4 Copyright (C) Andrew Bartlett 2005
5 Copyright (C) Simo Sorce 2006
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * Component: ldb kludge ACL module
26 * Description: Simple module to enforce a simple form of access
27 * control, sufficient for securing a default Samba4
30 * Author: Andrew Bartlett
34 #include "ldb/include/ldb.h"
35 #include "ldb/include/ldb_errors.h"
36 #include "ldb/include/ldb_private.h"
37 #include "auth/auth.h"
38 #include "libcli/security/security.h"
39 #include "dsdb/samdb/samdb.h"
43 * - System can read passwords
44 * - Administrators can write anything
45 * - Users can read anything that is not a password
56 struct kludge_private_data {
57 const char **password_attrs;
60 static enum user_is what_is_user(struct ldb_module *module)
62 struct auth_session_info *session_info
63 = (struct auth_session_info *)ldb_get_opaque(module->ldb, "sessionInfo");
68 if (security_token_is_system(session_info->security_token)) {
72 if (security_token_is_anonymous(session_info->security_token)) {
76 if (security_token_has_builtin_administrators(session_info->security_token)) {
80 if (security_token_has_nt_authenticated_users(session_info->security_token)) {
87 static const char *user_name(TALLOC_CTX *mem_ctx, struct ldb_module *module)
89 struct auth_session_info *session_info
90 = (struct auth_session_info *)ldb_get_opaque(module->ldb, "sessionInfo");
92 return "UNKNOWN (NULL)";
95 return talloc_asprintf(mem_ctx, "%s\\%s",
96 session_info->server_info->domain_name,
97 session_info->server_info->account_name);
101 struct kludge_acl_context {
103 struct ldb_module *module;
105 int (*up_callback)(struct ldb_context *, void *, struct ldb_reply *);
107 enum user_is user_type;
108 bool allowedAttributes;
109 bool allowedAttributesEffective;
110 bool allowedChildClasses;
111 bool allowedChildClassesEffective;
115 /* read all objectClasses */
117 static int kludge_acl_allowedAttributes(struct ldb_context *ldb, struct ldb_message *msg,
118 const char *attrName)
120 struct ldb_message_element *oc_el;
121 struct ldb_message_element *allowedAttributes;
122 const struct dsdb_schema *schema = dsdb_get_schema(ldb);
123 const struct dsdb_class *class;
126 /* If we don't have a schema yet, we can't do anything... */
127 if (schema == NULL) {
131 /* Must remove any existing attribute, or else confusion reins */
132 ldb_msg_remove_attr(msg, attrName);
133 ret = ldb_msg_add_empty(msg, attrName, 0, &allowedAttributes);
134 if (ret != LDB_SUCCESS) {
138 /* To ensure that oc_el is valid, we must look for it after
139 we alter the element array in ldb_msg_add_empty() */
140 oc_el = ldb_msg_find_element(msg, "objectClass");
142 for (i=0; oc_el && i < oc_el->num_values; i++) {
143 class = dsdb_class_by_lDAPDisplayName(schema, (const char *)oc_el->values[i].data);
145 /* We don't know this class? what is going on? */
149 for (j=0; class->mayContain && class->mayContain[j]; j++) {
150 ldb_msg_add_string(msg, attrName, class->mayContain[j]);
152 for (j=0; class->mustContain && class->mustContain[j]; j++) {
153 ldb_msg_add_string(msg, attrName, class->mustContain[j]);
155 for (j=0; class->systemMayContain && class->systemMayContain[j]; j++) {
156 ldb_msg_add_string(msg, attrName, class->systemMayContain[j]);
158 for (j=0; class->systemMustContain && class->systemMustContain[j]; j++) {
159 ldb_msg_add_string(msg, attrName, class->systemMustContain[j]);
163 if (allowedAttributes->num_values > 1) {
164 qsort(allowedAttributes->values,
165 allowedAttributes->num_values,
166 sizeof(*allowedAttributes->values),
167 (comparison_fn_t)data_blob_cmp);
169 for (i=1 ; i < allowedAttributes->num_values; i++) {
170 struct ldb_val *val1 = &allowedAttributes->values[i-1];
171 struct ldb_val *val2 = &allowedAttributes->values[i];
172 if (data_blob_cmp(val1, val2) == 0) {
173 memmove(val1, val2, (allowedAttributes->num_values - i) * sizeof( struct ldb_val));
174 allowedAttributes->num_values--;
183 /* read all objectClasses */
