source3/libgpo/gpo_reg.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2007-2008
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "../libgpo/gpo.h"
  22 #include "libgpo/gpo_proto.h"
  23 #include "registry.h"
  24 #include "registry/reg_backend_db.h"
  25
  26
  27 /****************************************************************
  28 ****************************************************************/
  29
  30 struct nt_user_token *registry_create_system_token(TALLOC_CTX *mem_ctx)
  31 {
  32         struct nt_user_token *token = NULL;
  33
  34         token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token);
  35         if (!token) {
  36                 DEBUG(1,("talloc failed\n"));
  37                 return NULL;
  38         }
  39
  40         token->privilege_mask = se_priv_all;
  41
  42         if (!NT_STATUS_IS_OK(add_sid_to_array(token, &global_sid_System,
  43                          &token->sids, &token->num_sids))) {
  44                 DEBUG(1,("Error adding nt-authority system sid to token\n"));
  45                 return NULL;
  46         }
  47
  48         return token;
  49 }
  50
  51 /****************************************************************
  52 ****************************************************************/
  53
  54 WERROR gp_init_reg_ctx(TALLOC_CTX *mem_ctx,
  55                        const char *initial_path,
  56                        uint32_t desired_access,
  57                        const struct nt_user_token *token,
  58                        struct gp_registry_context **reg_ctx)
  59 {
  60         struct gp_registry_context *tmp_ctx;
  61         WERROR werr;
  62
  63         if (!reg_ctx) {
  64                 return WERR_INVALID_PARAM;
  65         }
  66
  67         werr = registry_init_basic();
  68         if (!W_ERROR_IS_OK(werr)) {
  69                 return werr;
  70         }
  71
  72         tmp_ctx = TALLOC_ZERO_P(mem_ctx, struct gp_registry_context);
  73         W_ERROR_HAVE_NO_MEMORY(tmp_ctx);
  74
  75         if (token) {
  76                 tmp_ctx->token = token;
  77         } else {
  78                 tmp_ctx->token = registry_create_system_token(mem_ctx);
  79         }
  80         if (!tmp_ctx->token) {
  81                 TALLOC_FREE(tmp_ctx);
  82                 return WERR_NOMEM;
  83         }
  84
  85         werr = regdb_open();
  86         if (!W_ERROR_IS_OK(werr)) {
  87                 return werr;
  88         }
  89
  90         if (initial_path) {
  91                 tmp_ctx->path = talloc_strdup(mem_ctx, initial_path);
  92                 if (!tmp_ctx->path) {
  93                         TALLOC_FREE(tmp_ctx);
  94                         return WERR_NOMEM;
  95                 }
  96
  97                 werr = reg_open_path(mem_ctx, tmp_ctx->path, desired_access,
  98                                      tmp_ctx->token, &tmp_ctx->curr_key);
  99                 if (!W_ERROR_IS_OK(werr)) {
 100                         TALLOC_FREE(tmp_ctx);
 101                         return werr;
 102                 }
 103         }
 104
 105         *reg_ctx = tmp_ctx;
 106
 107         return WERR_OK;
 108 }
 109
 110 /****************************************************************
 111 ****************************************************************/
 112
 113 void gp_free_reg_ctx(struct gp_registry_context *reg_ctx)
 114 {
 115         TALLOC_FREE(reg_ctx);
 116 }
 117
 118 /****************************************************************
 119 ****************************************************************/
 120
 121 WERROR gp_store_reg_subkey(TALLOC_CTX *mem_ctx,
 122                            const char *subkeyname,
 123                            struct registry_key *curr_key,
 124                            struct registry_key **new_key)
 125 {
 126         enum winreg_CreateAction action = REG_ACTION_NONE;
 127         WERROR werr;
 128
 129         werr = reg_createkey(mem_ctx, curr_key, subkeyname,
 130                              REG_KEY_WRITE, new_key, &action);
 131         if (W_ERROR_IS_OK(werr) && (action != REG_CREATED_NEW_KEY)) {
 132                 return WERR_OK;
 133         }
 134
 135         return werr;
 136 }
 137
 138 /****************************************************************
 139 ****************************************************************/
 140
 141 WERROR gp_read_reg_subkey(TALLOC_CTX *mem_ctx,
 142                           struct gp_registry_context *reg_ctx,
 143                           const char *subkeyname,
 144                           struct registry_key **key)
 145 {
 146         const char *tmp = NULL;
 147
 148         if (!reg_ctx || !subkeyname || !key) {
 149                 return WERR_INVALID_PARAM;
 150         }
 151
 152         tmp = talloc_asprintf(mem_ctx, "%s\\%s", reg_ctx->path, subkeyname);
 153         W_ERROR_HAVE_NO_MEMORY(tmp);
 154
 155         return reg_open_path(mem_ctx, tmp, REG_KEY_READ,
 156                              reg_ctx->token, key);
 157 }
 158
