libgpo: remove some unused code and remove that important FIXME note.
[metze/samba/wip.git] / libgpo / gpo_sec.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Group Policy Object Support
4  *  Copyright (C) Guenther Deschner 2007
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 3 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19
20 #include "includes.h"
21 #include "libcli/security/security.h"
22 #include "../libgpo/gpo.h"
23 #include "auth.h"
24 #include "../librpc/ndr/libndr.h"
25
26 /****************************************************************
27 ****************************************************************/
28
29 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
30 {
31         struct GUID ext_right_apg_guid;
32         NTSTATUS status;
33
34         if (!object) {
35                 return false;
36         }
37
38         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
39                                   &ext_right_apg_guid);
40         if (!NT_STATUS_IS_OK(status)) {
41                 return false;
42         }
43
44         switch (object->flags) {
45                 case SEC_ACE_OBJECT_TYPE_PRESENT:
46                         if (GUID_equal(&object->type.type,
47                                        &ext_right_apg_guid)) {
48                                 return true;
49                         }
50                         /* FALL TROUGH */
51                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
52                         if (GUID_equal(&object->inherited_type.inherited_type,
53                                        &ext_right_apg_guid)) {
54                                 return true;
55                         }
56                         /* FALL TROUGH */
57                 default:
58                         break;
59         }
60
61         return false;
62 }
63
64 /****************************************************************
65 ****************************************************************/
66
67 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
68 {
69         if (!sec_ace_object(ace->type)) {
70                 return false;
71         }
72
73         return gpo_sd_check_agp_object_guid(&ace->object.object);
74 }
75
76 /****************************************************************
77 ****************************************************************/
78
79 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
80 {
81         return (access_mask & SEC_ADS_CONTROL_ACCESS);
82 }
83
84 #if 0
85 /****************************************************************
86 ****************************************************************/
87
88 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
89 {
90         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
91                            SEC_RIGHTS_READ_ALL_PROP |
92                            SEC_RIGHTS_READ_PERMS;
93
94         return (read_bits == (access_mask & read_bits));
95 }
96 #endif
97
98 /****************************************************************
99 ****************************************************************/
100
101 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
102                                                const struct security_token *token)
103 {
104         char *sid_str;
105
106         if (gpo_sd_check_agp_object(ace) &&
107             gpo_sd_check_agp_access_bits(ace->access_mask) &&
108             security_token_has_sid(token, &ace->trustee)) {
109                 sid_str = dom_sid_string(NULL, &ace->trustee);
110                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
111                         "Access denied as of ace for %s\n",
112                         sid_str));
113                 talloc_free(sid_str);
114                 return NT_STATUS_ACCESS_DENIED;
115         }
116
117         return STATUS_MORE_ENTRIES;
118 }
119
120 /****************************************************************
121 ****************************************************************/
122
123 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
124                                                 const struct security_token *token)
125 {
126         char *sid_str;
127
128         if (gpo_sd_check_agp_object(ace) &&
129             gpo_sd_check_agp_access_bits(ace->access_mask) &&
130             security_token_has_sid(token, &ace->trustee)) {
131                 sid_str = dom_sid_string(NULL, &ace->trustee);
132                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
133                         "Access granted as of ace for %s\n",
134                         sid_str));
135                 talloc_free(sid_str);
136
137                 return NT_STATUS_OK;
138         }
139
140         return STATUS_MORE_ENTRIES;
141 }
142
143 /****************************************************************
144 ****************************************************************/
145
146 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
147                                  const struct security_token *token)
148 {
149         switch (ace->type) {
150                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
151                         return gpo_sd_check_ace_denied_object(ace, token);
152                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
153                         return gpo_sd_check_ace_allowed_object(ace, token);
154                 default:
155                         return STATUS_MORE_ENTRIES;
156         }
157 }
158
159 /****************************************************************
160 ****************************************************************/
161
162 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
163                                       const struct security_token *token)
164 {
165         struct security_descriptor *sd = gpo->security_descriptor;
166         struct security_acl *dacl = NULL;
167         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
168         int i;
169
170         if (!token) {
171                 return NT_STATUS_INVALID_USER_BUFFER;
172         }
173
174         if (!sd) {
175                 return NT_STATUS_INVALID_SECURITY_DESCR;
176         }
177
178         dacl = sd->dacl;
179         if (!dacl) {
180                 return NT_STATUS_INVALID_SECURITY_DESCR;
181         }
182
183         /* check all aces and only return NT_STATUS_OK (== Access granted) or
184          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
185          * deny access */
186
187         for (i = 0; i < dacl->num_aces; i ++) {
188
189                 status = gpo_sd_check_ace(&dacl->aces[i], token);
190
191                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
192                         return status;
193                 } else if (NT_STATUS_IS_OK(status)) {
194                         return status;
195                 }
196
197                 continue;
198         }
199
200         return NT_STATUS_ACCESS_DENIED;
201 }