4 Copyright (C) Andrew Bartlett 2005
5 Copyright (C) Simo Sorce 2006
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 * Component: ldb kludge ACL module
27 * Description: Simple module to enforce a simple form of access
28 * control, sufficient for securing a default Samba4
31 * Author: Andrew Bartlett
35 #include "ldb/include/ldb.h"
36 #include "ldb/include/ldb_errors.h"
37 #include "ldb/include/ldb_private.h"
38 #include "auth/auth.h"
39 #include "libcli/security/security.h"
40 #include "dsdb/samdb/samdb.h"
44 * - System can read passwords
45 * - Administrators can write anything
46 * - Users can read anything that is not a password
57 struct kludge_private_data {
58 const char **password_attrs;
61 static enum user_is what_is_user(struct ldb_module *module)
63 struct auth_session_info *session_info
64 = ldb_get_opaque(module->ldb, "sessionInfo");
69 if (security_token_is_system(session_info->security_token)) {
73 if (security_token_is_anonymous(session_info->security_token)) {
77 if (security_token_has_builtin_administrators(session_info->security_token)) {
81 if (security_token_has_nt_authenticated_users(session_info->security_token)) {
88 static const char *user_name(TALLOC_CTX *mem_ctx, struct ldb_module *module)
90 struct auth_session_info *session_info
91 = ldb_get_opaque(module->ldb, "sessionInfo");
93 return "UNKNOWN (NULL)";
96 return talloc_asprintf(mem_ctx, "%s\\%s",
97 session_info->server_info->domain_name,
98 session_info->server_info->account_name);
102 struct kludge_acl_context {
104 struct ldb_module *module;
106 int (*up_callback)(struct ldb_context *, void *, struct ldb_reply *);
108 enum user_is user_type;
109 bool allowedAttributes;
110 bool allowedAttributesEffective;
114 /* read all objectClasses */
116 static int kludge_acl_allowedAttributes(struct ldb_context *ldb, struct ldb_message *msg,
117 const char *attrName)
119 struct ldb_message_element *oc_el = ldb_msg_find_element(msg, "objectClass");
120 struct ldb_message_element *allowedAttributes;
121 const struct dsdb_schema *schema = dsdb_get_schema(ldb);
122 const struct dsdb_class *class;
124 ret = ldb_msg_add_empty(msg, attrName, 0, &allowedAttributes);
125 if (ret != LDB_SUCCESS) {
129 for (i=0; i < oc_el->num_values; i++) {
130 class = dsdb_class_by_lDAPDisplayName(schema, (const char *)oc_el->values[i].data);
132 /* We don't know this class? what is going on? */
135 for (j=0; class->mayContain && class->mayContain[j]; j++) {
136 ldb_msg_add_string(msg, attrName, class->mayContain[j]);
138 for (j=0; class->mustContain && class->mustContain[j]; j++) {
139 ldb_msg_add_string(msg, attrName, class->mustContain[j]);
141 for (j=0; class->systemMayContain && class->systemMayContain[j]; j++) {
142 ldb_msg_add_string(msg, attrName, class->systemMayContain[j]);
144 for (j=0; class->systemMustContain && class->systemMustContain[j]; j++) {
145 ldb_msg_add_string(msg, attrName, class->systemMustContain[j]);
149 if (allowedAttributes->num_values > 1) {
150 qsort(allowedAttributes->values,
151 allowedAttributes->num_values,
152 sizeof(*allowedAttributes->values),
155 for (i=1 ; i < allowedAttributes->num_values; i++) {
156 struct ldb_val *val1 = &allowedAttributes->values[i-1];
157 struct ldb_val *val2 = &allowedAttributes->values[i];
158 if (data_blob_cmp(val1, val2) == 0) {
159 memmove(val1, val2, (allowedAttributes->num_values - i) * sizeof( struct ldb_val));
160 allowedAttributes->num_values--;
170 /* find all attributes allowed by all these objectClasses */
172 static int kludge_acl_callback(struct ldb_context *ldb, void *context, struct ldb_reply *ares)
174 struct kludge_acl_context *ac;
175 struct kludge_private_data *data;
178 if (!context || !ares) {
179 ldb_set_errstring(ldb, "NULL Context or Result in callback");
183 ac = talloc_get_type(context, struct kludge_acl_context);
184 data = talloc_get_type(ac->module->private_data, struct kludge_private_data);
186 if (ares->type != LDB_REPLY_ENTRY) {
187 return ac->up_callback(ldb, ac->up_context, ares);
190 if (ac->allowedAttributes) {
191 ret = kludge_acl_allowedAttributes(ldb, ares->message, "allowedAttributes");
192 if (ret != LDB_SUCCESS) {
197 if (data && data->password_attrs) /* if we are not initialized just get through */
199 switch (ac->user_type) {
202 if (ac->allowedAttributesEffective) {
203 ret = kludge_acl_allowedAttributes(ldb, ares->message, "allowedAttributesEffective");
204 if (ret != LDB_SUCCESS) {
210 /* remove password attributes */
211 for (i = 0; data->password_attrs[i]; i++) {
212 ldb_msg_remove_attr(ares->message, data->password_attrs[i]);
217 if ((ac->allowedAttributes || ac->allowedAttributesEffective) &&
218 (!ldb_attr_in_list(ac->attrs, "objectClass") &&
