s4:dsdb/common: add samdb_domain_guid() helper function
[samba.git] / libgpo / gpo_util.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Group Policy Object Support
4  *  Copyright (C) Guenther Deschner 2005-2008
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 3 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19
20 #include "includes.h"
21 #include "system/filesys.h"
22 #include "librpc/gen_ndr/ndr_misc.h"
23 #include "../librpc/gen_ndr/ndr_security.h"
24 #include "../libgpo/gpo.h"
25 #include "../libcli/security/security.h"
26 #include "registry.h"
27 #include "libgpo/gpo_proto.h"
28 #include "libgpo/gpext/gpext.h"
29
30 #if 0
31 #define DEFAULT_DOMAIN_POLICY "Default Domain Policy"
32 #define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy"
33 #endif
34
35 /* should we store a parsed guid ? */
36 struct gp_table {
37         const char *name;
38         const char *guid_string;
39 };
40
41 #if 0 /* unused */
42 static struct gp_table gpo_default_policy[] = {
43         { DEFAULT_DOMAIN_POLICY,
44                 "31B2F340-016D-11D2-945F-00C04FB984F9" },
45         { DEFAULT_DOMAIN_CONTROLLERS_POLICY,
46                 "6AC1786C-016F-11D2-945F-00C04fB984F9" },
47         { NULL, NULL }
48 };
49 #endif
50
51 /* the following is seen in gPCMachineExtensionNames / gPCUserExtensionNames */
52
53 static struct gp_table gpo_cse_extensions[] = {
54         /* used to be "Administrative Templates Extension" */
55         /* "Registry Settings"
56         (http://support.microsoft.com/kb/216357/EN-US/) */
57         { "Registry Settings",
58                 GP_EXT_GUID_REGISTRY },
59         { "Microsoft Disc Quota",
60                 "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" },
61         { "EFS recovery",
62                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
63         { "Folder Redirection",
64                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
65         { "IP Security",
66                 "E437BC1C-AA7D-11D2-A382-00C04F991E27" },
67         { "Internet Explorer Branding",
68                 "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" },
69         { "QoS Packet Scheduler",
70                 "426031c0-0b47-4852-b0ca-ac3d37bfcb39" },
71         { "Scripts",
72                 GP_EXT_GUID_SCRIPTS },
73         { "Security",
74                 GP_EXT_GUID_SECURITY },
75         { "Software Installation",
76                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
77         { "Wireless Group Policy",
78                 "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" },
79         { "Application Management",
80                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
81         { "unknown",
82                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
83         { NULL, NULL }
84 };
85
86 /* guess work */
87 static struct gp_table gpo_cse_snapin_extensions[] = {
88         { "Administrative Templates",
89                 "0F6B957D-509E-11D1-A7CC-0000F87571E3" },
90         { "Certificates",
91                 "53D6AB1D-2488-11D1-A28C-00C04FB94F17" },
92         { "EFS recovery policy processing",
93                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
94         { "Folder Redirection policy processing",
95                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
96         { "Folder Redirection",
97                 "88E729D6-BDC1-11D1-BD2A-00C04FB9603F" },
98         { "Registry policy processing",
99                 "35378EAC-683F-11D2-A89A-00C04FBBCFA2" },
100         { "Remote Installation Services",
101                 "3060E8CE-7020-11D2-842D-00C04FA372D4" },
102         { "Security Settings",
103                 "803E14A0-B4FB-11D0-A0D0-00A0C90F574B" },
104         { "Security policy processing",
105                 "827D319E-6EAC-11D2-A4EA-00C04F79F83A" },
106         { "unknown",
107                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
108         { "unknown2",
109                 "53D6AB1B-2488-11D1-A28C-00C04FB94F17" },
110         { NULL, NULL }
111 };
112
113 /****************************************************************
114 ****************************************************************/
115
116 static const char *name_to_guid_string(const char *name,
117                                        struct gp_table *table)
118 {
119         int i;
120
121         for (i = 0; table[i].name; i++) {
122                 if (strequal(name, table[i].name)) {
123                         return table[i].guid_string;
124                 }
125         }
126
127         return NULL;
128 }
129
130 /****************************************************************
131 ****************************************************************/
132
133 static const char *guid_string_to_name(const char *guid_string,
134                                        struct gp_table *table)
135 {
136         int i;
137
138         for (i = 0; table[i].guid_string; i++) {
139                 if (strequal(guid_string, table[i].guid_string)) {
