2 * Unix SMB/CIFS implementation.
3 * Group Policy Object Support
4 * Copyright (C) Guenther Deschner 2007
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "librpc/gen_ndr/security.h"
22 #include "librpc/gen_ndr/ndr_misc.h"
23 #include "../libgpo/gpo.h"
25 /****************************************************************
26 ****************************************************************/
28 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
30 struct GUID ext_right_apg_guid;
37 status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
39 if (!NT_STATUS_IS_OK(status)) {
43 switch (object->flags) {
44 case SEC_ACE_OBJECT_TYPE_PRESENT:
45 if (GUID_equal(&object->type.type,
46 &ext_right_apg_guid)) {
49 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
50 if (GUID_equal(&object->inherited_type.inherited_type,
51 &ext_right_apg_guid)) {
61 /****************************************************************
62 ****************************************************************/
64 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
66 if (!sec_ace_object(ace->type)) {
70 return gpo_sd_check_agp_object_guid(&ace->object.object);
73 /****************************************************************
74 ****************************************************************/
76 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
78 return (access_mask & SEC_RIGHTS_EXTENDED);
82 /****************************************************************
83 ****************************************************************/
85 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
87 uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
88 SEC_RIGHTS_READ_ALL_PROP |
89 SEC_RIGHTS_READ_PERMS;
91 return (read_bits == (access_mask & read_bits));
95 /****************************************************************
96 ****************************************************************/
98 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
99 const struct nt_user_token *token)
101 if (gpo_sd_check_agp_object(ace) &&
102 gpo_sd_check_agp_access_bits(ace->access_mask) &&
103 nt_token_check_sid(&ace->trustee, token)) {
104 DEBUG(10,("gpo_sd_check_ace_denied_object: "
105 "Access denied as of ace for %s\n",
106 sid_string_dbg(&ace->trustee)));
107 return NT_STATUS_ACCESS_DENIED;
110 return STATUS_MORE_ENTRIES;
113 /****************************************************************
114 ****************************************************************/
116 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
117 const struct nt_user_token *token)
119 if (gpo_sd_check_agp_object(ace) &&
120 gpo_sd_check_agp_access_bits(ace->access_mask) &&
121 nt_token_check_sid(&ace->trustee, token)) {
122 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
123 "Access granted as of ace for %s\n",
124 sid_string_dbg(&ace->trustee)));
128 return STATUS_MORE_ENTRIES;
131 /****************************************************************
132 ****************************************************************/
134 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
135 const struct nt_user_token *token)
138 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
139 return gpo_sd_check_ace_denied_object(ace, token);
140 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
141 return gpo_sd_check_ace_allowed_object(ace, token);
143 return STATUS_MORE_ENTRIES;
147 /****************************************************************
148 ****************************************************************/
150 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
151 const struct nt_user_token *token)
153 struct security_descriptor *sd = gpo->security_descriptor;
154 struct security_acl *dacl = NULL;
155 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
159 return NT_STATUS_INVALID_USER_BUFFER;
163 return NT_STATUS_INVALID_SECURITY_DESCR;
168 return NT_STATUS_INVALID_SECURITY_DESCR;
171 /* check all aces and only return NT_STATUS_OK (== Access granted) or
172 * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
175 for (i = 0; i < dacl->num_aces; i ++) {
177 status = gpo_sd_check_ace(&dacl->aces[i], token);
179 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
181 } else if (NT_STATUS_IS_OK(status)) {
188 return NT_STATUS_ACCESS_DENIED;