 159 /****************************************************************
 160 ****************************************************************/
 161
 162 WERROR gp_store_reg_val_sz(TALLOC_CTX *mem_ctx,
 163                            struct registry_key *key,
 164                            const char *val_name,
 165                            const char *val)
 166 {
 167         struct registry_value reg_val;
 168
 169         reg_val.type = REG_SZ;
 170         if (!push_reg_sz(mem_ctx, &reg_val.data, val)) {
 171                 return WERR_NOMEM;
 172         }
 173
 174         return reg_setvalue(key, val_name, &reg_val);
 175 }
 176
 177 /****************************************************************
 178 ****************************************************************/
 179
 180 static WERROR gp_store_reg_val_dword(TALLOC_CTX *mem_ctx,
 181                                      struct registry_key *key,
 182                                      const char *val_name,
 183                                      uint32_t val)
 184 {
 185         struct registry_value reg_val;
 186
 187         reg_val.type = REG_DWORD;
 188         reg_val.data = data_blob_talloc(mem_ctx, NULL, 4);
 189         SIVAL(reg_val.data.data, 0, val);
 190
 191         return reg_setvalue(key, val_name, &reg_val);
 192 }
 193
 194 /****************************************************************
 195 ****************************************************************/
 196
 197 WERROR gp_read_reg_val_sz(TALLOC_CTX *mem_ctx,
 198                           struct registry_key *key,
 199                           const char *val_name,
 200                           const char **val)
 201 {
 202         WERROR werr;
 203         struct registry_value *reg_val = NULL;
 204
 205         werr = reg_queryvalue(mem_ctx, key, val_name, &reg_val);
 206         W_ERROR_NOT_OK_RETURN(werr);
 207
 208         if (reg_val->type != REG_SZ) {
 209                 return WERR_INVALID_DATATYPE;
 210         }
 211
 212         if (!pull_reg_sz(mem_ctx, &reg_val->data, val)) {
 213                 return WERR_NOMEM;
 214         }
 215
 216         return WERR_OK;
 217 }
 218
 219 /****************************************************************
 220 ****************************************************************/
 221
 222 static WERROR gp_read_reg_val_dword(TALLOC_CTX *mem_ctx,
 223                                     struct registry_key *key,
 224                                     const char *val_name,
 225                                     uint32_t *val)
 226 {
 227         WERROR werr;
 228         struct registry_value *reg_val = NULL;
 229
 230         werr = reg_queryvalue(mem_ctx, key, val_name, &reg_val);
 231         W_ERROR_NOT_OK_RETURN(werr);
 232
 233         if (reg_val->type != REG_DWORD) {
 234                 return WERR_INVALID_DATATYPE;
 235         }
 236
 237         if (reg_val->data.length < 4) {
 238                 return WERR_INSUFFICIENT_BUFFER;
 239         }
 240         *val = IVAL(reg_val->data.data, 0);
 241
 242         return WERR_OK;
 243 }
 244
 245 /****************************************************************
 246 ****************************************************************/
 247
 248 static WERROR gp_store_reg_gpovals(TALLOC_CTX *mem_ctx,
 249                                    struct registry_key *key,
 250                                    struct GROUP_POLICY_OBJECT *gpo)
 251 {
 252         WERROR werr;
 253
 254         if (!key || !gpo) {
 255                 return WERR_INVALID_PARAM;
 256         }
 257
 258         werr = gp_store_reg_val_dword(mem_ctx, key, "Version",
 259                                       gpo->version);
 260         W_ERROR_NOT_OK_RETURN(werr);
 261
 262         werr = gp_store_reg_val_dword(mem_ctx, key, "WQLFilterPass",
 263                                       true); /* fake */
 264         W_ERROR_NOT_OK_RETURN(werr);
 265
 266         werr = gp_store_reg_val_dword(mem_ctx, key, "AccessDenied",
 267                                       false); /* fake */
 268         W_ERROR_NOT_OK_RETURN(werr);
 269
 270         werr = gp_store_reg_val_dword(mem_ctx, key, "GPO-Disabled",
 271                                       (gpo->options & GPO_FLAG_DISABLE));
 272         W_ERROR_NOT_OK_RETURN(werr);
 273
 274         werr = gp_store_reg_val_dword(mem_ctx, key, "Options",
 275                                       gpo->options);
 276         W_ERROR_NOT_OK_RETURN(werr);
 277
 278         werr = gp_store_reg_val_sz(mem_ctx, key, "GPOID",
 279                                    gpo->name);
 280         W_ERROR_NOT_OK_RETURN(werr);
 281
 282         werr = gp_store_reg_val_sz(mem_ctx, key, "SOM",
 283                                    gpo->link);
 284         W_ERROR_NOT_OK_RETURN(werr);
 285
 286         werr = gp_store_reg_val_sz(mem_ctx, key, "DisplayName",
 287                                    gpo->display_name);
 288         W_ERROR_NOT_OK_RETURN(werr);
 289
 290         werr = gp_store_reg_val_sz(mem_ctx, key, "WQL-Id",
