libcli/security/security_descriptor.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    security descriptror utility functions
   5
   6    Copyright (C) Andrew Tridgell                2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/security/security.h"
  24
  25 /*
  26   return a blank security descriptor (no owners, dacl or sacl)
  27 */
  28 struct security_descriptor *security_descriptor_initialise(TALLOC_CTX *mem_ctx)
  29 {
  30         struct security_descriptor *sd;
  31
  32         sd = talloc(mem_ctx, struct security_descriptor);
  33         if (!sd) {
  34                 return NULL;
  35         }
  36
  37         sd->revision = SD_REVISION;
  38         /* we mark as self relative, even though it isn't while it remains
  39            a pointer in memory because this simplifies the ndr code later.
  40            All SDs that we store/emit are in fact SELF_RELATIVE
  41         */
  42         sd->type = SEC_DESC_SELF_RELATIVE;
  43
  44         sd->owner_sid = NULL;
  45         sd->group_sid = NULL;
  46         sd->sacl = NULL;
  47         sd->dacl = NULL;
  48
  49         return sd;
  50 }
  51
  52 struct security_acl *security_acl_dup(TALLOC_CTX *mem_ctx,
  53                                              const struct security_acl *oacl)
  54 {
  55         struct security_acl *nacl;
  56
  57         if (oacl == NULL) {
  58                 return NULL;
  59         }
  60
  61         if (oacl->aces == NULL && oacl->num_aces > 0) {
  62                 return NULL;
  63         }
  64
  65         nacl = talloc (mem_ctx, struct security_acl);
  66         if (nacl == NULL) {
  67                 return NULL;
  68         }
  69
  70         nacl->aces = (struct security_ace *)talloc_memdup (nacl, oacl->aces, sizeof(struct security_ace) * oacl->num_aces);
  71         if ((nacl->aces == NULL) && (oacl->num_aces > 0)) {
  72                 goto failed;
  73         }
  74
  75         nacl->revision = oacl->revision;
  76         nacl->size = oacl->size;
  77         nacl->num_aces = oacl->num_aces;
  78
  79         return nacl;
  80
  81  failed:
  82         talloc_free (nacl);
  83         return NULL;
  84
  85 }
  86
  87 struct security_acl *security_acl_concatenate(TALLOC_CTX *mem_ctx,
  88                                               const struct security_acl *acl1,
  89                                               const struct security_acl *acl2)
  90 {
  91         struct security_acl *nacl;
  92         uint32_t i;
  93
  94         if (!acl1 && !acl2)
  95                 return NULL;
  96
  97         if (!acl1){
  98                 nacl = security_acl_dup(mem_ctx, acl2);
  99                 return nacl;
 100         }
 101
 102         if (!acl2){
 103                 nacl = security_acl_dup(mem_ctx, acl1);
 104                 return nacl;
 105         }
 106
 107         nacl = talloc (mem_ctx, struct security_acl);
 108         if (nacl == NULL) {
 109                 return NULL;
 110         }
 111
 112         nacl->revision = acl1->revision;
 113         nacl->size = acl1->size + acl2->size;
 114         nacl->num_aces = acl1->num_aces + acl2->num_aces;
 115
 116         if (nacl->num_aces == 0)
 117                 return nacl;
 118
 119         nacl->aces = (struct security_ace *)talloc_array (mem_ctx, struct security_ace, acl1->num_aces+acl2->num_aces);
 120         if ((nacl->aces == NULL) && (nacl->num_aces > 0)) {
 121                 goto failed;
 122         }
 123
 124         for (i = 0; i < acl1->num_aces; i++)
 125                 nacl->aces[i] = acl1->aces[i];
 126         for (i = 0; i < acl2->num_aces; i++)
 127                 nacl->aces[i + acl1->num_aces] = acl2->aces[i];
 128
 129         return nacl;
 130
 131  failed:
 132         talloc_free (nacl);
 133         return NULL;
