4 Copyright (C) Simo Sorce 2006-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2007
6 Copyright (C) Nadezhda Ivanova 2009
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 * Component: DS Security descriptor module
28 * - Calculate the security descriptor of a newly created object
29 * - Perform sd recalculation on a move operation
30 * - Handle sd modification invariants
32 * Author: Nadezhda Ivanova
36 #include "ldb_module.h"
37 #include "dlinklist.h"
38 #include "dsdb/samdb/samdb.h"
39 #include "librpc/ndr/libndr.h"
40 #include "librpc/gen_ndr/ndr_security.h"
41 #include "libcli/security/security.h"
42 #include "auth/auth.h"
43 #include "param/param.h"
45 struct descriptor_context {
46 struct ldb_module *module;
47 struct ldb_request *req;
48 struct ldb_reply *search_res;
49 int (*step_fn)(struct descriptor_context *);
52 static struct dsdb_class * get_last_structural_class(const struct dsdb_schema *schema, struct ldb_message_element *element)
54 struct dsdb_class *last_class = NULL;
56 for (i = 0; i < element->num_values; i++){
58 last_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &element->values[i]);
60 struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &element->values[i]);
61 if (tmp_class->subClass_order > last_class->subClass_order)
62 last_class = tmp_class;
68 struct dom_sid *get_default_ag(TALLOC_CTX *mem_ctx,
70 struct security_token *token,
71 struct ldb_context *ldb)
73 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
74 struct ldb_dn *root_base_dn = ldb_get_root_basedn(ldb);
75 struct ldb_dn *schema_base_dn = ldb_get_schema_basedn(ldb);
76 struct ldb_dn *config_base_dn = ldb_get_config_basedn(ldb);
77 const struct dom_sid *domain_sid = samdb_domain_sid(ldb);
78 struct dom_sid *da_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_ADMINS);
79 struct dom_sid *ea_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_ENTERPRISE_ADMINS);
80 struct dom_sid *sa_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_SCHEMA_ADMINS);
81 struct dom_sid *dag_sid;
83 if (ldb_dn_compare_base(schema_base_dn, dn) == 0){
84 if (security_token_has_sid(token, sa_sid))
85 dag_sid = dom_sid_dup(mem_ctx, sa_sid);
86 else if (security_token_has_sid(token, ea_sid))
87 dag_sid = dom_sid_dup(mem_ctx, ea_sid);
88 else if (security_token_has_sid(token, da_sid))
89 dag_sid = dom_sid_dup(mem_ctx, da_sid);
93 else if (ldb_dn_compare_base(config_base_dn, dn) == 0){
94 if (security_token_has_sid(token, ea_sid))
95 dag_sid = dom_sid_dup(mem_ctx, ea_sid);
96 else if (security_token_has_sid(token, da_sid))
97 dag_sid = dom_sid_dup(mem_ctx, da_sid);
101 else if (ldb_dn_compare_base(root_base_dn, dn) == 0){
102 if (security_token_has_sid(token, da_sid))
103 dag_sid = dom_sid_dup(mem_ctx, da_sid);
104 else if (security_token_has_sid(token, ea_sid))
105 dag_sid = dom_sid_dup(mem_ctx, ea_sid);
112 talloc_free(tmp_ctx);
116 static struct security_descriptor *get_sd_unpacked(struct ldb_module *module, TALLOC_CTX *mem_ctx,
117 const struct dsdb_class *objectclass)
119 struct ldb_context *ldb = ldb_module_get_ctx(module);
120 struct security_descriptor *sd;
121 const struct dom_sid *domain_sid = samdb_domain_sid(ldb);
123 if (!objectclass->defaultSecurityDescriptor || !domain_sid) {
127 sd = sddl_decode(mem_ctx,
128 objectclass->defaultSecurityDescriptor,
133 static struct dom_sid *get_default_group(TALLOC_CTX *mem_ctx,
134 struct ldb_context *ldb,
137 int *domainFunctionality;
139 domainFunctionality = talloc_get_type(ldb_get_opaque(ldb, "domainFunctionality"), int);
141 if (*domainFunctionality && (*domainFunctionality >= DS_BEHAVIOR_WIN2008)){
148 static DATA_BLOB *get_new_descriptor(struct ldb_module *module,
151 const struct dsdb_class *objectclass,
152 struct ldb_val *parent,
