Make gpo_ldap.c compatible with samba 4. Add ads_get_ldap_server_name() function...
[ira/wip.git] / libgpo / gpo_sec.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Group Policy Object Support
4  *  Copyright (C) Guenther Deschner 2007
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 3 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19
20 #include "includes.h"
21 #include "librpc/gen_ndr/security.h"
22 #include "librpc/gen_ndr/ndr_misc.h"
23 #include "../libgpo/gpo.h"
24
25 /****************************************************************
26 ****************************************************************/
27
28 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
29 {
30         struct GUID ext_right_apg_guid;
31         NTSTATUS status;
32
33         if (!object) {
34                 return false;
35         }
36
37         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
38                                   &ext_right_apg_guid);
39         if (!NT_STATUS_IS_OK(status)) {
40                 return false;
41         }
42
43         switch (object->flags) {
44                 case SEC_ACE_OBJECT_TYPE_PRESENT:
45                         if (GUID_equal(&object->type.type,
46                                        &ext_right_apg_guid)) {
47                                 return true;
48                         }
49                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
50                         if (GUID_equal(&object->inherited_type.inherited_type,
51                                        &ext_right_apg_guid)) {
52                                 return true;
53                         }
54                 default:
55                         break;
56         }
57
58         return false;
59 }
60
61 /****************************************************************
62 ****************************************************************/
63
64 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
65 {
66         if (!sec_ace_object(ace->type)) {
67                 return false;
68         }
69
70         return gpo_sd_check_agp_object_guid(&ace->object.object);
71 }
72
73 /****************************************************************
74 ****************************************************************/
75
76 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
77 {
78         return (access_mask & SEC_RIGHTS_EXTENDED);
79 }
80
81 #if 0
82 /****************************************************************
83 ****************************************************************/
84
85 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
86 {
87         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
88                            SEC_RIGHTS_READ_ALL_PROP |
89                            SEC_RIGHTS_READ_PERMS;
90
91         return (read_bits == (access_mask & read_bits));
92 }
93 #endif
94
95 /****************************************************************
96 ****************************************************************/
97
98 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
99                                                const struct nt_user_token *token)
100 {
101         if (gpo_sd_check_agp_object(ace) &&
102             gpo_sd_check_agp_access_bits(ace->access_mask) &&
103             nt_token_check_sid(&ace->trustee, token)) {
104                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
105                         "Access denied as of ace for %s\n",
106                         sid_string_dbg(&ace->trustee)));
107                 return NT_STATUS_ACCESS_DENIED;
108         }
109
110         return STATUS_MORE_ENTRIES;
111 }
112
113 /****************************************************************
114 ****************************************************************/
115
116 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
117                                                 const struct nt_user_token *token)
118 {
119         if (gpo_sd_check_agp_object(ace) &&
120             gpo_sd_check_agp_access_bits(ace->access_mask) &&
121             nt_token_check_sid(&ace->trustee, token)) {
122                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
123                         "Access granted as of ace for %s\n",
124                         sid_string_dbg(&ace->trustee)));
125                 return NT_STATUS_OK;
126         }
127
128         return STATUS_MORE_ENTRIES;
129 }
130
131 /****************************************************************
132 ****************************************************************/
133
134 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
135                                  const struct nt_user_token *token)
136 {
137         switch (ace->type) {
138                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
139                         return gpo_sd_check_ace_denied_object(ace, token);
140                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
141                         return gpo_sd_check_ace_allowed_object(ace, token);
142                 default:
143                         return STATUS_MORE_ENTRIES;
144         }
145 }
146
147 /****************************************************************
148 ****************************************************************/
149
150 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
151                                       const struct nt_user_token *token)
152 {
153         struct security_descriptor *sd = gpo->security_descriptor;
154         struct security_acl *dacl = NULL;
155         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
156         int i;
157
158         if (!token) {
159                 return NT_STATUS_INVALID_USER_BUFFER;
160         }
161
162         if (!sd) {
163                 return NT_STATUS_INVALID_SECURITY_DESCR;
164         }
165
166         dacl = sd->dacl;
167         if (!dacl) {
168                 return NT_STATUS_INVALID_SECURITY_DESCR;
169         }
170
171         /* check all aces and only return NT_STATUS_OK (== Access granted) or
172          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
173          * deny access */
174
175         for (i = 0; i < dacl->num_aces; i ++) {
176
177                 status = gpo_sd_check_ace(&dacl->aces[i], token);
178
179                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
180                         return status;
181                 } else if (NT_STATUS_IS_OK(status)) {
182                         return status;
183                 }
184
185                 continue;
186         }
187
188         return NT_STATUS_ACCESS_DENIED;
189 }