 134
 135 }
 136
 137 /*
 138    talloc and copy a security descriptor
 139  */
 140 struct security_descriptor *security_descriptor_copy(TALLOC_CTX *mem_ctx,
 141                                                      const struct security_descriptor *osd)
 142 {
 143         struct security_descriptor *nsd;
 144
 145         nsd = talloc_zero(mem_ctx, struct security_descriptor);
 146         if (!nsd) {
 147                 return NULL;
 148         }
 149
 150         if (osd->owner_sid) {
 151                 nsd->owner_sid = dom_sid_dup(nsd, osd->owner_sid);
 152                 if (nsd->owner_sid == NULL) {
 153                         goto failed;
 154                 }
 155         }
 156
 157         if (osd->group_sid) {
 158                 nsd->group_sid = dom_sid_dup(nsd, osd->group_sid);
 159                 if (nsd->group_sid == NULL) {
 160                         goto failed;
 161                 }
 162         }
 163
 164         if (osd->sacl) {
 165                 nsd->sacl = security_acl_dup(nsd, osd->sacl);
 166                 if (nsd->sacl == NULL) {
 167                         goto failed;
 168                 }
 169         }
 170
 171         if (osd->dacl) {
 172                 nsd->dacl = security_acl_dup(nsd, osd->dacl);
 173                 if (nsd->dacl == NULL) {
 174                         goto failed;
 175                 }
 176         }
 177
 178         nsd->revision = osd->revision;
 179         nsd->type = osd->type;
 180
 181         return nsd;
 182
 183  failed:
 184         talloc_free(nsd);
 185
 186         return NULL;
 187 }
 188
 189 NTSTATUS security_descriptor_for_client(TALLOC_CTX *mem_ctx,
 190                                         const struct security_descriptor *ssd,
 191                                         uint32_t sec_info,
 192                                         uint32_t access_granted,
 193                                         struct security_descriptor **_csd)
 194 {
 195         struct security_descriptor *csd = NULL;
 196         uint32_t access_required = 0;
 197
 198         *_csd = NULL;
 199
 200         if (sec_info & (SECINFO_OWNER|SECINFO_GROUP)) {
 201                 access_required |= SEC_STD_READ_CONTROL;
 202         }
 203         if (sec_info & SECINFO_DACL) {
 204                 access_required |= SEC_STD_READ_CONTROL;
 205         }
 206         if (sec_info & SECINFO_SACL) {
 207                 access_required |= SEC_FLAG_SYSTEM_SECURITY;
 208         }
 209
 210         if (access_required & (~access_granted)) {
 211                 return NT_STATUS_ACCESS_DENIED;
 212         }
 213
 214         /*
 215          * make a copy...
 216          */
 217         csd = security_descriptor_copy(mem_ctx, ssd);
 218         if (csd == NULL) {
 219                 return NT_STATUS_NO_MEMORY;
 220         }
 221
 222         /*
 223          * ... and remove everthing not wanted
 224          */
 225
 226         if (!(sec_info & SECINFO_OWNER)) {
 227                 TALLOC_FREE(csd->owner_sid);
 228                 csd->type &= ~SEC_DESC_OWNER_DEFAULTED;
 229         }
 230         if (!(sec_info & SECINFO_GROUP)) {
 231                 TALLOC_FREE(csd->group_sid);
 232                 csd->type &= ~SEC_DESC_GROUP_DEFAULTED;
 233         }
 234         if (!(sec_info & SECINFO_DACL)) {
 235                 TALLOC_FREE(csd->dacl);
 236                 csd->type &= ~(
 237                         SEC_DESC_DACL_PRESENT |
 238                         SEC_DESC_DACL_DEFAULTED|
 239                         SEC_DESC_DACL_AUTO_INHERIT_REQ |
 240                         SEC_DESC_DACL_AUTO_INHERITED |
 241                         SEC_DESC_DACL_PROTECTED |
 242                         SEC_DESC_DACL_TRUSTED);
 243         }
 244         if (!(sec_info & SECINFO_SACL)) {
