auth: add SeDiskOperatorsPrivilege to get_root_nt_token to fix registry shares.
[ira/wip.git] / source3 / auth / token_util.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Authentication utility functions
4  *  Copyright (C) Andrew Tridgell 1992-1998
5  *  Copyright (C) Andrew Bartlett 2001
6  *  Copyright (C) Jeremy Allison 2000-2001
7  *  Copyright (C) Rafal Szczesniak 2002
8  *  Copyright (C) Volker Lendecke 2006
9  *  Copyright (C) Michael Adam 2007
10  *
11  *  This program is free software; you can redistribute it and/or modify
12  *  it under the terms of the GNU General Public License as published by
13  *  the Free Software Foundation; either version 3 of the License, or
14  *  (at your option) any later version.
15  *
16  *  This program is distributed in the hope that it will be useful,
17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19  *  GNU General Public License for more details.
20  *
21  *  You should have received a copy of the GNU General Public License
22  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
23  */
24
25 /* functions moved from auth/auth_util.c to minimize linker deps */
26
27 #include "includes.h"
28
29 /****************************************************************************
30  Check for a SID in an NT_USER_TOKEN
31 ****************************************************************************/
32
33 bool nt_token_check_sid ( const DOM_SID *sid, const NT_USER_TOKEN *token )
34 {
35         int i;
36
37         if ( !sid || !token )
38                 return False;
39
40         for ( i=0; i<token->num_sids; i++ ) {
41                 if ( sid_equal( sid, &token->user_sids[i] ) )
42                         return True;
43         }
44
45         return False;
46 }
47
48 bool nt_token_check_domain_rid( NT_USER_TOKEN *token, uint32 rid )
49 {
50         DOM_SID domain_sid;
51
52         /* if we are a domain member, the get the domain SID, else for
53            a DC or standalone server, use our own SID */
54
55         if ( lp_server_role() == ROLE_DOMAIN_MEMBER ) {
56                 if ( !secrets_fetch_domain_sid( lp_workgroup(),
57                                                 &domain_sid ) ) {
58                         DEBUG(1,("nt_token_check_domain_rid: Cannot lookup "
59                                  "SID for domain [%s]\n", lp_workgroup()));
60                         return False;
61                 }
62         }
63         else
64                 sid_copy( &domain_sid, get_global_sam_sid() );
65
66         sid_append_rid( &domain_sid, rid );
67
68         return nt_token_check_sid( &domain_sid, token );\
69 }
70
71 /******************************************************************************
72  Create a token for the root user to be used internally by smbd.
73  This is similar to running under the context of the LOCAL_SYSTEM account
74  in Windows.  This is a read-only token.  Do not modify it or free() it.
75  Create a copy if your need to change it.
76 ******************************************************************************/
77
78 NT_USER_TOKEN *get_root_nt_token( void )
79 {
80         struct nt_user_token *token = NULL;
81         DOM_SID u_sid, g_sid;
82         struct passwd *pw;
83         void *cache_data;
84
85         cache_data = memcache_lookup_talloc(
86                 NULL, SINGLETON_CACHE_TALLOC,
87                 data_blob_string_const("root_nt_token"));
88
89         if (cache_data != NULL) {
90                 return talloc_get_type_abort(
91                         cache_data, struct nt_user_token);
92         }
93
94         if ( !(pw = sys_getpwnam( "root" )) ) {
95                 DEBUG(0,("get_root_nt_token: getpwnam(\"root\") failed!\n"));
96                 return NULL;
97         }
98
99         /* get the user and primary group SIDs; although the
100            BUILTIN\Administrators SId is really the one that matters here */
101
102         uid_to_sid(&u_sid, pw->pw_uid);
103         gid_to_sid(&g_sid, pw->pw_gid);
104
105         token = create_local_nt_token(NULL, &u_sid, False,
106                                       1, &global_sid_Builtin_Administrators);
107
108         token->privileges = se_disk_operators;
109
110         memcache_add_talloc(
111                 NULL, SINGLETON_CACHE_TALLOC,
112                 data_blob_string_const("root_nt_token"), token);
113
114         return token;
115 }
116
117
118 /*
119  * Add alias SIDs from memberships within the partially created token SID list
120  */
121
122 NTSTATUS add_aliases(const DOM_SID *domain_sid,
123                      struct nt_user_token *token)
124 {
125         uint32 *aliases;
126         size_t i, num_aliases;
127         NTSTATUS status;
128         TALLOC_CTX *tmp_ctx;
129
130         if (!(tmp_ctx = talloc_init("add_aliases"))) {
131                 return NT_STATUS_NO_MEMORY;
132         }
133
134         aliases = NULL;
135         num_aliases = 0;
136
137         status = pdb_enum_alias_memberships(tmp_ctx, domain_sid,
138                                             token->user_sids,
139                                             token->num_sids,
140                                             &aliases, &num_aliases);
141
142         if (!NT_STATUS_IS_OK(status)) {
143                 DEBUG(10, ("pdb_enum_alias_memberships failed: %s\n",
144                            nt_errstr(status)));
145                 goto done;
