2 Unix SMB/CIFS implementation.
4 security descriptor description language functions
6 Copyright (C) Andrew Tridgell 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libcli/security/security.h"
24 #include "librpc/gen_ndr/ndr_misc.h"
25 #include "system/locale.h"
32 static bool sddl_map_flag(
33 const struct flag_map *map,
38 while (map->name != NULL) {
39 size_t len = strlen(map->name);
40 int cmp = strncmp(map->name, str, len);
53 map a series of letter codes into a uint32_t
55 static bool sddl_map_flags(const struct flag_map *map, const char *str,
56 uint32_t *pflags, size_t *plen)
58 const char *str0 = str;
63 while (str[0] && isupper(str[0])) {
68 found = sddl_map_flag(map, str, &len, &flags);
70 DEBUG(1, ("Unknown flag - %s in %s\n", str, str0));
84 a mapping between the 2 letter SID codes and sid strings
91 { .code = "WD", .sid = SID_WORLD },
93 { .code = "CO", .sid = SID_CREATOR_OWNER },
94 { .code = "CG", .sid = SID_CREATOR_GROUP },
96 { .code = "NU", .sid = SID_NT_NETWORK },
97 { .code = "IU", .sid = SID_NT_INTERACTIVE },
98 { .code = "SU", .sid = SID_NT_SERVICE },
99 { .code = "AN", .sid = SID_NT_ANONYMOUS },
100 { .code = "ED", .sid = SID_NT_ENTERPRISE_DCS },
101 { .code = "PS", .sid = SID_NT_SELF },
102 { .code = "AU", .sid = SID_NT_AUTHENTICATED_USERS },
103 { .code = "RC", .sid = SID_NT_RESTRICTED },
104 { .code = "SY", .sid = SID_NT_SYSTEM },
105 { .code = "LS", .sid = SID_NT_LOCAL_SERVICE },
106 { .code = "NS", .sid = SID_NT_NETWORK_SERVICE },
107 { .code = "IS", .sid = SID_NT_IUSR },
109 { .code = "BA", .sid = SID_BUILTIN_ADMINISTRATORS },
110 { .code = "BU", .sid = SID_BUILTIN_USERS },
111 { .code = "BG", .sid = SID_BUILTIN_GUESTS },
112 { .code = "PU", .sid = SID_BUILTIN_POWER_USERS },
113 { .code = "AO", .sid = SID_BUILTIN_ACCOUNT_OPERATORS },
114 { .code = "SO", .sid = SID_BUILTIN_SERVER_OPERATORS },
115 { .code = "PO", .sid = SID_BUILTIN_PRINT_OPERATORS },
116 { .code = "BO", .sid = SID_BUILTIN_BACKUP_OPERATORS },
117 { .code = "RE", .sid = SID_BUILTIN_REPLICATOR },
118 { .code = "BR", .sid = SID_BUILTIN_RAS_SERVERS },
119 { .code = "RU", .sid = SID_BUILTIN_PREW2K },
120 { .code = "RD", .sid = SID_BUILTIN_REMOTE_DESKTOP_USERS },
121 { .code = "NO", .sid = SID_BUILTIN_NETWORK_CONF_OPERATORS },
122 { .code = "IF", .sid = SID_BUILTIN_INCOMING_FOREST_TRUST },
124 { .code = "LA", .sid = NULL, .rid = DOMAIN_RID_ADMINISTRATOR },
125 { .code = "LG", .sid = NULL, .rid = DOMAIN_RID_GUEST },
126 { .code = "LK", .sid = NULL, .rid = DOMAIN_RID_KRBTGT },
128 { .code = "ER", .sid = NULL, .rid = DOMAIN_RID_ENTERPRISE_READONLY_DCS },
129 { .code = "DA", .sid = NULL, .rid = DOMAIN_RID_ADMINS },
130 { .code = "DU", .sid = NULL, .rid = DOMAIN_RID_USERS },
131 { .code = "DG", .sid = NULL, .rid = DOMAIN_RID_GUESTS },
132 { .code = "DC", .sid = NULL, .rid = DOMAIN_RID_DOMAIN_MEMBERS },
133 { .code = "DD", .sid = NULL, .rid = DOMAIN_RID_DCS },