 291                                    NULL);
 292         W_ERROR_NOT_OK_RETURN(werr);
 293
 294         return werr;
 295 }
 296
 297 /****************************************************************
 298 ****************************************************************/
 299
 300 static const char *gp_reg_groupmembership_path(TALLOC_CTX *mem_ctx,
 301                                                const struct dom_sid *sid,
 302                                                uint32_t flags)
 303 {
 304         if (flags & GPO_LIST_FLAG_MACHINE) {
 305                 return "GroupMembership";
 306         }
 307
 308         return talloc_asprintf(mem_ctx, "%s\\%s", sid_string_tos(sid),
 309                                "GroupMembership");
 310 }
 311
 312 /****************************************************************
 313 ****************************************************************/
 314
 315 static WERROR gp_reg_del_groupmembership(TALLOC_CTX *mem_ctx,
 316                                          struct registry_key *key,
 317                                          const struct nt_user_token *token,
 318                                          uint32_t flags)
 319 {
 320         const char *path = NULL;
 321
 322         path = gp_reg_groupmembership_path(mem_ctx, &token->sids[0],
 323                                            flags);
 324         W_ERROR_HAVE_NO_MEMORY(path);
 325
 326         return reg_deletekey_recursive(mem_ctx, key, path);
 327
 328 }
 329
 330 /****************************************************************
 331 ****************************************************************/
 332
 333 static WERROR gp_reg_store_groupmembership(TALLOC_CTX *mem_ctx,
 334                                            struct gp_registry_context *reg_ctx,
 335                                            const struct nt_user_token *token,
 336                                            uint32_t flags)
 337 {
 338         struct registry_key *key = NULL;
 339         WERROR werr;
 340         int i = 0;
 341         const char *valname = NULL;
 342         const char *path = NULL;
 343         const char *val = NULL;
 344         int count = 0;
 345
 346         path = gp_reg_groupmembership_path(mem_ctx, &token->sids[0],
 347                                            flags);
 348         W_ERROR_HAVE_NO_MEMORY(path);
 349
 350         gp_reg_del_groupmembership(mem_ctx, reg_ctx->curr_key, token, flags);
 351
 352         werr = gp_store_reg_subkey(mem_ctx, path,
 353                                    reg_ctx->curr_key, &key);
 354         W_ERROR_NOT_OK_RETURN(werr);
 355
 356         for (i=0; i<token->num_sids; i++) {
 357
 358                 valname = talloc_asprintf(mem_ctx, "Group%d", count++);
 359                 W_ERROR_HAVE_NO_MEMORY(valname);
 360
 361                 val = sid_string_talloc(mem_ctx, &token->sids[i]);
 362                 W_ERROR_HAVE_NO_MEMORY(val);
 363                 werr = gp_store_reg_val_sz(mem_ctx, key, valname, val);
 364                 W_ERROR_NOT_OK_RETURN(werr);
 365         }
 366
 367         werr = gp_store_reg_val_dword(mem_ctx, key, "Count", count);
 368         W_ERROR_NOT_OK_RETURN(werr);
 369
 370         return WERR_OK;
 371 }
 372
 373 /****************************************************************
 374 ****************************************************************/
 375 #if 0
 376 /* not used yet */
 377 static WERROR gp_reg_read_groupmembership(TALLOC_CTX *mem_ctx,
 378                                           struct gp_registry_context *reg_ctx,
 379                                           const struct dom_sid *object_sid,
 380                                           struct nt_user_token **token,
 381                                           uint32_t flags)
 382 {
 383         struct registry_key *key = NULL;
 384         WERROR werr;
 385         int i = 0;
 386         const char *valname = NULL;
 387         const char *val = NULL;
 388         const char *path = NULL;
 389         uint32_t count = 0;
 390         int num_token_sids = 0;
 391         struct nt_user_token *tmp_token = NULL;
 392
 393         tmp_token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token);
 394         W_ERROR_HAVE_NO_MEMORY(tmp_token);
 395
 396         path = gp_reg_groupmembership_path(mem_ctx, object_sid, flags);
 397         W_ERROR_HAVE_NO_MEMORY(path);
 398
 399         werr = gp_read_reg_subkey(mem_ctx, reg_ctx, path, &key);
 400         W_ERROR_NOT_OK_RETURN(werr);
 401
 402         werr = gp_read_reg_val_dword(mem_ctx, key, "Count", &count);
 403         W_ERROR_NOT_OK_RETURN(werr);
 404
 405         for (i=0; i<count; i++) {
 406
 407                 valname = talloc_asprintf(mem_ctx, "Group%d", i);
 408                 W_ERROR_HAVE_NO_MEMORY(valname);
 409
 410                 werr = gp_read_reg_val_sz(mem_ctx, key, valname, &val);
 411                 W_ERROR_NOT_OK_RETURN(werr);
 412
 413                 if (!string_to_sid(&tmp_token->sids[num_token_sids++],
 414                                    val)) {