 245                 TALLOC_FREE(csd->sacl);
 246                 csd->type &= ~(
 247                         SEC_DESC_SACL_PRESENT |
 248                         SEC_DESC_SACL_DEFAULTED |
 249                         SEC_DESC_SACL_AUTO_INHERIT_REQ |
 250                         SEC_DESC_SACL_AUTO_INHERITED |
 251                         SEC_DESC_SACL_PROTECTED |
 252                         SEC_DESC_SERVER_SECURITY);
 253         }
 254
 255         *_csd = csd;
 256         return NT_STATUS_OK;
 257 }
 258
 259 /*
 260   add an ACE to an ACL of a security_descriptor
 261 */
 262
 263 static NTSTATUS security_descriptor_acl_add(struct security_descriptor *sd,
 264                                             bool add_to_sacl,
 265                                             const struct security_ace *ace)
 266 {
 267         struct security_acl *acl = NULL;
 268
 269         if (add_to_sacl) {
 270                 acl = sd->sacl;
 271         } else {
 272                 acl = sd->dacl;
 273         }
 274
 275         if (acl == NULL) {
 276                 acl = talloc(sd, struct security_acl);
 277                 if (acl == NULL) {
 278                         return NT_STATUS_NO_MEMORY;
 279                 }
 280                 acl->revision = SECURITY_ACL_REVISION_NT4;
 281                 acl->size     = 0;
 282                 acl->num_aces = 0;
 283                 acl->aces     = NULL;
 284         }
 285
 286         acl->aces = talloc_realloc(acl, acl->aces,
 287                                    struct security_ace, acl->num_aces+1);
 288         if (acl->aces == NULL) {
 289                 return NT_STATUS_NO_MEMORY;
 290         }
 291
 292         acl->aces[acl->num_aces] = *ace;
 293
 294         switch (acl->aces[acl->num_aces].type) {
 295         case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 296         case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 297         case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
 298         case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
 299                 acl->revision = SECURITY_ACL_REVISION_ADS;
 300                 break;
 301         default:
 302                 break;
 303         }
 304
 305         acl->num_aces++;
 306
 307         if (add_to_sacl) {
 308                 sd->sacl = acl;
 309                 sd->type |= SEC_DESC_SACL_PRESENT;
 310         } else {
 311                 sd->dacl = acl;
 312                 sd->type |= SEC_DESC_DACL_PRESENT;
 313         }
 314
 315         return NT_STATUS_OK;
 316 }
 317
 318 /*
 319   add an ACE to the SACL of a security_descriptor
 320 */
 321
 322 NTSTATUS security_descriptor_sacl_add(struct security_descriptor *sd,
 323                                       const struct security_ace *ace)
 324 {
 325         return security_descriptor_acl_add(sd, true, ace);
 326 }
 327
 328 /*
 329   add an ACE to the DACL of a security_descriptor
 330 */
 331
 332 NTSTATUS security_descriptor_dacl_add(struct security_descriptor *sd,
 333                                       const struct security_ace *ace)
 334 {
 335         return security_descriptor_acl_add(sd, false, ace);
 336 }
 337
 338 /*
 339   delete the ACE corresponding to the given trustee in an ACL of a
 340   security_descriptor
 341 */
 342
 343 static NTSTATUS security_descriptor_acl_del(struct security_descriptor *sd,
 344                                             bool sacl_del,
 345                                             const struct dom_sid *trustee)
 346 {
 347         uint32_t i;
 348         bool found = false;
 349         struct security_acl *acl = NULL;
 350
 351         if (sacl_del) {
 352                 acl = sd->sacl;
 353         } else {
 354                 acl = sd->dacl;
 355         }
 356
 357         if (acl == NULL) {