134 { .code = "CA", .sid = NULL, .rid = DOMAIN_RID_CERT_ADMINS },
135 { .code = "SA", .sid = NULL, .rid = DOMAIN_RID_SCHEMA_ADMINS },
136 { .code = "EA", .sid = NULL, .rid = DOMAIN_RID_ENTERPRISE_ADMINS },
137 { .code = "PA", .sid = NULL, .rid = DOMAIN_RID_POLICY_ADMINS },
138 { .code = "RO", .sid = NULL, .rid = DOMAIN_RID_READONLY_DCS },
139 { .code = "RS", .sid = NULL, .rid = DOMAIN_RID_RAS_SERVERS }
144 It can either be a special 2 letter code, or in S-* format
146 static struct dom_sid *sddl_decode_sid(TALLOC_CTX *mem_ctx, const char **sddlp,
147 const struct dom_sid *domain_sid)
149 const char *sddl = (*sddlp);
152 /* see if its in the numeric format */
153 if (strncmp(sddl, "S-", 2) == 0) {
156 size_t len = strspn(sddl+2, "-0123456789");
157 sid_str = talloc_strndup(mem_ctx, sddl, len+2);
162 sid = dom_sid_parse_talloc(mem_ctx, sid_str);
163 talloc_free(sid_str);
167 /* now check for one of the special codes */
168 for (i=0;i<ARRAY_SIZE(sid_codes);i++) {
169 if (strncmp(sid_codes[i].code, sddl, 2) == 0) break;
171 if (i == ARRAY_SIZE(sid_codes)) {
172 DEBUG(1,("Unknown sddl sid code '%2.2s'\n", sddl));
178 if (sid_codes[i].sid == NULL) {
179 return dom_sid_add_rid(mem_ctx, domain_sid, sid_codes[i].rid);
182 return dom_sid_parse_talloc(mem_ctx, sid_codes[i].sid);
185 static const struct flag_map ace_types[] = {
186 { "AU", SEC_ACE_TYPE_SYSTEM_AUDIT },
187 { "AL", SEC_ACE_TYPE_SYSTEM_ALARM },
188 { "OA", SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT },
189 { "OD", SEC_ACE_TYPE_ACCESS_DENIED_OBJECT },
190 { "OU", SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT },
191 { "OL", SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT },
192 { "A", SEC_ACE_TYPE_ACCESS_ALLOWED },
193 { "D", SEC_ACE_TYPE_ACCESS_DENIED },
197 static const struct flag_map ace_flags[] = {
198 { "OI", SEC_ACE_FLAG_OBJECT_INHERIT },
199 { "CI", SEC_ACE_FLAG_CONTAINER_INHERIT },
200 { "NP", SEC_ACE_FLAG_NO_PROPAGATE_INHERIT },
201 { "IO", SEC_ACE_FLAG_INHERIT_ONLY },
202 { "ID", SEC_ACE_FLAG_INHERITED_ACE },
203 { "SA", SEC_ACE_FLAG_SUCCESSFUL_ACCESS },
204 { "FA", SEC_ACE_FLAG_FAILED_ACCESS },
208 static const struct flag_map ace_access_mask[] = {
209 { "RP", SEC_ADS_READ_PROP },
210 { "WP", SEC_ADS_WRITE_PROP },
211 { "CR", SEC_ADS_CONTROL_ACCESS },
212 { "CC", SEC_ADS_CREATE_CHILD },
213 { "DC", SEC_ADS_DELETE_CHILD },
214 { "LC", SEC_ADS_LIST },
215 { "LO", SEC_ADS_LIST_OBJECT },
216 { "RC", SEC_STD_READ_CONTROL },
217 { "WO", SEC_STD_WRITE_OWNER },
218 { "WD", SEC_STD_WRITE_DAC },
219 { "SD", SEC_STD_DELETE },
220 { "DT", SEC_ADS_DELETE_TREE },
221 { "SW", SEC_ADS_SELF_WRITE },
222 { "GA", SEC_GENERIC_ALL },
223 { "GR", SEC_GENERIC_READ },
224 { "GW", SEC_GENERIC_WRITE },
225 { "GX", SEC_GENERIC_EXECUTE },
229 static const struct flag_map decode_ace_access_mask[] = {
230 { "FA", FILE_ALL_ACCESS },
231 { "FR", FILE_GENERIC_READ },
232 { "FW", FILE_GENERIC_WRITE },
233 { "FX", FILE_GENERIC_EXECUTE },
