libcli/security/security_descriptor.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    security descriptror utility functions
   5
   6    Copyright (C) Andrew Tridgell                2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/security/security_descriptor.h"
  24 #include "libcli/security/dom_sid.h"
  25
  26 /*
  27   return a blank security descriptor (no owners, dacl or sacl)
  28 */
  29 struct security_descriptor *security_descriptor_initialise(TALLOC_CTX *mem_ctx)
  30 {
  31         struct security_descriptor *sd;
  32
  33         sd = talloc(mem_ctx, struct security_descriptor);
  34         if (!sd) {
  35                 return NULL;
  36         }
  37
  38         sd->revision = SD_REVISION;
  39         /* we mark as self relative, even though it isn't while it remains
  40            a pointer in memory because this simplifies the ndr code later.
  41            All SDs that we store/emit are in fact SELF_RELATIVE
  42         */
  43         sd->type = SEC_DESC_SELF_RELATIVE;
  44
  45         sd->owner_sid = NULL;
  46         sd->group_sid = NULL;
  47         sd->sacl = NULL;
  48         sd->dacl = NULL;
  49
  50         return sd;
  51 }
  52
  53 struct security_acl *security_acl_dup(TALLOC_CTX *mem_ctx,
  54                                              const struct security_acl *oacl)
  55 {
  56         struct security_acl *nacl;
  57
  58         if (oacl == NULL) {
  59                 return NULL;
  60         }
  61
  62         nacl = talloc (mem_ctx, struct security_acl);
  63         if (nacl == NULL) {
  64                 return NULL;
  65         }
  66
  67         nacl->aces = (struct security_ace *)talloc_memdup (nacl, oacl->aces, sizeof(struct security_ace) * oacl->num_aces);
  68         if ((nacl->aces == NULL) && (oacl->num_aces > 0)) {
  69                 goto failed;
  70         }
  71
  72         nacl->revision = oacl->revision;
  73         nacl->size = oacl->size;
  74         nacl->num_aces = oacl->num_aces;
  75
  76         return nacl;
  77
  78  failed:
  79         talloc_free (nacl);
  80         return NULL;
  81
  82 }
  83
  84 struct security_acl *security_acl_concatenate(TALLOC_CTX *mem_ctx,
  85                                               const struct security_acl *acl1,
  86                                               const struct security_acl *acl2)
  87 {
  88         struct security_acl *nacl;
  89         int i;
  90
  91         if (!acl1 && !acl2)
  92                 return NULL;
  93
  94         if (!acl1){
  95                 nacl = security_acl_dup(mem_ctx, acl2);
  96                 return nacl;
  97         }
  98
  99         if (!acl2){
 100                 nacl = security_acl_dup(mem_ctx, acl1);
 101                 return nacl;
 102         }
 103
 104         nacl = talloc (mem_ctx, struct security_acl);
 105         if (nacl == NULL) {
 106                 return NULL;
 107         }
 108
 109         nacl->revision = acl1->revision;
 110         nacl->size = acl1->size + acl2->size;
 111         nacl->num_aces = acl1->num_aces + acl2->num_aces;
 112
 113         if (nacl->num_aces == 0)
 114                 return nacl;
 115
 116         nacl->aces = (struct security_ace *)talloc_array (mem_ctx, struct security_ace, acl1->num_aces+acl2->num_aces);
 117         if ((nacl->aces == NULL) && (nacl->num_aces > 0)) {
 118                 goto failed;
 119         }
 120
 121         for (i = 0; i < acl1->num_aces; i++)
 122                 nacl->aces[i] = acl1->aces[i];
 123         for (i = 0; i < acl2->num_aces; i++)
 124                 nacl->aces[i + acl1->num_aces] = acl2->aces[i];
 125
 126         return nacl;
 127
 128  failed:
 129         talloc_free (nacl);
 130         return NULL;
 131
 132 }
 133
 134 /*
 135    talloc and copy a security descriptor
 136  */
 137 struct security_descriptor *security_descriptor_copy(TALLOC_CTX *mem_ctx,
 138                                                      const struct security_descriptor *osd)
 139 {
 140         struct security_descriptor *nsd;
 141