185 static int kludge_acl_childClasses(struct ldb_context *ldb, struct ldb_message *msg,
186 const char *attrName)
188 struct ldb_message_element *oc_el;
189 struct ldb_message_element *allowedClasses;
190 const struct dsdb_schema *schema = dsdb_get_schema(ldb);
191 const struct dsdb_class *class;
194 /* If we don't have a schema yet, we can't do anything... */
195 if (schema == NULL) {
199 /* Must remove any existing attribute, or else confusion reins */
200 ldb_msg_remove_attr(msg, attrName);
201 ret = ldb_msg_add_empty(msg, attrName, 0, &allowedClasses);
202 if (ret != LDB_SUCCESS) {
206 /* To ensure that oc_el is valid, we must look for it after
207 we alter the element array in ldb_msg_add_empty() */
208 oc_el = ldb_msg_find_element(msg, "objectClass");
210 for (i=0; oc_el && i < oc_el->num_values; i++) {
211 class = dsdb_class_by_lDAPDisplayName(schema, (const char *)oc_el->values[i].data);
213 /* We don't know this class? what is going on? */
217 for (j=0; class->possibleInferiors && class->possibleInferiors[j]; j++) {
218 ldb_msg_add_string(msg, attrName, class->possibleInferiors[j]);
222 if (allowedClasses->num_values > 1) {
223 qsort(allowedClasses->values,
224 allowedClasses->num_values,
225 sizeof(*allowedClasses->values),
226 (comparison_fn_t)data_blob_cmp);
228 for (i=1 ; i < allowedClasses->num_values; i++) {
229 struct ldb_val *val1 = &allowedClasses->values[i-1];
230 struct ldb_val *val2 = &allowedClasses->values[i];
231 if (data_blob_cmp(val1, val2) == 0) {
232 memmove(val1, val2, (allowedClasses->num_values - i) * sizeof( struct ldb_val));
233 allowedClasses->num_values--;
243 /* find all attributes allowed by all these objectClasses */
245 static int kludge_acl_callback(struct ldb_context *ldb, void *context, struct ldb_reply *ares)
247 struct kludge_acl_context *ac;
248 struct kludge_private_data *data;
251 ac = talloc_get_type(context, struct kludge_acl_context);
252 data = talloc_get_type(ac->module->private_data, struct kludge_private_data);
254 if (ares->type != LDB_REPLY_ENTRY) {
255 return ac->up_callback(ldb, ac->up_context, ares);
258 if (ac->allowedAttributes) {
259 ret = kludge_acl_allowedAttributes(ldb, ares->message, "allowedAttributes");
260 if (ret != LDB_SUCCESS) {
265 if (ac->allowedChildClasses) {
266 ret = kludge_acl_childClasses(ldb, ares->message, "allowedChildClasses");
267 if (ret != LDB_SUCCESS) {
272 if (data && data->password_attrs) /* if we are not initialized just get through */
274 switch (ac->user_type) {
277 if (ac->allowedAttributesEffective) {
278 ret = kludge_acl_allowedAttributes(ldb, ares->message, "allowedAttributesEffective");
279 if (ret != LDB_SUCCESS) {
283 if (ac->allowedChildClassesEffective) {
284 ret = kludge_acl_childClasses(ldb, ares->message, "allowedChildClassesEffective");
285 if (ret != LDB_SUCCESS) {
291 /* remove password attributes */
292 for (i = 0; data->password_attrs[i]; i++) {
293 ldb_msg_remove_attr(ares->message, data->password_attrs[i]);
298 if ((ac->allowedAttributes || ac->allowedAttributesEffective
299 || ac->allowedChildClasses || ac->allowedChildClassesEffective) &&
300 (!ldb_attr_in_list(ac->attrs, "objectClass") &&
301 !ldb_attr_in_list(ac->attrs, "*"))) {
302 ldb_msg_remove_attr(ares->message, "objectClass");
305 return ac->up_callback(ldb, ac->up_context, ares);
308 static int kludge_acl_search(struct ldb_module *module, struct ldb_request *req)
310 struct kludge_acl_context *ac;
311 struct ldb_request *down_req;
312 struct kludge_private_data *data;
317 ac = talloc(req, struct kludge_acl_context);
319 return LDB_ERR_OPERATIONS_ERROR;
322 data = talloc_get_type(module->private_data, struct kludge_private_data);
325 ac->up_context = req->context;
326 ac->up_callback = req->callback;
327 ac->user_type = what_is_user(module);
328 ac->attrs = req->op.search.attrs;
330 down_req = talloc_zero(req, struct ldb_request);
331 if (down_req == NULL) {
332 return LDB_ERR_OPERATIONS_ERROR;
335 down_req->operation = req->operation;
336 down_req->op.search.base = req->op.search.base;
