Mark the places where work needs to be done.
[ira/wip.git] / libgpo / gpo_sec.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Group Policy Object Support
4  *  Copyright (C) Guenther Deschner 2007
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 3 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19
20 #include "includes.h"
21 #include "libcli/security/dom_sid.h"
22 #if _SAMBA_BUILD_ == 4
23 #include "libgpo/ads_convenience.h"
24 #include "librpc/gen_ndr/security.h"
25 #include "librpc/gen_ndr/ndr_misc.h"
26 #include "../libgpo/gpo.h"
27 #endif
28
29 /****************************************************************
30 ****************************************************************/
31
32 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
33 {
34         struct GUID ext_right_apg_guid;
35         NTSTATUS status;
36
37         if (!object) {
38                 return false;
39         }
40
41         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
42                                   &ext_right_apg_guid);
43         if (!NT_STATUS_IS_OK(status)) {
44                 return false;
45         }
46
47         switch (object->flags) {
48                 case SEC_ACE_OBJECT_TYPE_PRESENT:
49                         if (GUID_equal(&object->type.type,
50                                        &ext_right_apg_guid)) {
51                                 return true;
52                         }
53                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
54                         if (GUID_equal(&object->inherited_type.inherited_type,
55                                        &ext_right_apg_guid)) {
56                                 return true;
57                         }
58                 default:
59                         break;
60         }
61
62         return false;
63 }
64
65 /****************************************************************
66 ****************************************************************/
67
68 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
69 {
70         if (!sec_ace_object(ace->type)) {
71                 return false;
72         }
73
74         return gpo_sd_check_agp_object_guid(&ace->object.object);
75 }
76
77 /****************************************************************
78 ****************************************************************/
79
80 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
81 {
82 #if _SAMBA_BUILD_ == 4
83         return (access_mask & SEC_ADS_CONTROL_ACCESS);
84 #else
85         return (access_mask & SEC_RIGHTS_EXTENDED);
86 #endif
87 }
88
89 #if 0
90 /****************************************************************
91 ****************************************************************/
92
93 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
94 {
95         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
96                            SEC_RIGHTS_READ_ALL_PROP |
97                            SEC_RIGHTS_READ_PERMS;
98
99         return (read_bits == (access_mask & read_bits));
100 }
101 #endif
102
103 /****************************************************************
104 ****************************************************************/
105
106 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
107                                                const NT_USER_TOKEN *token)
108 {
109         char *sid_str;
110
111         if (gpo_sd_check_agp_object(ace) &&
112             gpo_sd_check_agp_access_bits(ace->access_mask) &&
113             nt_token_check_sid(&ace->trustee, token)) {
114                 sid_str = dom_sid_string(NULL, &ace->trustee);
115                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
116                         "Access denied as of ace for %s\n",
117                         sid_str));
118                 talloc_free(sid_str);
119                 return NT_STATUS_ACCESS_DENIED;
120         }
121
122         return STATUS_MORE_ENTRIES;
123 }
124
125 /****************************************************************
126 ****************************************************************/
127
128 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
129                                                 const NT_USER_TOKEN *token)
130 {
131         char *sid_str;
132
133         if (gpo_sd_check_agp_object(ace) &&
134             gpo_sd_check_agp_access_bits(ace->access_mask) &&
135             nt_token_check_sid(&ace->trustee, token)) {
136                 sid_str = dom_sid_string(NULL, &ace->trustee);
137                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
138                         "Access granted as of ace for %s\n",
139                         sid_str));
140                 talloc_free(sid_str);
141
142                 return NT_STATUS_OK;
143         }
144
145         return STATUS_MORE_ENTRIES;
146 }
147
148 /****************************************************************
149 ****************************************************************/
150
151 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
152                                  const NT_USER_TOKEN *token)
153 {
154         switch (ace->type) {
155                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
156                         return gpo_sd_check_ace_denied_object(ace, token);
157                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
158                         return gpo_sd_check_ace_allowed_object(ace, token);
159                 default:
160                         return STATUS_MORE_ENTRIES;
161         }
162 }
163
164 /****************************************************************
165 ****************************************************************/
166
167 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
168                                       const NT_USER_TOKEN *token)
169 {
170         struct security_descriptor *sd = gpo->security_descriptor;
171         struct security_acl *dacl = NULL;
172         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
173         int i;
174
175         if (!token) {
176                 return NT_STATUS_INVALID_USER_BUFFER;
177         }
178
179         if (!sd) {
180                 return NT_STATUS_INVALID_SECURITY_DESCR;
181         }
182
183         dacl = sd->dacl;
184         if (!dacl) {
185                 return NT_STATUS_INVALID_SECURITY_DESCR;
186         }
187
188         /* check all aces and only return NT_STATUS_OK (== Access granted) or
189          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
190          * deny access */
191
192         for (i = 0; i < dacl->num_aces; i ++) {
193
194                 status = gpo_sd_check_ace(&dacl->aces[i], token);
195
196                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
197                         return status;
198                 } else if (NT_STATUS_IS_OK(status)) {
199                         return status;
200                 }
201
202                 continue;
203         }
204
205         return NT_STATUS_ACCESS_DENIED;
206 }