV_+SID entry */
377 if ( strncmp(key.dptr, PRIVPREFIX, prefixlen) != 0)
380 /* check to see if we are looking for a particular privilege */
382 if ( !se_priv_equal(&priv->privilege, &se_priv_none) ) {
385 se_priv_copy( &mask, (SE_PRIV*)data.dptr );
387 /* if the SID does not have the specified privilege
390 if ( !is_privilege_assigned( &mask, &priv->privilege) )
394 fstrcpy( sid_string, &key.dptr[strlen(PRIVPREFIX)] );
396 if ( !string_to_sid(&sid, sid_string) ) {
397 DEBUG(0,("travsersal_fn_enum__acct: Could not convert SID [%s]\n",
402 add_sid_to_array( &sid, &priv->sids.list, &priv->sids.count );
407 /*********************************************************************
408 Retreive list of privileged SIDs (for _lsa_enumerate_accounts()
409 *********************************************************************/
411 NTSTATUS privilege_enumerate_accounts(DOM_SID **sids, int *num_sids)
413 TDB_CONTEXT *tdb = get_account_pol_tdb();
418 se_priv_copy( &priv.privilege, &se_priv_none );
420 tdb_traverse( tdb, priv_traverse_fn, &priv);
422 /* give the memory away; caller will free */
424 *sids = priv.sids.list;
425 *num_sids = priv.sids.count;
430 #if 0 /* JERRY - not used */
431 /***************************************************************************
432 Retrieve the SIDs assigned to a given privilege
433 ****************************************************************************/
435 NTSTATUS priv_get_sids(const char *privname, DOM_SID **sids, int *num_sids)
437 TDB_CONTEXT *tdb = get_account_pol_tdb();
442 tdb_traverse( tdb, priv_traverse_fn, &priv);
444 /* give the memory away; caller will free */
446 *sids = priv.sids.list;
447 *num_sids = priv.sids.count;
453 /***************************************************************************
455 ****************************************************************************/
457 BOOL grant_privilege(const DOM_SID *sid, SE_PRIV *priv_mask)
459 SE_PRIV old_mask, new_mask;
461 if ( get_privileges( sid, &old_mask ) )
462 se_priv_copy( &new_mask, &old_mask );
464 se_priv_copy( &new_mask, &se_priv_none );
466 se_priv_add( &new_mask, priv_mask );
468 DEBUG(10,("grant_privilege: %s\n", sid_string_static(sid)));
470 DEBUGADD( 10, ("original privilege mask:\n"));
471 dump_se_priv( DBGC_ALL, 10, &old_mask );
473 DEBUGADD( 10, ("new privilege mask:\n"));
474 dump_se_priv( DBGC_ALL, 10, &new_mask );
476 return set_privileges( sid, &new_mask );
479 /*********************************************************************
480 Add a privilege based on its name
481 *********************************************************************/
483 BOOL grant_privilege_by_name(DOM_SID *sid, const char *name)
487 for ( i=0; !se_priv_equal(&privs[i].se_priv, &se_priv_end); i++ ) {
488 if ( strequal(privs[i].name, name) ) {
489 return grant_privilege( sid, &privs[i].se_priv );
493 DEBUG(3, ("grant_privilege_by_name: No Such Privilege Found (%s)\n", name));
498 /***************************************************************************
499 Remove privilege from sid
500 ****************************************************************************/
502 BOOL revoke_privilege(const DOM_SID *sid, SE_PRIV *priv_mask)
506 /* if the user has no privileges, then we can't revoke any */
508 if ( !get_privileges( sid, &mask ) )
511 DEBUG(10,("revoke_privilege: %s\n", sid_string_static(sid)));
513 DEBUGADD( 10, ("original privilege mask:\n"));
514 dump_se_priv( DBGC_ALL, 10, &mask );
516 se_priv_remove( &mask, priv_mask );
518 DEBUGADD( 10, ("new privilege mask:\n"));
519 dump_se_priv( DBGC_ALL, 10, &mask );
521 return set_privileges( sid, &mask );
524 /*********************************************************************
525 Revoke all privileges
526 *********************************************************************/
528 BOOL revoke_all_privileges( DOM_SID *sid )
530 return revoke_privilege( sid, &se_priv_all );
533 /*********************************************************************
534 Add a privilege based on its name
535 *********************************************************************/
537 BOOL revoke_privilege_by_name(DOM_SID *sid, const char *name)
541 for ( i=0; !se_priv_equal(&privs[i].se_priv, &se_priv_end); i++ ) {
542 if ( strequal(privs[i].name, name) ) {
543 return revoke_privilege( sid, &privs[i].se_priv );
547 DEBUG(3, ("revoke_privilege_by_name: No Such Privilege Found (%s)\n", name));
552 /***************************************************************************
553 Retrieve the SIDs assigned to a given privilege
554 ****************************************************************************/
556 NTSTATUS privilege_create_account(const DOM_SID *sid )
558 return ( grant_privilege(sid, &se_priv_none) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL);
561 /****************************************************************************
562 initialise a privilege list and set the talloc context
563 ****************************************************************************/
564 NTSTATUS privilege_set_init(PRIVILEGE_SET *priv_set)
569 ZERO_STRUCTP( priv_set );
571 mem_ctx = talloc_init("privilege set");