219 !ldb_attr_in_list(ac->attrs, "*"))) {
220 ldb_msg_remove_attr(ares->message, "objectClass");
223 return ac->up_callback(ldb, ac->up_context, ares);
227 return LDB_ERR_OPERATIONS_ERROR;
230 static int kludge_acl_search(struct ldb_module *module, struct ldb_request *req)
232 struct kludge_acl_context *ac;
233 struct ldb_request *down_req;
234 struct kludge_private_data *data;
239 ac = talloc(req, struct kludge_acl_context);
241 return LDB_ERR_OPERATIONS_ERROR;
244 data = talloc_get_type(module->private_data, struct kludge_private_data);
247 ac->up_context = req->context;
248 ac->up_callback = req->callback;
249 ac->user_type = what_is_user(module);
250 ac->attrs = req->op.search.attrs;
252 down_req = talloc_zero(req, struct ldb_request);
253 if (down_req == NULL) {
254 return LDB_ERR_OPERATIONS_ERROR;
257 down_req->operation = req->operation;
258 down_req->op.search.base = req->op.search.base;
259 down_req->op.search.scope = req->op.search.scope;
260 down_req->op.search.tree = req->op.search.tree;
261 down_req->op.search.attrs = req->op.search.attrs;
263 ac->allowedAttributes = ldb_attr_in_list(req->op.search.attrs, "allowedAttributes");
265 ac->allowedAttributesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedAttributesEffective");
267 if (ac->allowedAttributes || ac->allowedAttributesEffective) {
268 down_req->op.search.attrs
269 = ldb_attr_list_copy_add(down_req, down_req->op.search.attrs, "objectClass");
272 /* FIXME: I hink we should copy the tree and keep the original
274 /* replace any attributes in the parse tree that are private,
275 so we don't allow a search for 'sambaPassword=penguin',
276 just as we would not allow that attribute to be returned */
277 switch (ac->user_type) {
281 /* remove password attributes */
282 for (i = 0; data && data->password_attrs && data->password_attrs[i]; i++) {
283 ldb_parse_tree_attr_replace(down_req->op.search.tree,
284 data->password_attrs[i],
285 "kludgeACLredactedattribute");
289 down_req->controls = req->controls;
291 down_req->context = ac;
292 down_req->callback = kludge_acl_callback;
293 ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
295 /* perform the search */
296 ret = ldb_next_request(module, down_req);
298 /* do not free down_req as the call results may be linked to it,
299 * it will be freed when the upper level request get freed */
300 if (ret == LDB_SUCCESS) {
301 req->handle = down_req->handle;
307 /* ANY change type */
308 static int kludge_acl_change(struct ldb_module *module, struct ldb_request *req)
310 enum user_is user_type = what_is_user(module);
314 return ldb_next_request(module, req);
316 ldb_asprintf_errstring(module->ldb,
317 "kludge_acl_change: "
318 "attempted database modify not permitted. "
319 "User %s is not SYSTEM or an administrator",
320 user_name(req, module));
321 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
325 static int kludge_acl_init(struct ldb_module *module)
328 TALLOC_CTX *mem_ctx = talloc_new(module);
329 static const char *attrs[] = { "passwordAttribute", NULL };
330 struct ldb_result *res;
331 struct ldb_message *msg;
332 struct ldb_message_element *password_attributes;
334 struct kludge_private_data *data;
336 data = talloc(module, struct kludge_private_data);
338 return LDB_ERR_OPERATIONS_ERROR;
341 data->password_attrs = NULL;
342 module->private_data = data;
345 return LDB_ERR_OPERATIONS_ERROR;
348 ret = ldb_search(module->ldb, ldb_dn_new(mem_ctx, module->ldb, "@KLUDGEACL"),
352 if (ret != LDB_SUCCESS) {
355 talloc_steal(mem_ctx, res);
356 if (res->count == 0) {
360 if (res->count > 1) {
361 talloc_free(mem_ctx);
362 return LDB_ERR_CONSTRAINT_VIOLATION;
367 password_attributes = ldb_msg_find_element(msg, "passwordAttribute");
368 if (!password_attributes) {
371 data->password_attrs = talloc_array(data, const char *, password_attributes->num_values + 1);
372 if (!data->password_attrs) {
373 talloc_free(mem_ctx);
374 return LDB_ERR_OPERATIONS_ERROR;
376 for (i=0; i < password_attributes->num_values; i++) {
377 data->password_attrs[i] = (const char *)password_attributes->values[i].data;
378 talloc_steal(data->password_attrs, password_attributes->values[i].data);
380 data->password_attrs[i] = NULL;
383 talloc_free(mem_ctx);
384 return ldb_next_init(module);
387 static const struct ldb_module_ops kludge_acl_ops = {
388 .name = "kludge_acl",
389 .search = kludge_acl_search,
390 .add = kludge_acl_change,
391 .modify = kludge_acl_change,
392 .del = kludge_acl_change,
393 .rename = kludge_acl_change,
394 .extended = kludge_acl_change,
395 .init_context = kludge_acl_init
398 int ldb_kludge_acl_init(void)
400 return ldb_register_module(&kludge_acl_ops);