239 return true on success, false on failure
240 note that this routine modifies the string
242 static bool sddl_decode_ace(TALLOC_CTX *mem_ctx, struct security_ace *ace, char *str,
243 const struct dom_sid *domain_sid)
253 /* parse out the 6 tokens */
256 char *ptr = strchr(str, ';');
257 if (ptr == NULL) return false;
264 if (!sddl_map_flags(ace_types, tok[0], &v, NULL)) {
270 if (!sddl_map_flags(ace_flags, tok[1], &v, NULL)) {
276 if (strncmp(tok[2], "0x", 2) == 0) {
277 ace->access_mask = strtol(tok[2], NULL, 16);
279 if (!sddl_map_flags(ace_access_mask, tok[2], &v, NULL) &&
281 decode_ace_access_mask, tok[2], &v, NULL)) {
284 ace->access_mask = v;
288 if (tok[3][0] != 0) {
289 NTSTATUS status = GUID_from_string(tok[3],
290 &ace->object.object.type.type);
291 if (!NT_STATUS_IS_OK(status)) {
294 ace->object.object.flags |= SEC_ACE_OBJECT_TYPE_PRESENT;
298 if (tok[4][0] != 0) {
299 NTSTATUS status = GUID_from_string(tok[4],
300 &ace->object.object.inherited_type.inherited_type);
301 if (!NT_STATUS_IS_OK(status)) {
304 ace->object.object.flags |= SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT;
309 sid = sddl_decode_sid(mem_ctx, &s, domain_sid);
319 static const struct flag_map acl_flags[] = {
320 { "P", SEC_DESC_DACL_PROTECTED },
321 { "AR", SEC_DESC_DACL_AUTO_INHERIT_REQ },
322 { "AI", SEC_DESC_DACL_AUTO_INHERITED },
329 static struct security_acl *sddl_decode_acl(struct security_descriptor *sd,
330 const char **sddlp, uint32_t *flags,
331 const struct dom_sid *domain_sid)
333 const char *sddl = *sddlp;
334 struct security_acl *acl;
339 acl = talloc_zero(sd, struct security_acl);
340 if (acl == NULL) return NULL;
341 acl->revision = SECURITY_ACL_REVISION_ADS;
343 if (isupper(sddl[0]) && sddl[1] == ':') {
344 /* its an empty ACL */
348 /* work out the ACL flags */
349 if (!sddl_map_flags(acl_flags, sddl, flags, &len)) {
356 while (*sddl == '(') {
358 len = strcspn(sddl+1, ")");
359 astr = talloc_strndup(acl, sddl+1, len);
360 if (astr == NULL || sddl[len+1] != ')') {
364 acl->aces = talloc_realloc(acl, acl->aces, struct security_ace,
366 if (acl->aces == NULL) {
370 if (!sddl_decode_ace(acl->aces, &acl->aces[acl->num_aces],
375 switch (acl->aces[acl->num_aces].type) {
376 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
377 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
378 case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
379 case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
380 acl->revision = SECURITY_ACL_REVISION_ADS;
395 decode a security descriptor in SDDL format
397 struct security_descriptor *sddl_decode(TALLOC_CTX *mem_ctx, const char *sddl,
398 const struct dom_sid *domain_sid)
400 struct security_descriptor *sd;
401 sd = talloc_zero(mem_ctx, struct security_descriptor);
403 sd->revision = SECURITY_DESCRIPTOR_REVISION_1;
404 sd->type = SEC_DESC_SELF_RELATIVE;
409 if (sddl[1] != ':') goto failed;
414 if (sd->dacl != NULL) goto failed;
