2 Unix SMB/CIFS implementation.
4 security descriptor utility functions
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Stefan Metzmacher 2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libcli/security/security.h"
25 #include "auth/session.h"
28 return a blank security token
30 struct security_token *security_token_initialise(TALLOC_CTX *mem_ctx)
32 struct security_token *st;
34 st = talloc(mem_ctx, struct security_token);
41 st->privilege_mask = 0;
46 /****************************************************************************
47 prints a struct security_token to debug output.
48 ****************************************************************************/
49 void security_token_debug(int dbg_lev, const struct security_token *token)
55 DEBUG(dbg_lev, ("Security token: (NULL)\n"));
59 mem_ctx = talloc_init("security_token_debug()");
64 DEBUG(dbg_lev, ("Security token SIDs (%lu):\n",
65 (unsigned long)token->num_sids));
66 for (i = 0; i < token->num_sids; i++) {
67 DEBUGADD(dbg_lev, (" SID[%3lu]: %s\n", (unsigned long)i,
68 dom_sid_string(mem_ctx, token->sids[i])));
71 security_token_debug_privileges(dbg_lev, token);
76 /* These really should be cheaper... */
78 bool security_token_is_sid(const struct security_token *token, const struct dom_sid *sid)
80 if (token->sids && dom_sid_equal(token->sids[PRIMARY_USER_SID_INDEX], sid)) {
86 bool security_token_is_sid_string(const struct security_token *token, const char *sid_string)
89 struct dom_sid *sid = dom_sid_parse_talloc(NULL, sid_string);
90 if (!sid) return false;
92 ret = security_token_is_sid(token, sid);
98 bool security_token_is_system(const struct security_token *token)
100 return security_token_is_sid_string(token, SID_NT_SYSTEM);
103 bool security_token_is_anonymous(const struct security_token *token)
105 return security_token_is_sid_string(token, SID_NT_ANONYMOUS);
108 bool security_token_has_sid(const struct security_token *token, const struct dom_sid *sid)
111 for (i = 0; i < token->num_sids; i++) {
112 if (dom_sid_equal(token->sids[i], sid)) {
119 bool security_token_has_sid_string(const struct security_token *token, const char *sid_string)
122 struct dom_sid *sid = dom_sid_parse_talloc(NULL, sid_string);
123 if (!sid) return false;
125 ret = security_token_has_sid(token, sid);
131 bool security_token_has_builtin_administrators(const struct security_token *token)
133 return security_token_has_sid_string(token, SID_BUILTIN_ADMINISTRATORS);
136 bool security_token_has_nt_authenticated_users(const struct security_token *token)
138 return security_token_has_sid_string(token, SID_NT_AUTHENTICATED_USERS);
141 bool security_token_has_enterprise_dcs(const struct security_token *token)
143 return security_token_has_sid_string(token, SID_NT_ENTERPRISE_DCS);
146 enum security_user_level security_session_user_level(struct auth_session_info *session_info,
147 const struct dom_sid *domain_sid)
150 return SECURITY_ANONYMOUS;
153 if (security_token_is_system(session_info->security_token)) {
154 return SECURITY_SYSTEM;
157 if (security_token_is_anonymous(session_info->security_token)) {
158 return SECURITY_ANONYMOUS;
161 if (security_token_has_builtin_administrators(session_info->security_token)) {
162 return SECURITY_ADMINISTRATOR;
166 struct dom_sid *rodc_dcs;
167 rodc_dcs = dom_sid_add_rid(session_info, domain_sid, DOMAIN_RID_READONLY_DCS);
168 if (security_token_has_sid(session_info->security_token, rodc_dcs)) {
169 talloc_free(rodc_dcs);
170 return SECURITY_RO_DOMAIN_CONTROLLER;
172 talloc_free(rodc_dcs);
175 if (security_token_has_enterprise_dcs(session_info->security_token)) {
176 return SECURITY_DOMAIN_CONTROLLER;
179 if (security_token_has_nt_authenticated_users(session_info->security_token)) {
180 return SECURITY_USER;
183 return SECURITY_ANONYMOUS;