 358                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 359         }
 360
 361         /* there can be multiple ace's for one trustee */
 362         for (i=0;i<acl->num_aces;i++) {
 363                 if (dom_sid_equal(trustee, &acl->aces[i].trustee)) {
 364                         memmove(&acl->aces[i], &acl->aces[i+1],
 365                                 sizeof(acl->aces[i]) * (acl->num_aces - (i+1)));
 366                         acl->num_aces--;
 367                         if (acl->num_aces == 0) {
 368                                 acl->aces = NULL;
 369                         }
 370                         found = true;
 371                 }
 372         }
 373
 374         if (!found) {
 375                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 376         }
 377
 378         acl->revision = SECURITY_ACL_REVISION_NT4;
 379
 380         for (i=0;i<acl->num_aces;i++) {
 381                 switch (acl->aces[i].type) {
 382                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 383                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 384                 case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
 385                 case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
 386                         acl->revision = SECURITY_ACL_REVISION_ADS;
 387                         return NT_STATUS_OK;
 388                 default:
 389                         break; /* only for the switch statement */
 390                 }
 391         }
 392
 393         return NT_STATUS_OK;
 394 }
 395
 396 /*
 397   delete the ACE corresponding to the given trustee in the DACL of a
 398   security_descriptor
 399 */
 400
 401 NTSTATUS security_descriptor_dacl_del(struct security_descriptor *sd,
 402                                       const struct dom_sid *trustee)
 403 {
 404         return security_descriptor_acl_del(sd, false, trustee);
 405 }
 406
 407 /*
 408   delete the ACE corresponding to the given trustee in the SACL of a
 409   security_descriptor
 410 */
 411
 412 NTSTATUS security_descriptor_sacl_del(struct security_descriptor *sd,
 413                                       const struct dom_sid *trustee)
 414 {
 415         return security_descriptor_acl_del(sd, true, trustee);
 416 }
 417
 418 /*
 419   compare two security ace structures
 420 */
 421 bool security_ace_equal(const struct security_ace *ace1,
 422                         const struct security_ace *ace2)
 423 {
 424         if (ace1 == ace2) {
 425                 return true;
 426         }
 427         if ((ace1 == NULL) || (ace2 == NULL)) {
 428                 return false;
 429         }
 430         if (ace1->type != ace2->type) {
 431                 return false;
 432         }
 433         if (ace1->flags != ace2->flags) {
 434                 return false;
 435         }
 436         if (ace1->access_mask != ace2->access_mask) {
 437                 return false;
 438         }
 439         if (!dom_sid_equal(&ace1->trustee, &ace2->trustee)) {
 440                 return false;
 441         }
 442
 443         return true;
 444 }
 445
 446
 447 /*
 448   compare two security acl structures
 449 */
 450 bool security_acl_equal(const struct security_acl *acl1,
 451                         const struct security_acl *acl2)
 452 {
 453         uint32_t i;
 454
 455         if (acl1 == acl2) return true;
 456         if (!acl1 || !acl2) return false;
 457         if (acl1->revision != acl2->revision) return false;
 458         if (acl1->num_aces != acl2->num_aces) return false;
 459
 460         for (i=0;i<acl1->num_aces;i++) {
 461                 if (!security_ace_equal(&acl1->aces[i], &acl2->aces[i])) return false;
 462         }
 463         return true;
 464 }
 465
 466 /*
 467   compare two security descriptors.