572 ALLOC_CHECK(mem_ctx, ret, done, "init_privilege");
574 priv_set->mem_ctx = mem_ctx;
582 /****************************************************************************
583 initialise a privilege list and with someone else's talloc context
584 ****************************************************************************/
586 NTSTATUS privilege_set_init_by_ctx(TALLOC_CTX *mem_ctx, PRIVILEGE_SET *priv_set)
588 ZERO_STRUCTP( priv_set );
590 priv_set->mem_ctx = mem_ctx;
591 priv_set->ext_ctx = True;
596 /****************************************************************************
597 Free all memory used by a PRIVILEGE_SET
598 ****************************************************************************/
600 void privilege_set_free(PRIVILEGE_SET *priv_set)
605 if ( !( priv_set->ext_ctx ) )
606 talloc_destroy( priv_set->mem_ctx );
608 ZERO_STRUCTP( priv_set );
611 /****************************************************************************
612 duplicate alloc luid_attr
613 ****************************************************************************/
615 NTSTATUS dup_luid_attr(TALLOC_CTX *mem_ctx, LUID_ATTR **new_la, LUID_ATTR *old_la, int count)
620 /* don't crash if the source pointer is NULL (since we don't
621 do priviledges now anyways) */
626 *new_la = TALLOC_ARRAY(mem_ctx, LUID_ATTR, count);
627 ALLOC_CHECK(new_la, ret, done, "dupalloc_luid_attr");
629 for (i=0; i<count; i++) {
630 (*new_la)[i].luid.high = old_la[i].luid.high;
631 (*new_la)[i].luid.low = old_la[i].luid.low;
632 (*new_la)[i].attr = old_la[i].attr;
642 /****************************************************************************
643 Performa deep copy of a PRIVILEGE_SET structure. Assumes an initialized
644 destination structure.
645 *****************************************************************************/
647 BOOL dup_privilege_set( PRIVILEGE_SET *dest, PRIVILEGE_SET *src )
654 result = dup_luid_attr( dest->mem_ctx, &dest->set, src->set, src->count );
655 if ( !NT_STATUS_IS_OK(result) ) {
656 DEBUG(0,("dup_privilege_set: Failed to dup LUID_ATTR array [%s]\n",
657 nt_errstr(result) ));
661 dest->control = src->control;
662 dest->count = src->count;
668 /****************************************************************************
669 Does the user have the specified privilege ? We only deal with one privilege
671 *****************************************************************************/
673 BOOL user_has_privileges(NT_USER_TOKEN *token, SE_PRIV *privilege)
675 return is_privilege_assigned( &token->privileges, privilege );
678 /****************************************************************************
679 Convert a LUID to a named string
680 ****************************************************************************/
682 char* luid_to_privilege_name(const LUID *set)
685 int max = count_all_privileges();
690 if ( set->low > max )
693 fstrcpy( name, privs[set->low - 1].name );
698 /****************************************************************************
699 Convert an LUID to a 32-bit mask
700 ****************************************************************************/
702 SE_PRIV* luid_to_privilege_mask(const LUID *set)
705 int max = count_all_privileges();
710 if ( set->low > max )
713 se_priv_copy( &mask, &privs[set->low - 1].se_priv );
718 /*******************************************************************
719 return the number of elements in the privlege array
720 *******************************************************************/
722 int count_all_privileges( void )
729 /* loop over the array and count it */
730 for ( count=0; !se_priv_equal(&privs[count].se_priv, &se_priv_end); count++ ) ;
736 /*******************************************************************
737 return True is the SID has an entry in the account_pol.tdb
738 *******************************************************************/
740 BOOL is_privileged_sid( DOM_SID *sid )
744 /* check if the lookup succeeds */
746 return get_privileges( sid, &mask );
750 /*******************************************************************
751 *******************************************************************/
753 BOOL se_priv_to_privilege_set( PRIVILEGE_SET *set, SE_PRIV *mask )
756 uint32 num_privs = count_all_privileges();
762 for ( i=0; i<num_privs; i++ ) {
763 if ( !is_privilege_assigned(mask, &privs[i].se_priv) )
766 luid.luid.low = GENERATE_LUID_LOW(i);
768 if ( !privilege_set_add( set, luid ) )
775 /*******************************************************************
776 *******************************************************************/
778 BOOL privilege_set_to_se_priv( SE_PRIV *mask, PRIVILEGE_SET *privset )
781 uint32 num_privs = count_all_privileges();
783 ZERO_STRUCTP( mask );
785 for ( i=0; i<privset->count; i++ ) {
788 /* sanity check for invalid privilege. we really
789 only care about the low 32 bits */
791 if ( privset->set[i].luid.high != 0 )
794 /* make sure :LUID.low is in range */
795 if ( privset->set[i].luid.low == 0 || privset->set[i].luid.low > num_privs )
798 r = privs[privset->set[i].luid.low - 1].se_priv;
799 se_priv_add( mask, &r );