4 Copyright (C) Andrew Bartlett 2005
5 Copyright (C) Simo Sorce 2006
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * Component: ldb kludge ACL module
26 * Description: Simple module to enforce a simple form of access
27 * control, sufficient for securing a default Samba4
30 * Author: Andrew Bartlett
34 #include "ldb/include/ldb.h"
35 #include "ldb/include/ldb_errors.h"
36 #include "ldb/include/ldb_private.h"
37 #include "auth/auth.h"
38 #include "libcli/security/security.h"
39 #include "dsdb/samdb/samdb.h"
43 * - System can read passwords
44 * - Administrators can write anything
45 * - Users can read anything that is not a password
56 struct kludge_private_data {
57 const char **password_attrs;
60 static enum user_is what_is_user(struct ldb_module *module)
62 struct auth_session_info *session_info
63 = ldb_get_opaque(module->ldb, "sessionInfo");
68 if (security_token_is_system(session_info->security_token)) {
72 if (security_token_is_anonymous(session_info->security_token)) {
76 if (security_token_has_builtin_administrators(session_info->security_token)) {
80 if (security_token_has_nt_authenticated_users(session_info->security_token)) {
87 static const char *user_name(TALLOC_CTX *mem_ctx, struct ldb_module *module)
89 struct auth_session_info *session_info
90 = ldb_get_opaque(module->ldb, "sessionInfo");
92 return "UNKNOWN (NULL)";
95 return talloc_asprintf(mem_ctx, "%s\\%s",
96 session_info->server_info->domain_name,
97 session_info->server_info->account_name);
101 struct kludge_acl_context {
103 struct ldb_module *module;
105 int (*up_callback)(struct ldb_context *, void *, struct ldb_reply *);
107 enum user_is user_type;
108 bool allowedAttributes;
109 bool allowedAttributesEffective;
113 /* read all objectClasses */
115 static int kludge_acl_allowedAttributes(struct ldb_context *ldb, struct ldb_message *msg,
116 const char *attrName)
118 struct ldb_message_element *oc_el;
119 struct ldb_message_element *allowedAttributes;
120 const struct dsdb_schema *schema = dsdb_get_schema(ldb);
121 const struct dsdb_class *class;
123 ret = ldb_msg_add_empty(msg, attrName, 0, &allowedAttributes);
124 if (ret != LDB_SUCCESS) {
128 /* To ensure that oc_el is valid, we must look for it after
129 we alter the element array in ldb_msg_add_empty() */
130 oc_el = ldb_msg_find_element(msg, "objectClass");
132 for (i=0; i < oc_el->num_values; i++) {
133 class = dsdb_class_by_lDAPDisplayName(schema, (const char *)oc_el->values[i].data);
135 /* We don't know this class? what is going on? */
138 for (j=0; class->mayContain && class->mayContain[j]; j++) {
139 ldb_msg_add_string(msg, attrName, class->mayContain[j]);
141 for (j=0; class->mustContain && class->mustContain[j]; j++) {
142 ldb_msg_add_string(msg, attrName, class->mustContain[j]);
144 for (j=0; class->systemMayContain && class->systemMayContain[j]; j++) {
145 ldb_msg_add_string(msg, attrName, class->systemMayContain[j]);
147 for (j=0; class->systemMustContain && class->systemMustContain[j]; j++) {
148 ldb_msg_add_string(msg, attrName, class->systemMustContain[j]);
152 if (allowedAttributes->num_values > 1) {
153 qsort(allowedAttributes->values,
154 allowedAttributes->num_values,
155 sizeof(*allowedAttributes->values),
156 (comparison_fn_t)data_blob_cmp);
158 for (i=1 ; i < allowedAttributes->num_values; i++) {
159 struct ldb_val *val1 = &allowedAttributes->values[i-1];
160 struct ldb_val *val2 = &allowedAttributes->values[i];
161 if (data_blob_cmp(val1, val2) == 0) {
162 memmove(val1, val2, (allowedAttributes->num_values - i) * sizeof( struct ldb_val));
163 allowedAttributes->num_values--;
173 /* find all attributes allowed by all these objectClasses */
175 static int kludge_acl_callback(struct ldb_context *ldb, void *context, struct ldb_reply *ares)
177 struct kludge_acl_context *ac;
178 struct kludge_private_data *data;
181 if (!context || !ares) {
182 ldb_set_errstring(ldb, "NULL Context or Result in callback");
186 ac = talloc_get_type(context, struct kludge_acl_context);
187 data = talloc_get_type(ac->module->private_data, struct kludge_private_data);
189 if (ares->type != LDB_REPLY_ENTRY) {
190 return ac->up_callback(ldb, ac->up_context, ares);
193 if (ac->allowedAttributes) {
194 ret = kludge_acl_allowedAttributes(ldb, ares->message, "allowedAttributes");
195 if (ret != LDB_SUCCESS) {
200 if (data && data->password_attrs) /* if we are not initialized just get through */
202 switch (ac->user_type) {
205 if (ac->allowedAttributesEffective) {
206 ret = kludge_acl_allowedAttributes(ldb, ares->message, "allowedAttributesEffective");
207 if (ret != LDB_SUCCESS) {
213 /* remove password attributes */
214 for (i = 0; data->password_attrs[i]; i++) {
215 ldb_msg_remove_attr(ares->message, data->password_attrs[i]);