 468 */
 469 bool security_descriptor_equal(const struct security_descriptor *sd1,
 470                                const struct security_descriptor *sd2)
 471 {
 472         if (sd1 == sd2) return true;
 473         if (!sd1 || !sd2) return false;
 474         if (sd1->revision != sd2->revision) return false;
 475         if (sd1->type != sd2->type) return false;
 476
 477         if (!dom_sid_equal(sd1->owner_sid, sd2->owner_sid)) return false;
 478         if (!dom_sid_equal(sd1->group_sid, sd2->group_sid)) return false;
 479         if (!security_acl_equal(sd1->sacl, sd2->sacl))      return false;
 480         if (!security_acl_equal(sd1->dacl, sd2->dacl))      return false;
 481
 482         return true;
 483 }
 484
 485 /*
 486   compare two security descriptors, but allow certain (missing) parts
 487   to be masked out of the comparison
 488 */
 489 bool security_descriptor_mask_equal(const struct security_descriptor *sd1,
 490                                     const struct security_descriptor *sd2,
 491                                     uint32_t mask)
 492 {
 493         if (sd1 == sd2) return true;
 494         if (!sd1 || !sd2) return false;
 495         if (sd1->revision != sd2->revision) return false;
 496         if ((sd1->type & mask) != (sd2->type & mask)) return false;
 497
 498         if (!dom_sid_equal(sd1->owner_sid, sd2->owner_sid)) return false;
 499         if (!dom_sid_equal(sd1->group_sid, sd2->group_sid)) return false;
 500         if ((mask & SEC_DESC_DACL_PRESENT) && !security_acl_equal(sd1->dacl, sd2->dacl))      return false;
 501         if ((mask & SEC_DESC_SACL_PRESENT) && !security_acl_equal(sd1->sacl, sd2->sacl))      return false;
 502
 503         return true;
 504 }
 505
 506
 507 static struct security_descriptor *security_descriptor_appendv(struct security_descriptor *sd,
 508                                                                bool add_ace_to_sacl,
 509                                                                va_list ap)
 510 {
 511         const char *sidstr;
 512
 513         while ((sidstr = va_arg(ap, const char *))) {
 514                 struct dom_sid *sid;
 515                 struct security_ace *ace = talloc_zero(sd, struct security_ace);
 516                 NTSTATUS status;
 517
 518                 if (ace == NULL) {
 519                         talloc_free(sd);
 520                         return NULL;
 521                 }
 522                 ace->type = va_arg(ap, unsigned int);
 523                 ace->access_mask = va_arg(ap, unsigned int);
 524                 ace->flags = va_arg(ap, unsigned int);
 525                 sid = dom_sid_parse_talloc(ace, sidstr);
 526                 if (sid == NULL) {
 527                         talloc_free(sd);
 528                         return NULL;
 529                 }
 530                 ace->trustee = *sid;
 531                 if (add_ace_to_sacl) {
 532                         status = security_descriptor_sacl_add(sd, ace);
 533                 } else {
 534                         status = security_descriptor_dacl_add(sd, ace);
 535                 }
 536                 /* TODO: check: would talloc_free(ace) here be correct? */
 537                 if (!NT_STATUS_IS_OK(status)) {
 538                         talloc_free(sd);
 539                         return NULL;
 540                 }
 541         }
 542
 543         return sd;
 544 }
 545
 546 struct security_descriptor *security_descriptor_append(struct security_descriptor *sd,
 547                                                        ...)
 548 {
 549         va_list ap;
 550
 551         va_start(ap, sd);
 552         sd = security_descriptor_appendv(sd, false, ap);
 553         va_end(ap);
 554
 555         return sd;
 556 }
 557
 558 static struct security_descriptor *security_descriptor_createv(TALLOC_CTX *mem_ctx,
 559                                                                uint16_t sd_type,
 560                                                                const char *owner_sid,
 561                                                                const char *group_sid,
 562                                                                bool add_ace_to_sacl,
 563                                                                va_list ap)
 564 {
 565         struct security_descriptor *sd;
 566
 567         sd = security_descriptor_initialise(mem_ctx);
 568         if (sd == NULL) {
 569                 return NULL;
 570         }
 571
 572         sd->type |= sd_type;
 573
 574         if (owner_sid) {
 575                 sd->owner_sid = dom_sid_parse_talloc(sd, owner_sid);
 576                 if (sd->owner_sid == NULL) {
 577                         talloc_free(sd);
 578                         return NULL;
 579                 }
 580         }
 581         if (group_sid) {
 582                 sd->group_sid = dom_sid_parse_talloc(sd, group_sid);
 583                 if (sd->group_sid == NULL) {
 584                         talloc_free(sd);
 585                         return NULL;
 586                 }
 587         }
 588
 589         return security_descriptor_appendv(sd, add_ace_to_sacl, ap);