 142         nsd = talloc_zero(mem_ctx, struct security_descriptor);
 143         if (!nsd) {
 144                 return NULL;
 145         }
 146
 147         if (osd->owner_sid) {
 148                 nsd->owner_sid = dom_sid_dup(nsd, osd->owner_sid);
 149                 if (nsd->owner_sid == NULL) {
 150                         goto failed;
 151                 }
 152         }
 153
 154         if (osd->group_sid) {
 155                 nsd->group_sid = dom_sid_dup(nsd, osd->group_sid);
 156                 if (nsd->group_sid == NULL) {
 157                         goto failed;
 158                 }
 159         }
 160
 161         if (osd->sacl) {
 162                 nsd->sacl = security_acl_dup(nsd, osd->sacl);
 163                 if (nsd->sacl == NULL) {
 164                         goto failed;
 165                 }
 166         }
 167
 168         if (osd->dacl) {
 169                 nsd->dacl = security_acl_dup(nsd, osd->dacl);
 170                 if (nsd->dacl == NULL) {
 171                         goto failed;
 172                 }
 173         }
 174
 175         nsd->revision = osd->revision;
 176         nsd->type = osd->type;
 177
 178         return nsd;
 179
 180  failed:
 181         talloc_free(nsd);
 182
 183         return NULL;
 184 }
 185
 186 /*
 187   add an ACE to an ACL of a security_descriptor
 188 */
 189
 190 static NTSTATUS security_descriptor_acl_add(struct security_descriptor *sd,
 191                                             bool add_to_sacl,
 192                                             const struct security_ace *ace)
 193 {
 194         struct security_acl *acl = NULL;
 195
 196         if (add_to_sacl) {
 197                 acl = sd->sacl;
 198         } else {
 199                 acl = sd->dacl;
 200         }
 201
 202         if (acl == NULL) {
 203                 acl = talloc(sd, struct security_acl);
 204                 if (acl == NULL) {
 205                         return NT_STATUS_NO_MEMORY;
 206                 }
 207                 acl->revision = SECURITY_ACL_REVISION_NT4;
 208                 acl->size     = 0;
 209                 acl->num_aces = 0;
 210                 acl->aces     = NULL;
 211         }
 212
 213         acl->aces = talloc_realloc(acl, acl->aces,
 214                                    struct security_ace, acl->num_aces+1);
 215         if (acl->aces == NULL) {
 216                 return NT_STATUS_NO_MEMORY;
 217         }
 218
 219         acl->aces[acl->num_aces] = *ace;
 220
 221         switch (acl->aces[acl->num_aces].type) {
 222         case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 223         case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 224         case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
 225         case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
 226                 acl->revision = SECURITY_ACL_REVISION_ADS;
 227                 break;
 228         default:
 229                 break;
 230         }
 231
 232         acl->num_aces++;
 233
 234         if (add_to_sacl) {
 235                 sd->sacl = acl;
 236                 sd->type |= SEC_DESC_SACL_PRESENT;
 237         } else {
 238                 sd->dacl = acl;
 239                 sd->type |= SEC_DESC_DACL_PRESENT;
 240         }
 241
 242         return NT_STATUS_OK;
 243 }
 244
 245 /*
 246   add an ACE to the SACL of a security_descriptor
 247 */
 248
 249 NTSTATUS security_descriptor_sacl_add(struct security_descriptor *sd,
 250                                       const struct security_ace *ace)
 251 {
 252         return security_descriptor_acl_add(sd, true, ace);
 253 }
 254
 255 /*
 256   add an ACE to the DACL of a security_descriptor
 257 */
 258
 259 NTSTATUS security_descriptor_dacl_add(struct security_descriptor *sd,
 260                                       const struct security_ace *ace)
 261 {
 262         return security_descriptor_acl_add(sd, false, ace);
 263 }
 264
 265 /*
 266   delete the ACE corresponding to the given trustee in an ACL of a
 267   security_descriptor
 268 */
 269