 415                         return WERR_INSUFFICIENT_BUFFER;
 416                 }
 417         }
 418
 419         tmp_token->num_sids = num_token_sids;
 420
 421         *token = tmp_token;
 422
 423         return WERR_OK;
 424 }
 425 #endif
 426 /****************************************************************
 427 ****************************************************************/
 428
 429 static const char *gp_req_state_path(TALLOC_CTX *mem_ctx,
 430                                      const struct dom_sid *sid,
 431                                      uint32_t flags)
 432 {
 433         if (flags & GPO_LIST_FLAG_MACHINE) {
 434                 return GPO_REG_STATE_MACHINE;
 435         }
 436
 437         return talloc_asprintf(mem_ctx, "%s\\%s", "State", sid_string_tos(sid));
 438 }
 439
 440 /****************************************************************
 441 ****************************************************************/
 442
 443 static WERROR gp_del_reg_state(TALLOC_CTX *mem_ctx,
 444                                struct registry_key *key,
 445                                const char *path)
 446 {
 447         return reg_deletesubkeys_recursive(mem_ctx, key, path);
 448 }
 449
 450 /****************************************************************
 451 ****************************************************************/
 452
 453 WERROR gp_reg_state_store(TALLOC_CTX *mem_ctx,
 454                           uint32_t flags,
 455                           const char *dn,
 456                           const struct nt_user_token *token,
 457                           struct GROUP_POLICY_OBJECT *gpo_list)
 458 {
 459         struct gp_registry_context *reg_ctx = NULL;
 460         WERROR werr = WERR_GENERAL_FAILURE;
 461         const char *subkeyname = NULL;
 462         struct GROUP_POLICY_OBJECT *gpo;
 463         int count = 0;
 464         struct registry_key *key;
 465
 466         werr = gp_init_reg_ctx(mem_ctx, KEY_GROUP_POLICY, REG_KEY_WRITE,
 467                                token, &reg_ctx);
 468         W_ERROR_NOT_OK_RETURN(werr);
 469
 470         werr = gp_secure_key(mem_ctx, flags, reg_ctx->curr_key,
 471                              &token->sids[0]);
 472         if (!W_ERROR_IS_OK(werr)) {
 473                 DEBUG(0,("failed to secure key: %s\n", win_errstr(werr)));
 474                 goto done;
 475         }
 476
 477         werr = gp_reg_store_groupmembership(mem_ctx, reg_ctx, token, flags);
 478         if (!W_ERROR_IS_OK(werr)) {
 479                 DEBUG(0,("failed to store group membership: %s\n", win_errstr(werr)));
 480                 goto done;
 481         }
 482
 483         subkeyname = gp_req_state_path(mem_ctx, &token->sids[0], flags);
 484         if (!subkeyname) {
 485                 werr = WERR_NOMEM;
 486                 goto done;
 487         }
 488
 489         werr = gp_del_reg_state(mem_ctx, reg_ctx->curr_key, subkeyname);
 490         if (!W_ERROR_IS_OK(werr)) {
 491                 DEBUG(0,("failed to delete old state: %s\n", win_errstr(werr)));
 492                 /* goto done; */
 493         }
 494
 495         werr = gp_store_reg_subkey(mem_ctx, subkeyname,
 496                                    reg_ctx->curr_key, &reg_ctx->curr_key);
 497         if (!W_ERROR_IS_OK(werr)) {
 498                 goto done;
 499         }
 500
 501         werr = gp_store_reg_val_sz(mem_ctx, reg_ctx->curr_key,
 502                                    "Distinguished-Name", dn);
 503         if (!W_ERROR_IS_OK(werr)) {
 504                 goto done;
 505         }
 506
 507         /* store link list */
 508
 509         werr = gp_store_reg_subkey(mem_ctx, "GPLink-List",
 510                                    reg_ctx->curr_key, &key);
 511         if (!W_ERROR_IS_OK(werr)) {
 512                 goto done;
 513         }
 514
 515         /* store gpo list */
 516
 517         werr = gp_store_reg_subkey(mem_ctx, "GPO-List",
 518                                    reg_ctx->curr_key, &reg_ctx->curr_key);
 519         if (!W_ERROR_IS_OK(werr)) {
 520                 goto done;
 521         }
 522
 523         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 524
 525                 subkeyname = talloc_asprintf(mem_ctx, "%d", count++);
 526                 if (!subkeyname) {
 527                         werr = WERR_NOMEM;
 528                         goto done;
 529                 }
 530
 531                 werr = gp_store_reg_subkey(mem_ctx, subkeyname,
 532                                            reg_ctx->curr_key, &key);
 533                 if (!W_ERROR_IS_OK(werr)) {
 534                         goto done;
 535                 }
 536
 537                 werr = gp_store_reg_gpovals(mem_ctx, key, gpo);
 538                 if (!W_ERROR_IS_OK(werr)) {
 539                         DEBUG(0,("gp_reg_state_store: "
 540                                 "gpo_store_reg_gpovals failed for %s: %s\n",
 541                                 gpo->display_name, win_errstr(werr)));