140                         return table[i].name;
141                 }
142         }
143
144         return NULL;
145 }
146
147 /****************************************************************
148 ****************************************************************/
149
150 static const char *snapin_guid_string_to_name(const char *guid_string,
151                                               struct gp_table *table)
152 {
153         int i;
154         for (i = 0; table[i].guid_string; i++) {
155                 if (strequal(guid_string, table[i].guid_string)) {
156                         return table[i].name;
157                 }
158         }
159         return NULL;
160 }
161
162 #if 0 /* unused */
163 static const char *default_gpo_name_to_guid_string(const char *name)
164 {
165         return name_to_guid_string(name, gpo_default_policy);
166 }
167
168 static const char *default_gpo_guid_string_to_name(const char *guid)
169 {
170         return guid_string_to_name(guid, gpo_default_policy);
171 }
172 #endif
173
174 /****************************************************************
175 ****************************************************************/
176
177 const char *cse_gpo_guid_string_to_name(const char *guid)
178 {
179         return guid_string_to_name(guid, gpo_cse_extensions);
180 }
181
182 /****************************************************************
183 ****************************************************************/
184
185 const char *cse_gpo_name_to_guid_string(const char *name)
186 {
187         return name_to_guid_string(name, gpo_cse_extensions);
188 }
189
190 /****************************************************************
191 ****************************************************************/
192
193 const char *cse_snapin_gpo_guid_string_to_name(const char *guid)
194 {
195         return snapin_guid_string_to_name(guid, gpo_cse_snapin_extensions);
196 }
197
198 /****************************************************************
199 ****************************************************************/
200
201 void dump_gp_ext(struct GP_EXT *gp_ext, int debuglevel)
202 {
203         int lvl = debuglevel;
204         int i;
205
206         if (gp_ext == NULL) {
207                 return;
208         }
209
210         DEBUG(lvl,("\t---------------------\n\n"));
211         DEBUGADD(lvl,("\tname:\t\t\t%s\n", gp_ext->gp_extension));
212
213         for (i=0; i< gp_ext->num_exts; i++) {
214
215                 DEBUGADD(lvl,("\textension:\t\t\t%s\n",
216                         gp_ext->extensions_guid[i]));
217                 DEBUGADD(lvl,("\textension (name):\t\t\t%s\n",
218                         gp_ext->extensions[i]));
219
220                 DEBUGADD(lvl,("\tsnapin:\t\t\t%s\n",
221                         gp_ext->snapins_guid[i]));
222                 DEBUGADD(lvl,("\tsnapin (name):\t\t\t%s\n",
223                         gp_ext->snapins[i]));
224         }
225 }
226
227 #ifdef HAVE_LDAP
228
229 /****************************************************************
230 ****************************************************************/
231
232 void dump_gpo(const struct GROUP_POLICY_OBJECT *gpo,
233               int debuglevel)
234 {
235         int lvl = debuglevel;
236         TALLOC_CTX *frame = talloc_stackframe();
237
238         if (gpo == NULL) {
239                 goto out;
240         }
241
242         DEBUG(lvl,("---------------------\n\n"));
243
244         DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name));
245         DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name));
246         DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version));
247         DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n",
248                 GPO_VERSION_USER(gpo->version),
249                 GPO_VERSION_USER(gpo->version)));
250         DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n",
251                 GPO_VERSION_MACHINE(gpo->version),
252                  GPO_VERSION_MACHINE(gpo->version)));
253         DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path));
254         DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path));
255
256         DEBUGADD(lvl,("options:\t\t%d ", gpo->options));
257         switch (gpo->options) {
258                 case GPFLAGS_ALL_ENABLED:
259                         DEBUGADD(lvl,("GPFLAGS_ALL_ENABLED\n"));
260                         break;
261                 case GPFLAGS_USER_SETTINGS_DISABLED:
262                         DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED\n"));
263                         break;
264                 case GPFLAGS_MACHINE_SETTINGS_DISABLED:
265                         DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED\n"));
266                         break;
267                 case GPFLAGS_ALL_DISABLED:
268                         DEBUGADD(lvl,("GPFLAGS_ALL_DISABLED\n"));
269                         break;
270                 default:
271                         DEBUGADD(lvl,("unknown option: %d\n", gpo->options));