 270 static NTSTATUS security_descriptor_acl_del(struct security_descriptor *sd,
 271                                             bool sacl_del,
 272                                             const struct dom_sid *trustee)
 273 {
 274         int i;
 275         bool found = false;
 276         struct security_acl *acl = NULL;
 277
 278         if (sacl_del) {
 279                 acl = sd->sacl;
 280         } else {
 281                 acl = sd->dacl;
 282         }
 283
 284         if (acl == NULL) {
 285                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 286         }
 287
 288         /* there can be multiple ace's for one trustee */
 289         for (i=0;i<acl->num_aces;i++) {
 290                 if (dom_sid_equal(trustee, &acl->aces[i].trustee)) {
 291                         memmove(&acl->aces[i], &acl->aces[i+1],
 292                                 sizeof(acl->aces[i]) * (acl->num_aces - (i+1)));
 293                         acl->num_aces--;
 294                         if (acl->num_aces == 0) {
 295                                 acl->aces = NULL;
 296                         }
 297                         found = true;
 298                 }
 299         }
 300
 301         if (!found) {
 302                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 303         }
 304
 305         acl->revision = SECURITY_ACL_REVISION_NT4;
 306
 307         for (i=0;i<acl->num_aces;i++) {
 308                 switch (acl->aces[i].type) {
 309                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 310                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 311                 case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
 312                 case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
 313                         acl->revision = SECURITY_ACL_REVISION_ADS;
 314                         return NT_STATUS_OK;
 315                 default:
 316                         break; /* only for the switch statement */
 317                 }
 318         }
 319
 320         return NT_STATUS_OK;
 321 }
 322
 323 /*
 324   delete the ACE corresponding to the given trustee in the DACL of a
 325   security_descriptor
 326 */
 327
 328 NTSTATUS security_descriptor_dacl_del(struct security_descriptor *sd,
 329                                       const struct dom_sid *trustee)
 330 {
 331         return security_descriptor_acl_del(sd, false, trustee);
 332 }
 333
 334 /*
 335   delete the ACE corresponding to the given trustee in the SACL of a
 336   security_descriptor
 337 */
 338
 339 NTSTATUS security_descriptor_sacl_del(struct security_descriptor *sd,
 340                                       const struct dom_sid *trustee)
 341 {
 342         return security_descriptor_acl_del(sd, true, trustee);
 343 }
 344
 345 /*
 346   compare two security ace structures
 347 */
 348 bool security_ace_equal(const struct security_ace *ace1,
 349                         const struct security_ace *ace2)
 350 {
 351         if (ace1 == ace2) return true;
 352         if (!ace1 || !ace2) return false;
 353         if (ace1->type != ace2->type) return false;
 354         if (ace1->flags != ace2->flags) return false;
 355         if (ace1->access_mask != ace2->access_mask) return false;
 356         if (!dom_sid_equal(&ace1->trustee, &ace2->trustee)) return false;
 357
 358         return true;
 359 }
 360
 361
 362 /*
 363   compare two security acl structures
 364 */
 365 bool security_acl_equal(const struct security_acl *acl1,
 366                         const struct security_acl *acl2)
 367 {
 368         int i;
 369
 370         if (acl1 == acl2) return true;
 371         if (!acl1 || !acl2) return false;
 372         if (acl1->revision != acl2->revision) return false;
 373         if (acl1->num_aces != acl2->num_aces) return false;
 374
 375         for (i=0;i<acl1->num_aces;i++) {
 376                 if (!security_ace_equal(&acl1->aces[i], &acl2->aces[i])) return false;
 377         }
 378         return true;
 379 }
 380
 381 /*
 382   compare two security descriptors.