 542                         goto done;
 543                 }
 544         }
 545  done:
 546         gp_free_reg_ctx(reg_ctx);
 547         return werr;
 548 }
 549
 550 /****************************************************************
 551 ****************************************************************/
 552
 553 static WERROR gp_read_reg_gpovals(TALLOC_CTX *mem_ctx,
 554                                   struct registry_key *key,
 555                                   struct GROUP_POLICY_OBJECT *gpo)
 556 {
 557         WERROR werr;
 558
 559         if (!key || !gpo) {
 560                 return WERR_INVALID_PARAM;
 561         }
 562
 563         werr = gp_read_reg_val_dword(mem_ctx, key, "Version",
 564                                      &gpo->version);
 565         W_ERROR_NOT_OK_RETURN(werr);
 566
 567         werr = gp_read_reg_val_dword(mem_ctx, key, "Options",
 568                                      &gpo->options);
 569         W_ERROR_NOT_OK_RETURN(werr);
 570
 571         werr = gp_read_reg_val_sz(mem_ctx, key, "GPOID",
 572                                   &gpo->name);
 573         W_ERROR_NOT_OK_RETURN(werr);
 574
 575         werr = gp_read_reg_val_sz(mem_ctx, key, "SOM",
 576                                   &gpo->link);
 577         W_ERROR_NOT_OK_RETURN(werr);
 578
 579         werr = gp_read_reg_val_sz(mem_ctx, key, "DisplayName",
 580                                   &gpo->display_name);
 581         W_ERROR_NOT_OK_RETURN(werr);
 582
 583         return werr;
 584 }
 585
 586 /****************************************************************
 587 ****************************************************************/
 588
 589 static WERROR gp_read_reg_gpo(TALLOC_CTX *mem_ctx,
 590                               struct registry_key *key,
 591                               struct GROUP_POLICY_OBJECT **gpo_ret)
 592 {
 593         struct GROUP_POLICY_OBJECT *gpo = NULL;
 594         WERROR werr;
 595
 596         if (!gpo_ret || !key) {
 597                 return WERR_INVALID_PARAM;
 598         }
 599
 600         gpo = TALLOC_ZERO_P(mem_ctx, struct GROUP_POLICY_OBJECT);
 601         W_ERROR_HAVE_NO_MEMORY(gpo);
 602
 603         werr = gp_read_reg_gpovals(mem_ctx, key, gpo);
 604         W_ERROR_NOT_OK_RETURN(werr);
 605
 606         *gpo_ret = gpo;
 607
 608         return werr;
 609 }
 610
 611 /****************************************************************
 612 ****************************************************************/
 613
 614 WERROR gp_reg_state_read(TALLOC_CTX *mem_ctx,
 615                          uint32_t flags,
 616                          const struct dom_sid *sid,
 617                          struct GROUP_POLICY_OBJECT **gpo_list)
 618 {
 619         struct gp_registry_context *reg_ctx = NULL;
 620         WERROR werr = WERR_GENERAL_FAILURE;
 621         const char *subkeyname = NULL;
 622         struct GROUP_POLICY_OBJECT *gpo = NULL;
 623         int count = 0;
 624         struct registry_key *key = NULL;
 625         const char *path = NULL;
 626         const char *gp_state_path = NULL;
 627
 628         if (!gpo_list) {
 629                 return WERR_INVALID_PARAM;
 630         }
 631
 632         ZERO_STRUCTP(gpo_list);
 633
 634         gp_state_path = gp_req_state_path(mem_ctx, sid, flags);
 635         if (!gp_state_path) {
 636                 werr = WERR_NOMEM;
 637                 goto done;
 638         }
 639
 640         path = talloc_asprintf(mem_ctx, "%s\\%s\\%s",
 641                                KEY_GROUP_POLICY,
 642                                gp_state_path,
 643                                "GPO-List");
 644         if (!path) {
 645                 werr = WERR_NOMEM;
 646                 goto done;
 647         }
 648
 649         werr = gp_init_reg_ctx(mem_ctx, path, REG_KEY_READ, NULL, &reg_ctx);
 650         if (!W_ERROR_IS_OK(werr)) {
 651                 goto done;
 652         }
 653
 654         while (1) {
 655
 656                 subkeyname = talloc_asprintf(mem_ctx, "%d", count++);
 657                 if (!subkeyname) {
 658                         werr = WERR_NOMEM;
 659                         goto done;
 660                 }
 661
 662                 werr = gp_read_reg_subkey(mem_ctx, reg_ctx, subkeyname, &key);
 663                 if (W_ERROR_EQUAL(werr, WERR_BADFILE)) {
 664                         werr = WERR_OK;
 665                         break;
 666                 }
 667                 if (!W_ERROR_IS_OK(werr)) {
 668                         DEBUG(0,("gp_reg_state_read: "
 669                                 "gp_read_reg_subkey gave: %s\n",
 670                                 win_errstr(werr)));
 671                         goto done;
 672                 }
 673
 674                 werr = gp_read_reg_gpo(mem_ctx, key, &gpo);
 675                 if (!W_ERROR_IS_OK(werr)) {
 676                         goto done;
 677                 }
 678
 679                 DLIST_ADD(*gpo_list, gpo);
 680         }
 681
 682  done:
 683         gp_free_reg_ctx(reg_ctx);
