idmap_ldap.8: Rework example to use new idmap syntax
[samba.git] / libgpo / gpo_sec.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Group Policy Object Support
4  *  Copyright (C) Guenther Deschner 2007
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 3 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19
20 #include "includes.h"
21 #include "libcli/security/security.h"
22 #include "../libgpo/gpo.h"
23 #include "auth.h"
24 #include "../librpc/ndr/libndr.h"
25 #if _SAMBA_BUILD_ == 4
26 #include "libgpo/ads_convenience.h"
27 #include "librpc/gen_ndr/security.h"
28 #include "librpc/gen_ndr/ndr_misc.h"
29 #include "../libcli/security/secace.h"
30 #endif
31
32 /****************************************************************
33 ****************************************************************/
34
35 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
36 {
37         struct GUID ext_right_apg_guid;
38         NTSTATUS status;
39
40         if (!object) {
41                 return false;
42         }
43
44         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
45                                   &ext_right_apg_guid);
46         if (!NT_STATUS_IS_OK(status)) {
47                 return false;
48         }
49
50         switch (object->flags) {
51                 case SEC_ACE_OBJECT_TYPE_PRESENT:
52                         if (GUID_equal(&object->type.type,
53                                        &ext_right_apg_guid)) {
54                                 return true;
55                         }
56                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
57                         if (GUID_equal(&object->inherited_type.inherited_type,
58                                        &ext_right_apg_guid)) {
59                                 return true;
60                         }
61                 default:
62                         break;
63         }
64
65         return false;
66 }
67
68 /****************************************************************
69 ****************************************************************/
70
71 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
72 {
73         if (!sec_ace_object(ace->type)) {
74                 return false;
75         }
76
77         return gpo_sd_check_agp_object_guid(&ace->object.object);
78 }
79
80 /****************************************************************
81 ****************************************************************/
82
83 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
84 {
85         return (access_mask & SEC_ADS_CONTROL_ACCESS);
86 }
87
88 #if 0
89 /****************************************************************
90 ****************************************************************/
91
92 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
93 {
94         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
95                            SEC_RIGHTS_READ_ALL_PROP |
96                            SEC_RIGHTS_READ_PERMS;
97
98         return (read_bits == (access_mask & read_bits));
99 }
100 #endif
101
102 /****************************************************************
103 ****************************************************************/
104
105 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
106                                                const struct security_token *token)
107 {
108         char *sid_str;
109
110         if (gpo_sd_check_agp_object(ace) &&
111             gpo_sd_check_agp_access_bits(ace->access_mask) &&
112             nt_token_check_sid(&ace->trustee, token)) {
113                 sid_str = dom_sid_string(NULL, &ace->trustee);
114                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
115                         "Access denied as of ace for %s\n",
116                         sid_str));
117                 talloc_free(sid_str);
118                 return NT_STATUS_ACCESS_DENIED;
119         }
120
121         return STATUS_MORE_ENTRIES;
122 }
123
124 /****************************************************************
125 ****************************************************************/
126
127 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
128                                                 const struct security_token *token)
129 {
130         char *sid_str;
131
132         if (gpo_sd_check_agp_object(ace) &&
133             gpo_sd_check_agp_access_bits(ace->access_mask) &&
134             nt_token_check_sid(&ace->trustee, token)) {
135                 sid_str = dom_sid_string(NULL, &ace->trustee);
136                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
137                         "Access granted as of ace for %s\n",
138                         sid_str));
139                 talloc_free(sid_str);
140
141                 return NT_STATUS_OK;
142         }
143
144         return STATUS_MORE_ENTRIES;
145 }
146
147 /****************************************************************
148 ****************************************************************/
149
150 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
151                                  const struct security_token *token)
152 {
153         switch (ace->type) {
154                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
155                         return gpo_sd_check_ace_denied_object(ace, token);
156                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
157                         return gpo_sd_check_ace_allowed_object(ace, token);
158                 default:
159                         return STATUS_MORE_ENTRIES;
160         }
161 }
162
163 /****************************************************************
164 ****************************************************************/
165
166 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
167                                       const struct security_token *token)
168 {
169         struct security_descriptor *sd = gpo->security_descriptor;
170         struct security_acl *dacl = NULL;
171         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
172         int i;
173
174         if (!token) {
175                 return NT_STATUS_INVALID_USER_BUFFER;
176         }
177
178         if (!sd) {
179                 return NT_STATUS_INVALID_SECURITY_DESCR;
180         }
181
182         dacl = sd->dacl;
183         if (!dacl) {
184                 return NT_STATUS_INVALID_SECURITY_DESCR;
185         }
186
187         /* check all aces and only return NT_STATUS_OK (== Access granted) or
188          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
189          * deny access */
190
191         for (i = 0; i < dacl->num_aces; i ++) {
192
193                 status = gpo_sd_check_ace(&dacl->aces[i], token);
194
195                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
196                         return status;
197                 } else if (NT_STATUS_IS_OK(status)) {
198                         return status;
199                 }
200
201                 continue;
202         }
203
204         return NT_STATUS_ACCESS_DENIED;
205 }