146         }
147
148         for (i=0; i<num_aliases; i++) {
149                 DOM_SID alias_sid;
150                 sid_compose(&alias_sid, domain_sid, aliases[i]);
151                 status = add_sid_to_array_unique(token, &alias_sid,
152                                                  &token->user_sids,
153                                                  &token->num_sids);
154                 if (!NT_STATUS_IS_OK(status)) {
155                         DEBUG(0, ("add_sid_to_array failed\n"));
156                         goto done;
157                 }
158         }
159
160 done:
161         TALLOC_FREE(tmp_ctx);
162         return NT_STATUS_OK;
163 }
164
165 /*******************************************************************
166 *******************************************************************/
167
168 static NTSTATUS add_builtin_administrators( struct nt_user_token *token )
169 {
170         DOM_SID domadm;
171         NTSTATUS status;
172
173         /* nothing to do if we aren't in a domain */
174
175         if ( !(IS_DC || lp_server_role()==ROLE_DOMAIN_MEMBER) ) {
176                 return NT_STATUS_OK;
177         }
178
179         /* Find the Domain Admins SID */
180
181         if ( IS_DC ) {
182                 sid_copy( &domadm, get_global_sam_sid() );
183         } else {
184                 if ( !secrets_fetch_domain_sid( lp_workgroup(), &domadm ) )
185                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
186         }
187         sid_append_rid( &domadm, DOMAIN_GROUP_RID_ADMINS );
188
189         /* Add Administrators if the user beloongs to Domain Admins */
190
191         if ( nt_token_check_sid( &domadm, token ) ) {
192                 status = add_sid_to_array(token,
193                                           &global_sid_Builtin_Administrators,
194                                           &token->user_sids, &token->num_sids);
195         if (!NT_STATUS_IS_OK(status)) {
196                         return status;
197                 }
198         }
199
200         return NT_STATUS_OK;
201 }
202
203 /*******************************************************************
204 *******************************************************************/
205
206 static NTSTATUS create_builtin_users( void )
207 {
208         NTSTATUS status;
209         DOM_SID dom_users;
210
211         status = pdb_create_builtin_alias( BUILTIN_ALIAS_RID_USERS );
212         if ( !NT_STATUS_IS_OK(status) ) {
213                 DEBUG(0,("create_builtin_users: Failed to create Users\n"));
214                 return status;
215         }
216
217         /* add domain users */
218         if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
219                 && secrets_fetch_domain_sid(lp_workgroup(), &dom_users))
220         {
221                 sid_append_rid(&dom_users, DOMAIN_GROUP_RID_USERS );
222                 status = pdb_add_aliasmem( &global_sid_Builtin_Users, &dom_users);
223                 if ( !NT_STATUS_IS_OK(status) ) {
224                         DEBUG(0,("create_builtin_administrators: Failed to add Domain Users to"
225                                 " Users\n"));
226                         return status;
227                 }
228         }
229
230         return NT_STATUS_OK;
231 }
232
233 /*******************************************************************
234 *******************************************************************/
235
236 static NTSTATUS create_builtin_administrators( void )
237 {
238         NTSTATUS status;
239         DOM_SID dom_admins, root_sid;
240         fstring root_name;
241         enum lsa_SidType type;
242         TALLOC_CTX *ctx;
243         bool ret;
244
245         status = pdb_create_builtin_alias( BUILTIN_ALIAS_RID_ADMINS );
246         if ( !NT_STATUS_IS_OK(status) ) {
247                 DEBUG(0,("create_builtin_administrators: Failed to create Administrators\n"));
248                 return status;
249         }
250
251         /* add domain admins */
252         if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
253                 && secrets_fetch_domain_sid(lp_workgroup(), &dom_admins))
254         {
255                 sid_append_rid(&dom_admins, DOMAIN_GROUP_RID_ADMINS);
256                 status = pdb_add_aliasmem( &global_sid_Builtin_Administrators, &dom_admins );
257                 if ( !NT_STATUS_IS_OK(status) ) {
258                         DEBUG(0,("create_builtin_administrators: Failed to add Domain Admins"
259                                 " Administrators\n"));
260                         return status;
261                 }
262         }
263
264         /* add root */
265         if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
266                 return NT_STATUS_NO_MEMORY;
267         }
268         fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
269         ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
270                           &root_sid, &type);
271         TALLOC_FREE( ctx );
272
273         if ( ret ) {
274                 status = pdb_add_aliasmem( &global_sid_Builtin_Administrators, &root_sid );
275                 if ( !NT_STATUS_IS_OK(status) ) {
276                         DEBUG(0,("create_builtin_administrators: Failed to add root"
277                                 " Administrators\n"));
278                         return status;
279                 }