153 struct ldb_val *object)
155 struct security_descriptor *user_descriptor = NULL, *parent_descriptor = NULL;
156 struct security_descriptor *new_sd;
157 DATA_BLOB *linear_sd;
158 enum ndr_err_code ndr_err;
159 struct ldb_context *ldb = ldb_module_get_ctx(module);
160 struct auth_session_info *session_info
161 = ldb_get_opaque(ldb, "sessionInfo");
162 const struct dom_sid *domain_sid = samdb_domain_sid(ldb);
164 struct dom_sid *default_owner;
165 struct dom_sid *default_group;
168 user_descriptor = talloc(mem_ctx, struct security_descriptor);
171 ndr_err = ndr_pull_struct_blob(object, user_descriptor, NULL,
173 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
175 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)){
176 talloc_free(user_descriptor);
181 user_descriptor = get_sd_unpacked(module, mem_ctx, objectclass);
184 parent_descriptor = talloc(mem_ctx, struct security_descriptor);
185 if(!parent_descriptor)
187 ndr_err = ndr_pull_struct_blob(parent, parent_descriptor, NULL,
189 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
191 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)){
192 talloc_free(parent_descriptor);
196 default_owner = get_default_ag(mem_ctx, dn,
197 session_info->security_token, ldb);
198 default_group = get_default_group(mem_ctx, ldb, default_owner);
199 new_sd = create_security_descriptor(mem_ctx, parent_descriptor, user_descriptor, true,
200 NULL, SEC_DACL_AUTO_INHERIT|SEC_SACL_AUTO_INHERIT,
201 session_info->security_token,
202 default_owner, default_group,
203 map_generic_rights_ds);
208 sddl_sd = sddl_encode(mem_ctx, new_sd, domain_sid);
209 DEBUG(10, ("Object %s created with desriptor %s", ldb_dn_get_linearized(dn), sddl_sd));
211 linear_sd = talloc(mem_ctx, DATA_BLOB);
216 ndr_err = ndr_push_struct_blob(linear_sd, mem_ctx,
217 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
219 (ndr_push_flags_fn_t)ndr_push_security_descriptor);
220 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
227 static struct descriptor_context *descriptor_init_context(struct ldb_module *module,
228 struct ldb_request *req)
230 struct ldb_context *ldb;
231 struct descriptor_context *ac;
233 ldb = ldb_module_get_ctx(module);
235 ac = talloc_zero(req, struct descriptor_context);
237 ldb_set_errstring(ldb, "Out of Memory");
246 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
248 struct ldb_context *ldb;
249 struct descriptor_context *ac;
252 ac = talloc_get_type(req->context, struct descriptor_context);
253 ldb = ldb_module_get_ctx(ac->module);
256 return ldb_module_done(ac->req, NULL, NULL,
257 LDB_ERR_OPERATIONS_ERROR);
259 if (ares->error != LDB_SUCCESS &&
260 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
261 return ldb_module_done(ac->req, ares->controls,
262 ares->response, ares->error);
265 switch (ares->type) {
266 case LDB_REPLY_ENTRY:
267 if (ac->search_res != NULL) {
268 ldb_set_errstring(ldb, "Too many results");
270 return ldb_module_done(ac->req, NULL, NULL,
271 LDB_ERR_OPERATIONS_ERROR);
274 ac->search_res = talloc_steal(ac, ares);
277 case LDB_REPLY_REFERRAL:
284 ret = ac->step_fn(ac);
285 if (ret != LDB_SUCCESS) {
286 return ldb_module_done(ac->req, NULL, NULL, ret);
293 static int descriptor_op_callback(struct ldb_request *req, struct ldb_reply *ares)
295 struct descriptor_context *ac;
297 ac = talloc_get_type(req->context, struct descriptor_context);
300 return ldb_module_done(ac->req, NULL, NULL,
301 LDB_ERR_OPERATIONS_ERROR);
303 if (ares->error != LDB_SUCCESS) {
304 return ldb_module_done(ac->req, ares->controls,
305 ares->response, ares->error);
308 if (ares->type != LDB_REPLY_DONE) {
310 return ldb_module_done(ac->req, NULL, NULL,
311 LDB_ERR_OPERATIONS_ERROR);
314 return ldb_module_done(ac->req, ares->controls,
315 ares->response, ares->error);
