libgpo: fix the build of gpext plugins.
[ira/wip.git] / libgpo / gpo_sec.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Group Policy Object Support
4  *  Copyright (C) Guenther Deschner 2007
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 3 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19
20 #include "includes.h"
21 #include "libcli/security/dom_sid.h"
22 #if _SAMBA_BUILD_ == 4
23 #include "libgpo/ads_convenience.h"
24 #include "librpc/gen_ndr/security.h"
25 #include "librpc/gen_ndr/ndr_misc.h"
26 #include "../libcli/security/secace.h"
27 #include "../libgpo/gpo.h"
28 #endif
29
30 /****************************************************************
31 ****************************************************************/
32
33 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
34 {
35         struct GUID ext_right_apg_guid;
36         NTSTATUS status;
37
38         if (!object) {
39                 return false;
40         }
41
42         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
43                                   &ext_right_apg_guid);
44         if (!NT_STATUS_IS_OK(status)) {
45                 return false;
46         }
47
48         switch (object->flags) {
49                 case SEC_ACE_OBJECT_TYPE_PRESENT:
50                         if (GUID_equal(&object->type.type,
51                                        &ext_right_apg_guid)) {
52                                 return true;
53                         }
54                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
55                         if (GUID_equal(&object->inherited_type.inherited_type,
56                                        &ext_right_apg_guid)) {
57                                 return true;
58                         }
59                 default:
60                         break;
61         }
62
63         return false;
64 }
65
66 /****************************************************************
67 ****************************************************************/
68
69 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
70 {
71         if (!sec_ace_object(ace->type)) {
72                 return false;
73         }
74
75         return gpo_sd_check_agp_object_guid(&ace->object.object);
76 }
77
78 /****************************************************************
79 ****************************************************************/
80
81 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
82 {
83 #if _SAMBA_BUILD_ == 4
84         return (access_mask & SEC_ADS_CONTROL_ACCESS);
85 #else
86         return (access_mask & SEC_RIGHTS_EXTENDED);
87 #endif
88 }
89
90 #if 0
91 /****************************************************************
92 ****************************************************************/
93
94 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
95 {
96         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
97                            SEC_RIGHTS_READ_ALL_PROP |
98                            SEC_RIGHTS_READ_PERMS;
99
100         return (read_bits == (access_mask & read_bits));
101 }
102 #endif
103
104 /****************************************************************
105 ****************************************************************/
106
107 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
108                                                const NT_USER_TOKEN *token)
109 {
110         char *sid_str;
111
112         if (gpo_sd_check_agp_object(ace) &&
113             gpo_sd_check_agp_access_bits(ace->access_mask) &&
114             nt_token_check_sid(&ace->trustee, token)) {
115                 sid_str = dom_sid_string(NULL, &ace->trustee);
116                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
117                         "Access denied as of ace for %s\n",
118                         sid_str));
119                 talloc_free(sid_str);
120                 return NT_STATUS_ACCESS_DENIED;
121         }
122
123         return STATUS_MORE_ENTRIES;
124 }
125
126 /****************************************************************
127 ****************************************************************/
128
129 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
130                                                 const NT_USER_TOKEN *token)
131 {
132         char *sid_str;
133
134         if (gpo_sd_check_agp_object(ace) &&
135             gpo_sd_check_agp_access_bits(ace->access_mask) &&
136             nt_token_check_sid(&ace->trustee, token)) {
137                 sid_str = dom_sid_string(NULL, &ace->trustee);
138                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
139                         "Access granted as of ace for %s\n",
140                         sid_str));
141                 talloc_free(sid_str);
142
143                 return NT_STATUS_OK;
144         }
145
146         return STATUS_MORE_ENTRIES;
147 }
148
149 /****************************************************************
150 ****************************************************************/
151
152 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
153                                  const NT_USER_TOKEN *token)
154 {
155         switch (ace->type) {
156                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
157                         return gpo_sd_check_ace_denied_object(ace, token);
158                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
159                         return gpo_sd_check_ace_allowed_object(ace, token);
160                 default:
161                         return STATUS_MORE_ENTRIES;
162         }
163 }
164
165 /****************************************************************
166 ****************************************************************/
167
168 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
169                                       const NT_USER_TOKEN *token)
170 {
171         struct security_descriptor *sd = gpo->security_descriptor;
172         struct security_acl *dacl = NULL;
173         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
174         int i;
175
176         if (!token) {
177                 return NT_STATUS_INVALID_USER_BUFFER;
178         }
179
180         if (!sd) {
181                 return NT_STATUS_INVALID_SECURITY_DESCR;
182         }
183
184         dacl = sd->dacl;
185         if (!dacl) {
186                 return NT_STATUS_INVALID_SECURITY_DESCR;
187         }
188
189         /* check all aces and only return NT_STATUS_OK (== Access granted) or
190          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
191          * deny access */
192
193         for (i = 0; i < dacl->num_aces; i ++) {
194
195                 status = gpo_sd_check_ace(&dacl->aces[i], token);
196
197                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
198                         return status;
199                 } else if (NT_STATUS_IS_OK(status)) {
200                         return status;
201                 }
202
203                 continue;
204         }
205
206         return NT_STATUS_ACCESS_DENIED;
207 }