 590 }
 591
 592 /*
 593   create a security descriptor using string SIDs. This is used by the
 594   torture code to allow the easy creation of complex ACLs
 595   This is a varargs function. The list of DACL ACEs ends with a NULL sid.
 596
 597   Each ACE contains a set of 4 parameters:
 598   SID, ACCESS_TYPE, MASK, FLAGS
 599
 600   a typical call would be:
 601
 602     sd = security_descriptor_dacl_create(mem_ctx,
 603                                          sd_type_flags,
 604                                          mysid,
 605                                          mygroup,
 606                                          SID_NT_AUTHENTICATED_USERS,
 607                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
 608                                          SEC_FILE_ALL,
 609                                          SEC_ACE_FLAG_OBJECT_INHERIT,
 610                                          NULL);
 611   that would create a sd with one DACL ACE
 612 */
 613
 614 struct security_descriptor *security_descriptor_dacl_create(TALLOC_CTX *mem_ctx,
 615                                                             uint16_t sd_type,
 616                                                             const char *owner_sid,
 617                                                             const char *group_sid,
 618                                                             ...)
 619 {
 620         struct security_descriptor *sd = NULL;
 621         va_list ap;
 622         va_start(ap, group_sid);
 623         sd = security_descriptor_createv(mem_ctx, sd_type, owner_sid,
 624                                          group_sid, false, ap);
 625         va_end(ap);
 626
 627         return sd;
 628 }
 629
 630 struct security_descriptor *security_descriptor_sacl_create(TALLOC_CTX *mem_ctx,
 631                                                             uint16_t sd_type,
 632                                                             const char *owner_sid,
 633                                                             const char *group_sid,
 634                                                             ...)
 635 {
 636         struct security_descriptor *sd = NULL;
 637         va_list ap;
 638         va_start(ap, group_sid);
 639         sd = security_descriptor_createv(mem_ctx, sd_type, owner_sid,
 640                                          group_sid, true, ap);
 641         va_end(ap);
 642
 643         return sd;
 644 }
 645
 646 struct security_ace *security_ace_create(TALLOC_CTX *mem_ctx,
 647                                          const char *sid_str,
 648                                          enum security_ace_type type,
 649                                          uint32_t access_mask,
 650                                          uint8_t flags)
 651
 652 {
 653         struct security_ace *ace;
 654         bool ok;
 655
 656         ace = talloc_zero(mem_ctx, struct security_ace);
 657         if (ace == NULL) {
 658                 return NULL;
 659         }
 660
 661         ok = dom_sid_parse(sid_str, &ace->trustee);
 662         if (!ok) {
 663                 talloc_free(ace);
 664                 return NULL;
 665         }
 666         ace->type = type;
 667         ace->access_mask = access_mask;
 668         ace->flags = flags;
 669
 670         return ace;
 671 }
 672
 673 /*******************************************************************
 674  Check for MS NFS ACEs in a sd
 675 *******************************************************************/
 676 bool security_descriptor_with_ms_nfs(const struct security_descriptor *psd)
 677 {
 678         int i;
 679
 680         if (psd->dacl == NULL) {
 681                 return false;
 682         }
 683
 684         for (i = 0; i < psd->dacl->num_aces; i++) {
 685                 if (dom_sid_compare_domain(
 686                             &global_sid_Unix_NFS,
 687                             &psd->dacl->aces[i].trustee) == 0) {
 688                         return true;
 689                 }
 690         }
 691
 692         return false;
 693 }