318 static int descriptor_do_add(struct descriptor_context *ac)
320 struct ldb_context *ldb;
321 const struct dsdb_schema *schema;
322 struct ldb_request *add_req;
323 struct ldb_message_element *objectclass_element, *sd_element = NULL;
324 struct ldb_message *msg;
327 struct ldb_val *sd_val = NULL, *parentsd_val = NULL;
329 struct dsdb_class *objectclass;
331 ldb = ldb_module_get_ctx(ac->module);
332 schema = dsdb_get_schema(ldb);
334 mem_ctx = talloc_new(ac);
335 if (mem_ctx == NULL) {
336 return LDB_ERR_OPERATIONS_ERROR;
339 msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
341 /* get the security descriptor values*/
342 sd_element = ldb_msg_find_element(msg, "nTSecurityDescriptor");
343 objectclass_element = ldb_msg_find_element(msg, "objectClass");
344 objectclass = get_last_structural_class(schema, objectclass_element);
347 return LDB_ERR_OPERATIONS_ERROR;
350 sd_val = &sd_element->values[0];
351 /* NC's have no parent */
352 if ((ldb_dn_compare(msg->dn, (ldb_get_schema_basedn(ldb))) == 0) ||
353 (ldb_dn_compare(msg->dn, (ldb_get_config_basedn(ldb))) == 0) ||
354 (ldb_dn_compare(msg->dn, (ldb_get_root_basedn(ldb))) == 0))
356 else if (ac->search_res != NULL)
357 parentsd_val = ldb_msg_find_ldb_val(ac->search_res->message, "nTSecurityDescriptor");
360 /* get the parent descriptor and the one provided. If not provided, get the default.*/
361 /* convert to security descriptor and calculate */
362 sd = get_new_descriptor(ac->module, msg->dn, mem_ctx, objectclass,
363 parentsd_val, sd_val);
365 ldb_msg_add_steal_value(msg, "nTSecurityDescriptor", sd);
368 talloc_free(mem_ctx);
369 ret = ldb_msg_sanity_check(ldb, msg);
371 if (ret != LDB_SUCCESS) {
375 ret = ldb_build_add_req(&add_req, ldb, ac,
378 ac, descriptor_op_callback,
380 if (ret != LDB_SUCCESS) {
384 /* perform the add */
385 return ldb_next_request(ac->module, add_req);
388 static int descriptor_add(struct ldb_module *module, struct ldb_request *req)
390 struct ldb_context *ldb;
391 struct ldb_request *search_req;
392 struct descriptor_context *ac;
393 struct ldb_dn *parent_dn;
395 static const char * const descr_attrs[] = { "nTSecurityDescriptor", NULL };
397 ldb = ldb_module_get_ctx(module);
399 ldb_debug(ldb, LDB_DEBUG_TRACE, "descriptor_add\n");
401 if (ldb_dn_is_special(req->op.add.message->dn)) {
402 return ldb_next_request(module, req);
405 ac = descriptor_init_context(module, req);
407 return LDB_ERR_OPERATIONS_ERROR;
410 /* If there isn't a parent, just go on to the add processing */
411 if (ldb_dn_get_comp_num(ac->req->op.add.message->dn) == 1) {
412 return descriptor_do_add(ac);
415 /* get copy of parent DN */
416 parent_dn = ldb_dn_get_parent(ac, ac->req->op.add.message->dn);
417 if (parent_dn == NULL) {
419 return LDB_ERR_OPERATIONS_ERROR;
422 ret = ldb_build_search_req(&search_req, ldb,
423 ac, parent_dn, LDB_SCOPE_BASE,
424 "(objectClass=*)", descr_attrs,
426 ac, get_search_callback,
428 if (ret != LDB_SUCCESS) {
431 talloc_steal(search_req, parent_dn);
433 ac->step_fn = descriptor_do_add;
435 return ldb_next_request(ac->module, search_req);
438 static int descriptor_modify(struct ldb_module *module, struct ldb_request *req)
440 struct ldb_context *ldb = ldb_module_get_ctx(module);
441 ldb_debug(ldb, LDB_DEBUG_TRACE, "descriptor_modify\n");
442 return ldb_next_request(module, req);
445 static int descriptor_rename(struct ldb_module *module, struct ldb_request *req)
447 struct ldb_context *ldb = ldb_module_get_ctx(module);
448 ldb_debug(ldb, LDB_DEBUG_TRACE, "descriptor_rename\n");
449 return ldb_next_request(module, req);
452 _PUBLIC_ const struct ldb_module_ops ldb_descriptor_module_ops = {
453 .name = "descriptor",
454 .add = descriptor_add,
455 .modify = descriptor_modify,
456 .rename = descriptor_rename,