272                         break;
273         }
274
275         DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link));
276         DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type));
277         switch (gpo->link_type) {
278                 case GP_LINK_UNKOWN:
279                         DEBUGADD(lvl,("GP_LINK_UNKOWN\n"));
280                         break;
281                 case GP_LINK_OU:
282                         DEBUGADD(lvl,("GP_LINK_OU\n"));
283                         break;
284                 case GP_LINK_DOMAIN:
285                         DEBUGADD(lvl,("GP_LINK_DOMAIN\n"));
286                         break;
287                 case GP_LINK_SITE:
288                         DEBUGADD(lvl,("GP_LINK_SITE\n"));
289                         break;
290                 case GP_LINK_MACHINE:
291                         DEBUGADD(lvl,("GP_LINK_MACHINE\n"));
292                         break;
293                 default:
294                         break;
295         }
296
297         DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions));
298
299         if (gpo->machine_extensions) {
300
301                 struct GP_EXT *gp_ext = NULL;
302
303                 if (!ads_parse_gp_ext(frame, gpo->machine_extensions,
304                                       &gp_ext)) {
305                         goto out;
306                 }
307                 dump_gp_ext(gp_ext, lvl);
308         }
309
310         DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions));
311
312         if (gpo->user_extensions) {
313
314                 struct GP_EXT *gp_ext = NULL;
315
316                 if (!ads_parse_gp_ext(frame, gpo->user_extensions,
317                                       &gp_ext)) {
318                         goto out;
319                 }
320                 dump_gp_ext(gp_ext, lvl);
321         }
322         if (gpo->security_descriptor) {
323                 DEBUGADD(lvl,("security descriptor:\n"));
324
325                 NDR_PRINT_DEBUG(security_descriptor, gpo->security_descriptor);
326         }
327  out:
328         talloc_free(frame);
329 }
330
331 /****************************************************************
332 ****************************************************************/
333
334 void dump_gpo_list(const struct GROUP_POLICY_OBJECT *gpo_list,
335                    int debuglevel)
336 {
337         const struct GROUP_POLICY_OBJECT *gpo = NULL;
338
339         for (gpo = gpo_list; gpo; gpo = gpo->next) {
340                 dump_gpo(gpo, debuglevel);
341         }
342 }
343
344 /****************************************************************
345 ****************************************************************/
346
347 void dump_gplink(const struct GP_LINK *gp_link)
348 {
349         int i;
350         int lvl = 10;
351
352         if (gp_link == NULL) {
353                 return;
354         }
355
356         DEBUG(lvl,("---------------------\n\n"));
357
358         DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link));
359         DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts));
360         switch (gp_link->gp_opts) {
361                 case GPOPTIONS_INHERIT:
362                         DEBUGADD(lvl,("GPOPTIONS_INHERIT\n"));
363                         break;
364                 case GPOPTIONS_BLOCK_INHERITANCE:
365                         DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n"));
366                         break;
367                 default:
368                         break;
369         }
370
371         DEBUGADD(lvl,("num links: %d\n", gp_link->num_links));
372
373         for (i = 0; i < gp_link->num_links; i++) {
374
375                 DEBUGADD(lvl,("---------------------\n\n"));
376
377                 DEBUGADD(lvl,("link: #%d\n", i + 1));
378                 DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i]));
379
380                 DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i]));
381                 if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) {
382                         DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED "));
383                 }
384                 if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) {
385                         DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED"));
386                 }
387                 DEBUGADD(lvl,("\n"));
388         }
389 }
390
391 #endif /* HAVE_LDAP */
392
393 /****************************************************************
394 ****************************************************************/
395
396 bool gpo_get_gp_ext_from_gpo(TALLOC_CTX *mem_ctx,
397                              uint32_t flags,
398                              const struct GROUP_POLICY_OBJECT *gpo,
399                              struct GP_EXT **gp_ext)
400 {
401         ZERO_STRUCTP(*gp_ext);
402
403         if (flags & GPO_INFO_FLAG_MACHINE) {
404
405                 if (gpo->machine_extensions) {
406
407                         if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