415 sd->dacl = sddl_decode_acl(sd, &sddl, &flags, domain_sid);
416 if (sd->dacl == NULL) goto failed;
417 sd->type |= flags | SEC_DESC_DACL_PRESENT;
420 if (sd->sacl != NULL) goto failed;
421 sd->sacl = sddl_decode_acl(sd, &sddl, &flags, domain_sid);
422 if (sd->sacl == NULL) goto failed;
423 /* this relies on the SEC_DESC_SACL_* flags being
424 1 bit shifted from the SEC_DESC_DACL_* flags */
425 sd->type |= (flags<<1) | SEC_DESC_SACL_PRESENT;
428 if (sd->owner_sid != NULL) goto failed;
429 sd->owner_sid = sddl_decode_sid(sd, &sddl, domain_sid);
430 if (sd->owner_sid == NULL) goto failed;
433 if (sd->group_sid != NULL) goto failed;
434 sd->group_sid = sddl_decode_sid(sd, &sddl, domain_sid);
435 if (sd->group_sid == NULL) goto failed;
443 DEBUG(2,("Badly formatted SDDL '%s'\n", sddl));
449 turn a set of flags into a string
451 static char *sddl_flags_to_string(TALLOC_CTX *mem_ctx, const struct flag_map *map,
452 uint32_t flags, bool check_all)
457 /* try to find an exact match */
458 for (i=0;map[i].name;i++) {
459 if (map[i].flag == flags) {
460 return talloc_strdup(mem_ctx, map[i].name);
464 s = talloc_strdup(mem_ctx, "");
467 for (i=0;map[i].name;i++) {
468 if ((flags & map[i].flag) != 0) {
469 s = talloc_asprintf_append_buffer(s, "%s", map[i].name);
470 if (s == NULL) goto failed;
471 flags &= ~map[i].flag;
475 if (check_all && flags != 0) {
487 encode a sid in SDDL format
489 static char *sddl_encode_sid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
490 const struct dom_sid *domain_sid)
495 sidstr = dom_sid_string(mem_ctx, sid);
496 if (sidstr == NULL) return NULL;
498 /* seen if its a well known sid */
499 for (i=0;sid_codes[i].sid;i++) {
500 if (strcmp(sidstr, sid_codes[i].sid) == 0) {
502 return talloc_strdup(mem_ctx, sid_codes[i].code);
506 /* or a well known rid in our domain */
507 if (dom_sid_in_domain(domain_sid, sid)) {
508 uint32_t rid = sid->sub_auths[sid->num_auths-1];
509 for (;i<ARRAY_SIZE(sid_codes);i++) {
510 if (rid == sid_codes[i].rid) {
512 return talloc_strdup(mem_ctx, sid_codes[i].code);
519 /* TODO: encode well known sids as two letter codes */
520 return dom_sid_string(mem_ctx, sid);
525 encode an ACE in SDDL format
527 static char *sddl_encode_ace(TALLOC_CTX *mem_ctx, const struct security_ace *ace,
528 const struct dom_sid *domain_sid)
532 struct GUID_txt_buf object_buf, iobject_buf;
533 const char *sddl_type="", *sddl_flags="", *sddl_mask="",
534 *sddl_object="", *sddl_iobject="", *sddl_trustee="";
536 tmp_ctx = talloc_new(mem_ctx);
537 if (tmp_ctx == NULL) {
538 DEBUG(0, ("talloc_new failed\n"));
542 sddl_type = sddl_flags_to_string(tmp_ctx, ace_types, ace->type, true);
543 if (sddl_type == NULL) {
547 sddl_flags = sddl_flags_to_string(tmp_ctx, ace_flags, ace->flags,
549 if (sddl_flags == NULL) {
553 sddl_mask = sddl_flags_to_string(tmp_ctx, ace_access_mask,
554 ace->access_mask, true);
555 if (sddl_mask == NULL) {