 684         return werr;
 685 }
 686
 687 /****************************************************************
 688 ****************************************************************/
 689
 690 static WERROR gp_reg_generate_sd(TALLOC_CTX *mem_ctx,
 691                                  const struct dom_sid *sid,
 692                                  struct security_descriptor **sd,
 693                                  size_t *sd_size)
 694 {
 695         struct security_ace ace[6];
 696         uint32_t mask;
 697
 698         struct security_acl *theacl = NULL;
 699
 700         uint8_t inherit_flags;
 701
 702         mask = REG_KEY_ALL;
 703         init_sec_ace(&ace[0],
 704                      &global_sid_System,
 705                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 706                      mask, 0);
 707
 708         mask = REG_KEY_ALL;
 709         init_sec_ace(&ace[1],
 710                      &global_sid_Builtin_Administrators,
 711                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 712                      mask, 0);
 713
 714         mask = REG_KEY_READ;
 715         init_sec_ace(&ace[2],
 716                      sid ? sid : &global_sid_Authenticated_Users,
 717                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 718                      mask, 0);
 719
 720         inherit_flags = SEC_ACE_FLAG_OBJECT_INHERIT |
 721                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 722                         SEC_ACE_FLAG_INHERIT_ONLY;
 723
 724         mask = REG_KEY_ALL;
 725         init_sec_ace(&ace[3],
 726                      &global_sid_System,
 727                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 728                      mask, inherit_flags);
 729
 730         mask = REG_KEY_ALL;
 731         init_sec_ace(&ace[4],
 732                      &global_sid_Builtin_Administrators,
 733                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 734                      mask, inherit_flags);
 735
 736         mask = REG_KEY_READ;
 737         init_sec_ace(&ace[5],
 738                      sid ? sid : &global_sid_Authenticated_Users,
 739                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 740                      mask, inherit_flags);
 741
 742         theacl = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 6, ace);
 743         W_ERROR_HAVE_NO_MEMORY(theacl);
 744
 745         *sd = make_sec_desc(mem_ctx, SD_REVISION,
 746                             SEC_DESC_SELF_RELATIVE |
 747                             SEC_DESC_DACL_AUTO_INHERITED | /* really ? */
 748                             SEC_DESC_DACL_AUTO_INHERIT_REQ, /* really ? */
 749                             NULL, NULL, NULL,
 750                             theacl, sd_size);
 751         W_ERROR_HAVE_NO_MEMORY(*sd);
 752
 753         return WERR_OK;
 754 }
 755
 756 /****************************************************************
 757 ****************************************************************/
 758
 759 WERROR gp_secure_key(TALLOC_CTX *mem_ctx,
 760                      uint32_t flags,
 761                      struct registry_key *key,
 762                      const struct dom_sid *sid)
 763 {
 764         struct security_descriptor *sd = NULL;
 765         size_t sd_size = 0;
 766         const struct dom_sid *sd_sid = NULL;
 767         WERROR werr;
 768
 769         if (!(flags & GPO_LIST_FLAG_MACHINE)) {
 770                 sd_sid = sid;
 771         }
 772
 773         werr = gp_reg_generate_sd(mem_ctx, sd_sid, &sd, &sd_size);
 774         W_ERROR_NOT_OK_RETURN(werr);
 775
 776         return reg_setkeysecurity(key, sd);
 777 }
 778
 779 /****************************************************************
 780 ****************************************************************/
 781
 782 void dump_reg_val(int lvl, const char *direction,
 783                   const char *key, const char *subkey,
 784                   struct registry_value *val)
 785 {
 786         int i = 0;
 787         const char *type_str = NULL;
 788
 789         if (!val) {
 790                 DEBUG(lvl,("no val!\n"));
 791                 return;
 792         }
 793
 794         type_str = str_regtype(val->type);
 795
 796         DEBUG(lvl,("\tdump_reg_val:\t%s '%s'\n\t\t\t'%s' %s: ",
 797                 direction, key, subkey, type_str));
 798
 799         switch (val->type) {
 800                 case REG_DWORD: {
 801                         uint32_t v;
 802                         if (val->data.length < 4) {
 803                                 break;
 804                         }
 805                         v = IVAL(val->data.data, 0);
 806                         DEBUG(lvl,("%d (0x%08x)\n",
 807                                 (int)v, v));
 808                         break;
 809                 }
 810                 case REG_QWORD: {
 811                         uint64_t v;
 812                         if (val->data.length < 8) {
 813                                 break;