408                                               gp_ext)) {
409                                 return false;
410                         }
411                 }
412         } else {
413
414                 if (gpo->user_extensions) {
415
416                         if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
417                                               gp_ext)) {
418                                 return false;
419                         }
420                 }
421         }
422
423         return true;
424 }
425
426 /****************************************************************
427 ****************************************************************/
428
429 NTSTATUS gpo_process_gpo_list(TALLOC_CTX *mem_ctx,
430                               const struct security_token *token,
431                               const struct GROUP_POLICY_OBJECT *deleted_gpo_list,
432                               const struct GROUP_POLICY_OBJECT *changed_gpo_list,
433                               const char *extensions_guid_filter,
434                               uint32_t flags)
435 {
436         NTSTATUS status = NT_STATUS_OK;
437         struct registry_key *root_key = NULL;
438         struct gp_registry_context *reg_ctx = NULL;
439         WERROR werr;
440
441         /* get the key here */
442         if (flags & GPO_LIST_FLAG_MACHINE) {
443                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKLM, REG_KEY_WRITE,
444                                        get_system_token(),
445                                        &reg_ctx);
446         } else {
447                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKCU, REG_KEY_WRITE,
448                                        token,
449                                        &reg_ctx);
450         }
451         if (!W_ERROR_IS_OK(werr)) {
452                 talloc_free(reg_ctx);
453                 return werror_to_ntstatus(werr);
454         }
455
456         root_key = reg_ctx->curr_key;
457
458         status = gpext_process_extension(mem_ctx,
459                                          flags, token, root_key,
460                                          deleted_gpo_list,
461                                          changed_gpo_list,
462                                          extensions_guid_filter);
463         talloc_free(reg_ctx);
464         talloc_free(root_key);
465         gpext_free_gp_extensions();
466
467         return status;
468 }
469
470
471 /****************************************************************
472  check wether the version number in a GROUP_POLICY_OBJECT match those of the
473  locally stored version. If not, fetch the required policy via CIFS
474 ****************************************************************/
475
476 NTSTATUS check_refresh_gpo(ADS_STRUCT *ads,
477                            TALLOC_CTX *mem_ctx,
478                            const char *cache_dir,
479                            uint32_t flags,
480                            const struct GROUP_POLICY_OBJECT *gpo)
481 {
482         NTSTATUS result;
483         char *server = NULL;
484         char *share = NULL;
485         char *nt_path = NULL;
486         char *unix_path = NULL;
487         uint32_t sysvol_gpt_version = 0;
488         char *display_name = NULL;
489
490         result = gpo_explode_filesyspath(mem_ctx, cache_dir, gpo->file_sys_path,
491                                          &server, &share, &nt_path, &unix_path);
492
493         if (!NT_STATUS_IS_OK(result)) {
494                 goto out;
495         }
496
497         result = gpo_get_sysvol_gpt_version(mem_ctx,
498                                             unix_path,
499                                             &sysvol_gpt_version,
500                                             &display_name);
501         if (!NT_STATUS_IS_OK(result) &&
502             !NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_FILE)) {
503                 DEBUG(10,("check_refresh_gpo: "
504                         "failed to get local gpt version: %s\n",
505                         nt_errstr(result)));
506                 goto out;
507         }
508
509         DEBUG(10,("check_refresh_gpo: versions gpo %d sysvol %d\n",
510                 gpo->version, sysvol_gpt_version));
511
512         /* FIXME: handle GPO_INFO_FLAG_FORCED_REFRESH from flags */
513
514         while (gpo->version > sysvol_gpt_version) {
515
516                 DEBUG(1,("check_refresh_gpo: need to refresh GPO\n"));
517
518                 result = gpo_fetch_files(mem_ctx, ads, cache_dir, gpo);
519                 if (!NT_STATUS_IS_OK(result)) {
520                         goto out;
521                 }
522
523                 result = gpo_get_sysvol_gpt_version(mem_ctx,
524                                                     unix_path,
525                                                     &sysvol_gpt_version,
526                                                     &display_name);
527                 if (!NT_STATUS_IS_OK(result)) {
528                         DEBUG(10,("check_refresh_gpo: "