 383 */
 384 bool security_descriptor_equal(const struct security_descriptor *sd1,
 385                                const struct security_descriptor *sd2)
 386 {
 387         if (sd1 == sd2) return true;
 388         if (!sd1 || !sd2) return false;
 389         if (sd1->revision != sd2->revision) return false;
 390         if (sd1->type != sd2->type) return false;
 391
 392         if (!dom_sid_equal(sd1->owner_sid, sd2->owner_sid)) return false;
 393         if (!dom_sid_equal(sd1->group_sid, sd2->group_sid)) return false;
 394         if (!security_acl_equal(sd1->sacl, sd2->sacl))      return false;
 395         if (!security_acl_equal(sd1->dacl, sd2->dacl))      return false;
 396
 397         return true;
 398 }
 399
 400 /*
 401   compare two security descriptors, but allow certain (missing) parts
 402   to be masked out of the comparison
 403 */
 404 bool security_descriptor_mask_equal(const struct security_descriptor *sd1,
 405                                     const struct security_descriptor *sd2,
 406                                     uint32_t mask)
 407 {
 408         if (sd1 == sd2) return true;
 409         if (!sd1 || !sd2) return false;
 410         if (sd1->revision != sd2->revision) return false;
 411         if ((sd1->type & mask) != (sd2->type & mask)) return false;
 412
 413         if (!dom_sid_equal(sd1->owner_sid, sd2->owner_sid)) return false;
 414         if (!dom_sid_equal(sd1->group_sid, sd2->group_sid)) return false;
 415         if ((mask & SEC_DESC_DACL_PRESENT) && !security_acl_equal(sd1->dacl, sd2->dacl))      return false;
 416         if ((mask & SEC_DESC_SACL_PRESENT) && !security_acl_equal(sd1->sacl, sd2->sacl))      return false;
 417
 418         return true;
 419 }
 420
 421
 422 static struct security_descriptor *security_descriptor_appendv(struct security_descriptor *sd,
 423                                                                bool add_ace_to_sacl,
 424                                                                va_list ap)
 425 {
 426         const char *sidstr;
 427
 428         while ((sidstr = va_arg(ap, const char *))) {
 429                 struct dom_sid *sid;
 430                 struct security_ace *ace = talloc_zero(sd, struct security_ace);
 431                 NTSTATUS status;
 432
 433                 if (ace == NULL) {
 434                         talloc_free(sd);
 435                         return NULL;
 436                 }
 437                 ace->type = va_arg(ap, unsigned int);
 438                 ace->access_mask = va_arg(ap, unsigned int);
 439                 ace->flags = va_arg(ap, unsigned int);
 440                 sid = dom_sid_parse_talloc(ace, sidstr);
 441                 if (sid == NULL) {
 442                         talloc_free(sd);
 443                         return NULL;
 444                 }
 445                 ace->trustee = *sid;
 446                 if (add_ace_to_sacl) {
 447                         status = security_descriptor_sacl_add(sd, ace);
 448                 } else {
 449                         status = security_descriptor_dacl_add(sd, ace);
 450                 }
 451                 /* TODO: check: would talloc_free(ace) here be correct? */
 452                 if (!NT_STATUS_IS_OK(status)) {
 453                         talloc_free(sd);
 454                         return NULL;
 455                 }
 456         }
 457
 458         return sd;
 459 }
 460
 461 struct security_descriptor *security_descriptor_append(struct security_descriptor *sd,
 462                                                        ...)
