libgpo/gpo_sec.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2007
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "librpc/gen_ndr/security.h"
  22 #include "librpc/gen_ndr/ndr_misc.h"
  23 #include "../libgpo/gpo.h"
  24
  25 /****************************************************************
  26 ****************************************************************/
  27
  28 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
  29 {
  30         struct GUID ext_right_apg_guid;
  31         NTSTATUS status;
  32
  33         if (!object) {
  34                 return false;
  35         }
  36
  37         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
  38                                   &ext_right_apg_guid);
  39         if (!NT_STATUS_IS_OK(status)) {
  40                 return false;
  41         }
  42
  43         switch (object->flags) {
  44                 case SEC_ACE_OBJECT_TYPE_PRESENT:
  45                         if (GUID_equal(&object->type.type,
  46                                        &ext_right_apg_guid)) {
  47                                 return true;
  48                         }
  49                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
  50                         if (GUID_equal(&object->inherited_type.inherited_type,
  51                                        &ext_right_apg_guid)) {
  52                                 return true;
  53                         }
  54                 default:
  55                         break;
  56         }
  57
  58         return false;
  59 }
  60
  61 /****************************************************************
  62 ****************************************************************/
  63
  64 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
  65 {
  66         if (!sec_ace_object(ace->type)) {
  67                 return false;
  68         }
  69
  70         return gpo_sd_check_agp_object_guid(&ace->object.object);
  71 }
  72
  73 /****************************************************************
  74 ****************************************************************/
  75
  76 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
  77 {
  78         return (access_mask & SEC_RIGHTS_EXTENDED);
  79 }
  80
  81 #if 0
  82 /****************************************************************
  83 ****************************************************************/
  84
  85 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
  86 {
  87         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
  88                            SEC_RIGHTS_READ_ALL_PROP |
  89                            SEC_RIGHTS_READ_PERMS;
  90
  91         return (read_bits == (access_mask & read_bits));
  92 }
  93 #endif
  94
  95 /****************************************************************
  96 ****************************************************************/
  97
  98 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
  99                                                const struct nt_user_token *token)
 100 {
 101         if (gpo_sd_check_agp_object(ace) &&
 102             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 103             nt_token_check_sid(&ace->trustee, token)) {
 104                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
 105                         "Access denied as of ace for %s\n",
 106                         sid_string_dbg(&ace->trustee)));
 107                 return NT_STATUS_ACCESS_DENIED;
 108         }
 109
 110         return STATUS_MORE_ENTRIES;
 111 }
 112
 113 /****************************************************************
 114 ****************************************************************/
 115
 116 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
 117                                                 const struct nt_user_token *token)
 118 {
 119         if (gpo_sd_check_agp_object(ace) &&
 120             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 121             nt_token_check_sid(&ace->trustee, token)) {
 122                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
 123                         "Access granted as of ace for %s\n",
 124                         sid_string_dbg(&ace->trustee)));
 125                 return NT_STATUS_OK;
 126         }
 127
 128         return STATUS_MORE_ENTRIES;
 129 }
 130
 131 /****************************************************************
 132 ****************************************************************/
 133
 134 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
 135                                  const struct nt_user_token *token)
 136 {
 137         switch (ace->type) {
 138                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 139                         return gpo_sd_check_ace_denied_object(ace, token);
 140                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 141                         return gpo_sd_check_ace_allowed_object(ace, token);
 142                 default:
 143                         return STATUS_MORE_ENTRIES;
 144         }
 145 }
 146
 147 /****************************************************************
 148 ****************************************************************/
 149
 150 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
 151                                       const struct nt_user_token *token)
 152 {
 153         struct security_descriptor *sd = gpo->security_descriptor;
 154         struct security_acl *dacl = NULL;
 155         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 156         int i;
 157
 158         if (!token) {
 159                 return NT_STATUS_INVALID_USER_BUFFER;
 160         }
 161
 162         if (!sd) {
 163                 return NT_STATUS_INVALID_SECURITY_DESCR;
 164         }
 165
 166         dacl = sd->dacl;
 167         if (!dacl) {
 168                 return NT_STATUS_INVALID_SECURITY_DESCR;
 169         }
 170
 171         /* check all aces and only return NT_STATUS_OK (== Access granted) or
 172          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
 173          * deny access */
 174
 175         for (i = 0; i < dacl->num_aces; i ++) {
 176
 177                 status = gpo_sd_check_ace(&dacl->aces[i], token);
 178
 179                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 180                         return status;
 181                 } else if (NT_STATUS_IS_OK(status)) {
 182                         return status;
 183                 }
 184
 185                 continue;
 186         }
 187
 188         return NT_STATUS_ACCESS_DENIED;
 189 }