 814                         }
 815                         v = BVAL(val->data.data, 0);
 816                         DEBUG(lvl,("%d (0x%016llx)\n",
 817                                 (int)v,
 818                                 (unsigned long long)v));
 819                         break;
 820                 }
 821                 case REG_SZ: {
 822                         const char *s;
 823                         if (!pull_reg_sz(talloc_tos(), &val->data, &s)) {
 824                                 break;
 825                         }
 826                         DEBUG(lvl,("%s (length: %d)\n",
 827                                    s, (int)strlen_m(s)));
 828                         break;
 829                 }
 830                 case REG_MULTI_SZ: {
 831                         const char **a;
 832                         if (!pull_reg_multi_sz(talloc_tos(), &val->data, &a)) {
 833                                 break;
 834                         }
 835                         for (i=0; a[i] != NULL; i++) {
 836                                 ;;
 837                         }
 838                         DEBUG(lvl,("(num_strings: %d)\n", i));
 839                         for (i=0; a[i] != NULL; i++) {
 840                                 DEBUGADD(lvl,("\t%s\n", a[i]));
 841                         }
 842                         break;
 843                 }
 844                 case REG_NONE:
 845                         DEBUG(lvl,("\n"));
 846                         break;
 847                 case REG_BINARY:
 848                         dump_data(lvl, val->data.data,
 849                                   val->data.length);
 850                         break;
 851                 default:
 852                         DEBUG(lvl,("unsupported type: %d\n", val->type));
 853                         break;
 854         }
 855 }
 856
 857 /****************************************************************
 858 ****************************************************************/
 859
 860 void dump_reg_entry(uint32_t flags,
 861                     const char *dir,
 862                     struct gp_registry_entry *entry)
 863 {
 864         if (!(flags & GPO_INFO_FLAG_VERBOSE))
 865                 return;
 866
 867         dump_reg_val(1, dir,
 868                      entry->key,
 869                      entry->value,
 870                      entry->data);
 871 }
 872
 873 /****************************************************************
 874 ****************************************************************/
 875
 876 void dump_reg_entries(uint32_t flags,
 877                       const char *dir,
 878                       struct gp_registry_entry *entries,
 879                       size_t num_entries)
 880 {
 881         size_t i;
 882
 883         if (!(flags & GPO_INFO_FLAG_VERBOSE))
 884                 return;
 885
 886         for (i=0; i < num_entries; i++) {
 887                 dump_reg_entry(flags, dir, &entries[i]);
 888         }
 889 }
 890
 891 /****************************************************************
 892 ****************************************************************/
 893
 894 bool add_gp_registry_entry_to_array(TALLOC_CTX *mem_ctx,
 895                                     struct gp_registry_entry *entry,
 896                                     struct gp_registry_entry **entries,
 897                                     size_t *num)
 898 {
 899         *entries = TALLOC_REALLOC_ARRAY(mem_ctx, *entries,
 900                                         struct gp_registry_entry,
 901                                         (*num)+1);
 902
 903         if (*entries == NULL) {
 904                 *num = 0;
 905                 return false;
 906         }
 907
 908         (*entries)[*num].action = entry->action;
 909         (*entries)[*num].key = entry->key;
 910         (*entries)[*num].value = entry->value;
 911         (*entries)[*num].data = entry->data;
 912
 913         *num += 1;
 914         return true;
 915 }
 916
 917 /****************************************************************
 918 ****************************************************************/
 919
 920 static const char *gp_reg_action_str(enum gp_reg_action action)
 921 {
 922         switch (action) {
 923                 case GP_REG_ACTION_NONE:
 924                         return "GP_REG_ACTION_NONE";
 925                 case GP_REG_ACTION_ADD_VALUE:
 926                         return "GP_REG_ACTION_ADD_VALUE";
 927                 case GP_REG_ACTION_ADD_KEY:
 928                         return "GP_REG_ACTION_ADD_KEY";
 929                 case GP_REG_ACTION_DEL_VALUES:
 930                         return "GP_REG_ACTION_DEL_VALUES";
 931                 case GP_REG_ACTION_DEL_VALUE:
 932                         return "GP_REG_ACTION_DEL_VALUE";
 933                 case GP_REG_ACTION_DEL_ALL_VALUES:
 934                         return "GP_REG_ACTION_DEL_ALL_VALUES";
 935                 case GP_REG_ACTION_DEL_KEYS:
 936                         return "GP_REG_ACTION_DEL_KEYS";