220 if ((ac->allowedAttributes || ac->allowedAttributesEffective) &&
221 (!ldb_attr_in_list(ac->attrs, "objectClass") &&
222 !ldb_attr_in_list(ac->attrs, "*"))) {
223 ldb_msg_remove_attr(ares->message, "objectClass");
226 return ac->up_callback(ldb, ac->up_context, ares);
230 return LDB_ERR_OPERATIONS_ERROR;
233 static int kludge_acl_search(struct ldb_module *module, struct ldb_request *req)
235 struct kludge_acl_context *ac;
236 struct ldb_request *down_req;
237 struct kludge_private_data *data;
242 ac = talloc(req, struct kludge_acl_context);
244 return LDB_ERR_OPERATIONS_ERROR;
247 data = talloc_get_type(module->private_data, struct kludge_private_data);
250 ac->up_context = req->context;
251 ac->up_callback = req->callback;
252 ac->user_type = what_is_user(module);
253 ac->attrs = req->op.search.attrs;
255 down_req = talloc_zero(req, struct ldb_request);
256 if (down_req == NULL) {
257 return LDB_ERR_OPERATIONS_ERROR;
260 down_req->operation = req->operation;
261 down_req->op.search.base = req->op.search.base;
262 down_req->op.search.scope = req->op.search.scope;
263 down_req->op.search.tree = req->op.search.tree;
264 down_req->op.search.attrs = req->op.search.attrs;
266 ac->allowedAttributes = ldb_attr_in_list(req->op.search.attrs, "allowedAttributes");
268 ac->allowedAttributesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedAttributesEffective");
270 if (ac->allowedAttributes || ac->allowedAttributesEffective) {
271 down_req->op.search.attrs
272 = ldb_attr_list_copy_add(down_req, down_req->op.search.attrs, "objectClass");
275 /* FIXME: I hink we should copy the tree and keep the original
277 /* replace any attributes in the parse tree that are private,
278 so we don't allow a search for 'sambaPassword=penguin',
279 just as we would not allow that attribute to be returned */
280 switch (ac->user_type) {
284 /* remove password attributes */
285 for (i = 0; data && data->password_attrs && data->password_attrs[i]; i++) {
286 ldb_parse_tree_attr_replace(down_req->op.search.tree,
287 data->password_attrs[i],
288 "kludgeACLredactedattribute");
292 down_req->controls = req->controls;
294 down_req->context = ac;
295 down_req->callback = kludge_acl_callback;
296 ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
298 /* perform the search */
299 ret = ldb_next_request(module, down_req);
301 /* do not free down_req as the call results may be linked to it,
302 * it will be freed when the upper level request get freed */
303 if (ret == LDB_SUCCESS) {
304 req->handle = down_req->handle;
310 /* ANY change type */
311 static int kludge_acl_change(struct ldb_module *module, struct ldb_request *req)
313 enum user_is user_type = what_is_user(module);
317 return ldb_next_request(module, req);
319 ldb_asprintf_errstring(module->ldb,
320 "kludge_acl_change: "
321 "attempted database modify not permitted. "
322 "User %s is not SYSTEM or an administrator",
323 user_name(req, module));
324 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
328 static int kludge_acl_init(struct ldb_module *module)
331 TALLOC_CTX *mem_ctx = talloc_new(module);
332 static const char *attrs[] = { "passwordAttribute", NULL };
333 struct ldb_result *res;
334 struct ldb_message *msg;
335 struct ldb_message_element *password_attributes;
337 struct kludge_private_data *data;
339 data = talloc(module, struct kludge_private_data);
341 return LDB_ERR_OPERATIONS_ERROR;
344 data->password_attrs = NULL;
345 module->private_data = data;
348 return LDB_ERR_OPERATIONS_ERROR;
351 ret = ldb_search(module->ldb, ldb_dn_new(mem_ctx, module->ldb, "@KLUDGEACL"),
355 if (ret != LDB_SUCCESS) {
358 talloc_steal(mem_ctx, res);
359 if (res->count == 0) {
363 if (res->count > 1) {
364 talloc_free(mem_ctx);
365 return LDB_ERR_CONSTRAINT_VIOLATION;
370 password_attributes = ldb_msg_find_element(msg, "passwordAttribute");
371 if (!password_attributes) {
374 data->password_attrs = talloc_array(data, const char *, password_attributes->num_values + 1);
375 if (!data->password_attrs) {
376 talloc_free(mem_ctx);
377 return LDB_ERR_OPERATIONS_ERROR;
379 for (i=0; i < password_attributes->num_values; i++) {
380 data->password_attrs[i] = (const char *)password_attributes->values[i].data;
381 talloc_steal(data->password_attrs, password_attributes->values[i].data);
383 data->password_attrs[i] = NULL;
386 talloc_free(mem_ctx);
387 return ldb_next_init(module);
390 static const struct ldb_module_ops kludge_acl_ops = {
391 .name = "kludge_acl",
392 .search = kludge_acl_search,
393 .add = kludge_acl_change,
394 .modify = kludge_acl_change,
395 .del = kludge_acl_change,
396 .rename = kludge_acl_change,
397 .extended = kludge_acl_change,
398 .init_context = kludge_acl_init
401 int ldb_kludge_acl_init(void)
403 return ldb_register_module(&kludge_acl_ops);