337 down_req->op.search.scope = req->op.search.scope;
338 down_req->op.search.tree = req->op.search.tree;
339 down_req->op.search.attrs = req->op.search.attrs;
341 ac->allowedAttributes = ldb_attr_in_list(req->op.search.attrs, "allowedAttributes");
343 ac->allowedAttributesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedAttributesEffective");
345 ac->allowedChildClasses = ldb_attr_in_list(req->op.search.attrs, "allowedChildClasses");
347 ac->allowedChildClassesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedChildClassesEffective");
349 if (ac->allowedAttributes || ac->allowedAttributesEffective || ac->allowedChildClasses || ac->allowedChildClassesEffective) {
350 down_req->op.search.attrs
351 = ldb_attr_list_copy_add(down_req, down_req->op.search.attrs, "objectClass");
354 /* FIXME: I hink we should copy the tree and keep the original
356 /* replace any attributes in the parse tree that are private,
357 so we don't allow a search for 'sambaPassword=penguin',
358 just as we would not allow that attribute to be returned */
359 switch (ac->user_type) {
363 /* remove password attributes */
364 for (i = 0; data && data->password_attrs && data->password_attrs[i]; i++) {
365 ldb_parse_tree_attr_replace(down_req->op.search.tree,
366 data->password_attrs[i],
367 "kludgeACLredactedattribute");
371 down_req->controls = req->controls;
373 down_req->context = ac;
374 down_req->callback = kludge_acl_callback;
375 ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
377 /* perform the search */
378 ret = ldb_next_request(module, down_req);
380 /* do not free down_req as the call results may be linked to it,
381 * it will be freed when the upper level request get freed */
382 if (ret == LDB_SUCCESS) {
383 req->handle = down_req->handle;
389 /* ANY change type */
390 static int kludge_acl_change(struct ldb_module *module, struct ldb_request *req)
392 enum user_is user_type = what_is_user(module);
396 return ldb_next_request(module, req);
398 ldb_asprintf_errstring(module->ldb,
399 "kludge_acl_change: "
400 "attempted database modify not permitted. "
401 "User %s is not SYSTEM or an administrator",
402 user_name(req, module));
403 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
407 static int kludge_acl_init(struct ldb_module *module)
410 TALLOC_CTX *mem_ctx = talloc_new(module);
411 const char *attrs[] = { "passwordAttribute", NULL };
412 struct ldb_result *res;
413 struct ldb_message *msg;
414 struct ldb_message_element *password_attributes;
416 struct kludge_private_data *data;
418 data = talloc(module, struct kludge_private_data);
420 return LDB_ERR_OPERATIONS_ERROR;
423 data->password_attrs = NULL;
424 module->private_data = data;
427 return LDB_ERR_OPERATIONS_ERROR;
430 ret = ldb_search(module->ldb, ldb_dn_new(mem_ctx, module->ldb, "@KLUDGEACL"),
434 if (ret != LDB_SUCCESS) {
437 talloc_steal(mem_ctx, res);
438 if (res->count == 0) {
442 if (res->count > 1) {
443 talloc_free(mem_ctx);
444 return LDB_ERR_CONSTRAINT_VIOLATION;
449 password_attributes = ldb_msg_find_element(msg, "passwordAttribute");
450 if (!password_attributes) {
453 data->password_attrs = talloc_array(data, const char *, password_attributes->num_values + 1);
454 if (!data->password_attrs) {
455 talloc_free(mem_ctx);
456 return LDB_ERR_OPERATIONS_ERROR;
458 for (i=0; i < password_attributes->num_values; i++) {
459 data->password_attrs[i] = (const char *)password_attributes->values[i].data;
460 talloc_steal(data->password_attrs, password_attributes->values[i].data);
462 data->password_attrs[i] = NULL;
465 talloc_free(mem_ctx);
466 return ldb_next_init(module);
469 static const struct ldb_module_ops kludge_acl_ops = {
470 .name = "kludge_acl",
471 .search = kludge_acl_search,
472 .add = kludge_acl_change,
473 .modify = kludge_acl_change,
474 .del = kludge_acl_change,
475 .rename = kludge_acl_change,
476 .extended = kludge_acl_change,
477 .init_context = kludge_acl_init
480 int ldb_kludge_acl_init(void)
482 return ldb_register_module(&kludge_acl_ops);