 937                 case GP_REG_ACTION_SEC_KEY_SET:
 938                         return "GP_REG_ACTION_SEC_KEY_SET";
 939                 case GP_REG_ACTION_SEC_KEY_RESET:
 940                         return "GP_REG_ACTION_SEC_KEY_RESET";
 941                 default:
 942                         return "unknown";
 943         }
 944 }
 945
 946 /****************************************************************
 947 ****************************************************************/
 948
 949 WERROR reg_apply_registry_entry(TALLOC_CTX *mem_ctx,
 950                                 struct registry_key *root_key,
 951                                 struct gp_registry_context *reg_ctx,
 952                                 struct gp_registry_entry *entry,
 953                                 const struct nt_user_token *token,
 954                                 uint32_t flags)
 955 {
 956         WERROR werr;
 957         struct registry_key *key = NULL;
 958
 959         if (flags & GPO_INFO_FLAG_VERBOSE) {
 960                 printf("about to store key:    [%s]\n", entry->key);
 961                 printf("               value:  [%s]\n", entry->value);
 962                 printf("               data:   [%s]\n", str_regtype(entry->data->type));
 963                 printf("               action: [%s]\n", gp_reg_action_str(entry->action));
 964         }
 965
 966         werr = gp_store_reg_subkey(mem_ctx, entry->key,
 967                                    root_key, &key);
 968                                    /* reg_ctx->curr_key, &key); */
 969         if (!W_ERROR_IS_OK(werr)) {
 970                 DEBUG(0,("gp_store_reg_subkey failed: %s\n", win_errstr(werr)));
 971                 return werr;
 972         }
 973
 974         switch (entry->action) {
 975                 case GP_REG_ACTION_NONE:
 976                 case GP_REG_ACTION_ADD_KEY:
 977                         return WERR_OK;
 978
 979                 case GP_REG_ACTION_SEC_KEY_SET:
 980                         werr = gp_secure_key(mem_ctx, flags,
 981                                              key,
 982                                              &token->sids[0]);
 983                         if (!W_ERROR_IS_OK(werr)) {
 984                                 DEBUG(0,("reg_apply_registry_entry: "
 985                                         "gp_secure_key failed: %s\n",
 986                                         win_errstr(werr)));
 987                                 return werr;
 988                         }
 989                         break;
 990                 case GP_REG_ACTION_ADD_VALUE:
 991                         werr = reg_setvalue(key, entry->value, entry->data);
 992                         if (!W_ERROR_IS_OK(werr)) {
 993                                 DEBUG(0,("reg_apply_registry_entry: "
 994                                         "reg_setvalue failed: %s\n",
 995                                         win_errstr(werr)));
 996                                 dump_reg_entry(flags, "STORE", entry);
 997                                 return werr;
 998                         }
 999                         break;
1000                 case GP_REG_ACTION_DEL_VALUE:
1001                         werr = reg_deletevalue(key, entry->value);
1002                         if (!W_ERROR_IS_OK(werr)) {
1003                                 DEBUG(0,("reg_apply_registry_entry: "
1004                                         "reg_deletevalue failed: %s\n",
1005                                         win_errstr(werr)));
1006                                 dump_reg_entry(flags, "STORE", entry);
1007                                 return werr;
1008                         }
1009                         break;
1010                 case GP_REG_ACTION_DEL_ALL_VALUES:
1011                         werr = reg_deleteallvalues(key);
1012                         if (!W_ERROR_IS_OK(werr)) {
1013                                 DEBUG(0,("reg_apply_registry_entry: "
1014                                         "reg_deleteallvalues failed: %s\n",
1015                                         win_errstr(werr)));
1016                                 dump_reg_entry(flags, "STORE", entry);
1017                                 return werr;
1018                         }
1019                         break;
1020                 case GP_REG_ACTION_DEL_VALUES:
1021                 case GP_REG_ACTION_DEL_KEYS:
1022                 case GP_REG_ACTION_SEC_KEY_RESET:
1023                         DEBUG(0,("reg_apply_registry_entry: "
1024                                 "not yet supported: %s (%d)\n",
1025                                 gp_reg_action_str(entry->action),
1026                                 entry->action));
1027                         return WERR_NOT_SUPPORTED;
1028                 default:
1029                         DEBUG(0,("invalid action: %d\n", entry->action));
1030                         return WERR_INVALID_PARAM;
1031         }
1032
1033         return werr;
1034 }
1035