 463 {
 464         va_list ap;
 465
 466         va_start(ap, sd);
 467         sd = security_descriptor_appendv(sd, false, ap);
 468         va_end(ap);
 469
 470         return sd;
 471 }
 472
 473 static struct security_descriptor *security_descriptor_createv(TALLOC_CTX *mem_ctx,
 474                                                                uint16_t sd_type,
 475                                                                const char *owner_sid,
 476                                                                const char *group_sid,
 477                                                                bool add_ace_to_sacl,
 478                                                                va_list ap)
 479 {
 480         struct security_descriptor *sd;
 481
 482         sd = security_descriptor_initialise(mem_ctx);
 483         if (sd == NULL) {
 484                 return NULL;
 485         }
 486
 487         sd->type |= sd_type;
 488
 489         if (owner_sid) {
 490                 sd->owner_sid = dom_sid_parse_talloc(sd, owner_sid);
 491                 if (sd->owner_sid == NULL) {
 492                         talloc_free(sd);
 493                         return NULL;
 494                 }
 495         }
 496         if (group_sid) {
 497                 sd->group_sid = dom_sid_parse_talloc(sd, group_sid);
 498                 if (sd->group_sid == NULL) {
 499                         talloc_free(sd);
 500                         return NULL;
 501                 }
 502         }
 503
 504         return security_descriptor_appendv(sd, add_ace_to_sacl, ap);
 505 }
 506
 507 /*
 508   create a security descriptor using string SIDs. This is used by the
 509   torture code to allow the easy creation of complex ACLs
 510   This is a varargs function. The list of DACL ACEs ends with a NULL sid.
 511
 512   Each ACE contains a set of 4 parameters:
 513   SID, ACCESS_TYPE, MASK, FLAGS
 514
 515   a typical call would be:
 516
 517     sd = security_descriptor_dacl_create(mem_ctx,
 518                                          sd_type_flags,
 519                                          mysid,
 520                                          mygroup,
 521                                          SID_NT_AUTHENTICATED_USERS,
 522                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
 523                                          SEC_FILE_ALL,
 524                                          SEC_ACE_FLAG_OBJECT_INHERIT,
 525                                          NULL);
 526   that would create a sd with one DACL ACE
 527 */
 528
 529 struct security_descriptor *security_descriptor_dacl_create(TALLOC_CTX *mem_ctx,
 530                                                             uint16_t sd_type,
 531                                                             const char *owner_sid,
 532                                                             const char *group_sid,
 533                                                             ...)
 534 {
 535         struct security_descriptor *sd = NULL;
 536         va_list ap;
 537         va_start(ap, group_sid);
 538         sd = security_descriptor_createv(mem_ctx, sd_type, owner_sid,
 539                                          group_sid, false, ap);
 540         va_end(ap);
 541
 542         return sd;
 543 }
 544
 545 struct security_descriptor *security_descriptor_sacl_create(TALLOC_CTX *mem_ctx,
 546                                                             uint16_t sd_type,
 547                                                             const char *owner_sid,
 548                                                             const char *group_sid,
 549                                                             ...)
 550 {
 551         struct security_descriptor *sd = NULL;
 552         va_list ap;
 553         va_start(ap, group_sid);
 554         sd = security_descriptor_createv(mem_ctx, sd_type, owner_sid,
 555                                          group_sid, true, ap);
 556         va_end(ap);
 557
 558         return sd;
 559 }
 560
 561 struct security_ace *security_ace_create(TALLOC_CTX *mem_ctx,
 562                                          const char *sid_str,
 563                                          enum security_ace_type type,
 564                                          uint32_t access_mask,
 565                                          uint8_t flags)
 566
 567 {
 568         struct dom_sid *sid;
 569         struct security_ace *ace;
 570
 571         ace = talloc_zero(mem_ctx, struct security_ace);
 572         if (ace == NULL) {
 573                 return NULL;
 574         }
 575
 576         sid = dom_sid_parse_talloc(ace, sid_str);
 577         if (sid == NULL) {
 578                 talloc_free(ace);
 579                 return NULL;
 580         }
 581
 582         ace->trustee = *sid;
 583         ace->type = type;
 584         ace->access_mask = access_mask;
 585         ace->flags = flags;
 586
 587         return ace;
 588 }