dbcheck: Add explict tests for unknown and unsorted attributeID values

[metze/samba/wip.git] / libgpo / gpo_sec.c

diff --git a/libgpo/gpo_sec.c b/libgpo/gpo_sec.c
index 15bd2881d50b0dbf76846baf302ef9a87ce6c843..af73697e56e8ae32523d05916693c3787264de0c 100644 (file)
--- a/libgpo/gpo_sec.c
+++ b/libgpo/gpo_sec.c
@@ -18,9 +18,10 @@
  */
 
 #include "includes.h"
-#include "librpc/gen_ndr/security.h"
-#include "librpc/gen_ndr/ndr_misc.h"
+#include "libcli/security/security.h"
 #include "../libgpo/gpo.h"
+#include "auth.h"
+#include "../librpc/ndr/libndr.h"
 
 /****************************************************************
 ****************************************************************/
@@ -46,11 +47,13 @@ static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *objec
                                       &ext_right_apg_guid)) {
                                return true;
                        }
+                       /* FALL TROUGH */
                case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
                        if (GUID_equal(&object->inherited_type.inherited_type,
                                       &ext_right_apg_guid)) {
                                return true;
                        }
+                       /* FALL TROUGH */
                default:
                        break;
        }
@@ -75,7 +78,7 @@ static bool gpo_sd_check_agp_object(const struct security_ace *ace)
 
 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
 {
-       return (access_mask & SEC_RIGHTS_EXTENDED);
+       return (access_mask & SEC_ADS_CONTROL_ACCESS);
 }
 
 #if 0
@@ -96,14 +99,18 @@ static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
 ****************************************************************/
 
 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
-                                              const struct nt_user_token *token)
+                                              const struct security_token *token)
 {
+       char *sid_str;
+
        if (gpo_sd_check_agp_object(ace) &&
            gpo_sd_check_agp_access_bits(ace->access_mask) &&
-           nt_token_check_sid(&ace->trustee, token)) {
+           security_token_has_sid(token, &ace->trustee)) {
+               sid_str = dom_sid_string(NULL, &ace->trustee);
                DEBUG(10,("gpo_sd_check_ace_denied_object: "
                        "Access denied as of ace for %s\n",
-                       sid_string_dbg(&ace->trustee)));
+                       sid_str));
+               talloc_free(sid_str);
                return NT_STATUS_ACCESS_DENIED;
        }
 
@@ -114,14 +121,19 @@ static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
 ****************************************************************/
 
 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
-                                               const struct nt_user_token *token)
+                                               const struct security_token *token)
 {
+       char *sid_str;
+
        if (gpo_sd_check_agp_object(ace) &&
            gpo_sd_check_agp_access_bits(ace->access_mask) &&
-           nt_token_check_sid(&ace->trustee, token)) {
+           security_token_has_sid(token, &ace->trustee)) {
+               sid_str = dom_sid_string(NULL, &ace->trustee);
                DEBUG(10,("gpo_sd_check_ace_allowed_object: "
                        "Access granted as of ace for %s\n",
-                       sid_string_dbg(&ace->trustee)));
+                       sid_str));
+               talloc_free(sid_str);
+
                return NT_STATUS_OK;
        }
 
@@ -132,7 +144,7 @@ static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
 ****************************************************************/
 
 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
-                                const struct nt_user_token *token)
+                                const struct security_token *token)
 {
        switch (ace->type) {
                case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
@@ -148,7 +160,7 @@ static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
 ****************************************************************/
 
 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
-                                     const struct nt_user_token *token)
+                                     const struct security_token *token)
 {
        struct security_descriptor *sd = gpo->security_descriptor;
        struct security_acl *dacl = NULL;