529                                 "failed to get local gpt version: %s\n",
530                                 nt_errstr(result)));
531                         goto out;
532                 }
533
534                 if (gpo->version == sysvol_gpt_version) {
535                         break;
536                 }
537         }
538
539         DEBUG(10,("Name:\t\t\t%s (%s)\n", gpo->display_name, gpo->name));
540         DEBUGADD(10,("sysvol GPT version:\t%d (user: %d, machine: %d)\n",
541                 sysvol_gpt_version,
542                 GPO_VERSION_USER(sysvol_gpt_version),
543                 GPO_VERSION_MACHINE(sysvol_gpt_version)));
544         DEBUGADD(10,("LDAP GPO version:\t%d (user: %d, machine: %d)\n",
545                 gpo->version,
546                 GPO_VERSION_USER(gpo->version),
547                 GPO_VERSION_MACHINE(gpo->version)));
548         DEBUGADD(10,("LDAP GPO link:\t\t%s\n", gpo->link));
549
550         result = NT_STATUS_OK;
551
552  out:
553         return result;
554
555 }
556
557 /****************************************************************
558  check wether the version numbers in the gpo_list match the locally stored, if
559  not, go and get each required GPO via CIFS
560  ****************************************************************/
561
562 NTSTATUS check_refresh_gpo_list(ADS_STRUCT *ads,
563                                 TALLOC_CTX *mem_ctx,
564                                 const char *cache_dir,
565                                 uint32_t flags,
566                                 const struct GROUP_POLICY_OBJECT *gpo_list)
567 {
568         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
569         const struct GROUP_POLICY_OBJECT *gpo;
570
571         if (!gpo_list) {
572                 return NT_STATUS_INVALID_PARAMETER;
573         }
574
575         for (gpo = gpo_list; gpo; gpo = gpo->next) {
576
577                 result = check_refresh_gpo(ads, mem_ctx, cache_dir, flags, gpo);
578                 if (!NT_STATUS_IS_OK(result)) {
579                         goto out;
580                 }
581         }
582
583         result = NT_STATUS_OK;
584
585  out:
586         /* FIXME close cli connection */
587
588         return result;
589 }
590
591 /****************************************************************
592 ****************************************************************/
593
594 NTSTATUS gpo_get_unix_path(TALLOC_CTX *mem_ctx,
595                            const char *cache_dir,
596                            const struct GROUP_POLICY_OBJECT *gpo,
597                            char **unix_path)
598 {
599         char *server, *share, *nt_path;
600         return gpo_explode_filesyspath(mem_ctx, cache_dir, gpo->file_sys_path,
601                                        &server, &share, &nt_path, unix_path);
602 }
603
604 /****************************************************************
605 ****************************************************************/
606
607 char *gpo_flag_str(TALLOC_CTX *ctx, uint32_t flags)
608 {
609         char *str = NULL;
610
611         if (flags == 0) {
612                 return NULL;
613         }
614
615         str = talloc_strdup(ctx, "");
616         if (!str) {
617                 return NULL;
618         }
619
620         if (flags & GPO_INFO_FLAG_SLOWLINK)
621                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_SLOWLINK ");
622         if (flags & GPO_INFO_FLAG_VERBOSE)
623                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_VERBOSE ");
624         if (flags & GPO_INFO_FLAG_SAFEMODE_BOOT)
625                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_SAFEMODE_BOOT ");
626         if (flags & GPO_INFO_FLAG_NOCHANGES)
627                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_NOCHANGES ");
628         if (flags & GPO_INFO_FLAG_MACHINE)
629                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_MACHINE ");
630         if (flags & GPO_INFO_FLAG_LOGRSOP_TRANSITION)
631                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_LOGRSOP_TRANSITION ");
632         if (flags & GPO_INFO_FLAG_LINKTRANSITION)
633                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_LINKTRANSITION ");
634         if (flags & GPO_INFO_FLAG_FORCED_REFRESH)
635                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_FORCED_REFRESH ");
636         if (flags & GPO_INFO_FLAG_BACKGROUND)
637                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_BACKGROUND ");
638
639         return str;
640 }
641
642 /****************************************************************
643 ****************************************************************/
644
645 NTSTATUS gp_find_file(TALLOC_CTX *mem_ctx,
646                       uint32_t flags,
647                       const char *filename,
648                       const char *suffix,
649                       const char **filename_out)
650 {
651         const char *tmp = NULL;
652         struct stat sbuf;
653         const char *path = NULL;