556 sddl_mask = talloc_asprintf(tmp_ctx, "0x%08x",
558 if (sddl_mask == NULL) {
563 if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT ||
564 ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT ||
565 ace->type == SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT ||
566 ace->type == SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT) {
567 const struct security_ace_object *object = &ace->object.object;
569 if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
570 sddl_object = GUID_buf_string(
571 &object->type.type, &object_buf);
574 if (ace->object.object.flags &
575 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT) {
576 sddl_iobject = GUID_buf_string(
577 &object->inherited_type.inherited_type,
582 sddl_trustee = sddl_encode_sid(tmp_ctx, &ace->trustee, domain_sid);
583 if (sddl_trustee == NULL) {
587 sddl = talloc_asprintf(mem_ctx, "%s;%s;%s;%s;%s;%s",
588 sddl_type, sddl_flags, sddl_mask, sddl_object,
589 sddl_iobject, sddl_trustee);
592 talloc_free(tmp_ctx);
597 encode an ACL in SDDL format
599 static char *sddl_encode_acl(TALLOC_CTX *mem_ctx, const struct security_acl *acl,
600 uint32_t flags, const struct dom_sid *domain_sid)
605 /* add any ACL flags */
606 sddl = sddl_flags_to_string(mem_ctx, acl_flags, flags, false);
607 if (sddl == NULL) goto failed;
609 /* now the ACEs, encoded in braces */
610 for (i=0;i<acl->num_aces;i++) {
611 char *ace = sddl_encode_ace(sddl, &acl->aces[i], domain_sid);
612 if (ace == NULL) goto failed;
613 sddl = talloc_asprintf_append_buffer(sddl, "(%s)", ace);
614 if (sddl == NULL) goto failed;
627 encode a security descriptor to SDDL format
629 char *sddl_encode(TALLOC_CTX *mem_ctx, const struct security_descriptor *sd,
630 const struct dom_sid *domain_sid)
635 /* start with a blank string */
636 sddl = talloc_strdup(mem_ctx, "");
637 if (sddl == NULL) goto failed;
639 tmp_ctx = talloc_new(mem_ctx);
641 if (sd->owner_sid != NULL) {
642 char *sid = sddl_encode_sid(tmp_ctx, sd->owner_sid, domain_sid);
643 if (sid == NULL) goto failed;
644 sddl = talloc_asprintf_append_buffer(sddl, "O:%s", sid);
645 if (sddl == NULL) goto failed;
648 if (sd->group_sid != NULL) {
649 char *sid = sddl_encode_sid(tmp_ctx, sd->group_sid, domain_sid);
650 if (sid == NULL) goto failed;
651 sddl = talloc_asprintf_append_buffer(sddl, "G:%s", sid);
652 if (sddl == NULL) goto failed;
655 if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl != NULL) {
656 char *acl = sddl_encode_acl(tmp_ctx, sd->dacl, sd->type, domain_sid);
657 if (acl == NULL) goto failed;
658 sddl = talloc_asprintf_append_buffer(sddl, "D:%s", acl);
659 if (sddl == NULL) goto failed;
662 if ((sd->type & SEC_DESC_SACL_PRESENT) && sd->sacl != NULL) {
663 char *acl = sddl_encode_acl(tmp_ctx, sd->sacl, sd->type>>1, domain_sid);
664 if (acl == NULL) goto failed;
665 sddl = talloc_asprintf_append_buffer(sddl, "S:%s", acl);
666 if (sddl == NULL) goto failed;
669 talloc_free(tmp_ctx);