654
655         if (flags & GPO_LIST_FLAG_MACHINE) {
656                 path = "Machine";
657         } else {
658                 path = "User";
659         }
660
661         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
662                               path, suffix);
663         NT_STATUS_HAVE_NO_MEMORY(tmp);
664
665         if (stat(tmp, &sbuf) == 0) {
666                 *filename_out = tmp;
667                 return NT_STATUS_OK;
668         }
669
670         path = talloc_strdup_upper(mem_ctx, path);
671         NT_STATUS_HAVE_NO_MEMORY(path);
672
673         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
674                               path, suffix);
675         NT_STATUS_HAVE_NO_MEMORY(tmp);
676
677         if (stat(tmp, &sbuf) == 0) {
678                 *filename_out = tmp;
679                 return NT_STATUS_OK;
680         }
681
682         return NT_STATUS_NO_SUCH_FILE;
683 }
684
685 /****************************************************************
686 ****************************************************************/
687
688 ADS_STATUS gp_get_machine_token(ADS_STRUCT *ads,
689                                 TALLOC_CTX *mem_ctx,
690                                 const char *dn,
691                                 struct security_token **token)
692 {
693 #ifdef HAVE_ADS
694         struct security_token *ad_token = NULL;
695         ADS_STATUS status;
696         NTSTATUS ntstatus;
697
698         status = ads_get_sid_token(ads, mem_ctx, dn, &ad_token);
699         if (!ADS_ERR_OK(status)) {
700                 return status;
701         }
702         ntstatus = merge_nt_token(mem_ctx, ad_token, get_system_token(),
703                                   token);
704         if (!NT_STATUS_IS_OK(ntstatus)) {
705                 return ADS_ERROR_NT(ntstatus);
706         }
707         return ADS_SUCCESS;
708 #else
709         return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
710 #endif
711 }
712
713 /****************************************************************
714 ****************************************************************/
715
716 NTSTATUS gpo_copy(TALLOC_CTX *mem_ctx,
717                   const struct GROUP_POLICY_OBJECT *gpo_src,
718                   struct GROUP_POLICY_OBJECT **gpo_dst)
719 {
720         struct GROUP_POLICY_OBJECT *gpo;
721
722         gpo = talloc_zero(mem_ctx, struct GROUP_POLICY_OBJECT);
723         NT_STATUS_HAVE_NO_MEMORY(gpo);
724
725         gpo->options            = gpo_src->options;
726         gpo->version            = gpo_src->version;
727
728         gpo->ds_path            = talloc_strdup(gpo, gpo_src->ds_path);
729         if (gpo->ds_path == NULL) {
730                 TALLOC_FREE(gpo);
731                 return NT_STATUS_NO_MEMORY;
732         }
733
734         gpo->file_sys_path      = talloc_strdup(gpo, gpo_src->file_sys_path);
735         if (gpo->file_sys_path == NULL) {
736                 TALLOC_FREE(gpo);
737                 return NT_STATUS_NO_MEMORY;
738         }
739
740         gpo->display_name       = talloc_strdup(gpo, gpo_src->display_name);
741         if (gpo->display_name == NULL) {
742                 TALLOC_FREE(gpo);
743                 return NT_STATUS_NO_MEMORY;
744         }
745
746         gpo->name               = talloc_strdup(gpo, gpo_src->name);
747         if (gpo->name == NULL) {
748                 TALLOC_FREE(gpo);
749                 return NT_STATUS_NO_MEMORY;
750         }
751
752         gpo->link               = talloc_strdup(gpo, gpo_src->link);
753         if (gpo->link == NULL) {
754                 TALLOC_FREE(gpo);
755                 return NT_STATUS_NO_MEMORY;
756         }
757
758         gpo->link_type          = gpo_src->link_type;
759
760         if (gpo_src->user_extensions) {
761                 gpo->user_extensions = talloc_strdup(gpo, gpo_src->user_extensions);
762                 if (gpo->user_extensions == NULL) {
763                         TALLOC_FREE(gpo);
764                         return NT_STATUS_NO_MEMORY;
765                 }
766         }
767
768         if (gpo_src->machine_extensions) {
769                 gpo->machine_extensions = talloc_strdup(gpo, gpo_src->machine_extensions);
770                 if (gpo->machine_extensions == NULL) {
771                         TALLOC_FREE(gpo);
772                         return NT_STATUS_NO_MEMORY;
773                 }
774         }
775
776         if (gpo_src->security_descriptor == NULL) {
777                 /* existing SD assumed */
778                 TALLOC_FREE(gpo);
779                 return NT_STATUS_INVALID_PARAMETER;
780         }
781         gpo->security_descriptor = security_descriptor_copy(gpo,
782                                                 gpo_src->security_descriptor);
783         if (gpo->security_descriptor == NULL) {
784                 TALLOC_FREE(gpo);
785                 return NT_STATUS_NO_MEMORY;
786         }
787
788         gpo->next = gpo->prev = NULL;
789
790         *gpo_dst = gpo;
791
792         return NT_STATUS_OK;
793 }