280         }
281
282         return NT_STATUS_OK;
283 }
284
285
286 /*******************************************************************
287  Create a NT token for the user, expanding local aliases
288 *******************************************************************/
289
290 struct nt_user_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
291                                             const DOM_SID *user_sid,
292                                             bool is_guest,
293                                             int num_groupsids,
294                                             const DOM_SID *groupsids)
295 {
296         struct nt_user_token *result = NULL;
297         int i;
298         NTSTATUS status;
299         gid_t gid;
300
301         DEBUG(10, ("Create local NT token for %s\n",
302                    sid_string_dbg(user_sid)));
303
304         if (!(result = TALLOC_ZERO_P(mem_ctx, struct nt_user_token))) {
305                 DEBUG(0, ("talloc failed\n"));
306                 return NULL;
307         }
308
309         /* Add the user and primary group sid */
310
311         status = add_sid_to_array(result, user_sid,
312                                   &result->user_sids, &result->num_sids);
313         if (!NT_STATUS_IS_OK(status)) {
314                 return NULL;
315         }
316
317         /* For guest, num_groupsids may be zero. */
318         if (num_groupsids) {
319                 status = add_sid_to_array(result, &groupsids[0],
320                                           &result->user_sids,
321                                           &result->num_sids);
322                 if (!NT_STATUS_IS_OK(status)) {
323                         return NULL;
324                 }
325         }
326
327         /* Add in BUILTIN sids */
328
329         status = add_sid_to_array(result, &global_sid_World,
330                                   &result->user_sids, &result->num_sids);
331         if (!NT_STATUS_IS_OK(status)) {
332                 return NULL;
333         }
334         status = add_sid_to_array(result, &global_sid_Network,
335                                   &result->user_sids, &result->num_sids);
336         if (!NT_STATUS_IS_OK(status)) {
337                 return NULL;
338         }
339
340         if (is_guest) {
341                 status = add_sid_to_array(result, &global_sid_Builtin_Guests,
342                                           &result->user_sids,
343                                           &result->num_sids);
344                 if (!NT_STATUS_IS_OK(status)) {
345                         return NULL;
346                 }
347         } else {
348                 status = add_sid_to_array(result,
349                                           &global_sid_Authenticated_Users,
350                                           &result->user_sids,
351                                           &result->num_sids);
352                 if (!NT_STATUS_IS_OK(status)) {
353                         return NULL;
354                 }
355         }
356
357         /* Now the SIDs we got from authentication. These are the ones from
358          * the info3 struct or from the pdb_enum_group_memberships, depending
359          * on who authenticated the user.
360          * Note that we start the for loop at "1" here, we already added the
361          * first group sid as primary above. */
362
363         for (i=1; i<num_groupsids; i++) {
364                 status = add_sid_to_array_unique(result, &groupsids[i],
365                                                  &result->user_sids,
366                                                  &result->num_sids);
367                 if (!NT_STATUS_IS_OK(status)) {
368                         return NULL;
369                 }
370         }
371
372         /* Deal with the BUILTIN\Administrators group.  If the SID can
373            be resolved then assume that the add_aliasmem( S-1-5-32 )
374            handled it. */
375
376         if ( !sid_to_gid( &global_sid_Builtin_Administrators, &gid ) ) {
377                 /* We can only create a mapping if winbind is running
378                    and the nested group functionality has been enabled */
379
380                 if ( lp_winbind_nested_groups() && winbind_ping() ) {
381                         become_root();
382                         status = create_builtin_administrators( );
383                         if ( !NT_STATUS_IS_OK(status) ) {
384                                 DEBUG(2,("create_local_nt_token: Failed to create BUILTIN\\Administrators group!\n"));
385                                 /* don't fail, just log the message */
386                         }
387                         unbecome_root();
388                 }
389                 else {
390                         status = add_builtin_administrators( result );
391                         if ( !NT_STATUS_IS_OK(status) ) {
392                                 /* just log a complaint but do not fail */
393                                 DEBUG(3,("create_local_nt_token: failed to check for local Administrators"
394                                         " membership (%s)\n", nt_errstr(status)));
395                         }
396                 }
397         }
398
399         /* Deal with the BUILTIN\Users group.  If the SID can
400            be resolved then assume that the add_aliasmem( S-1-5-32 )
401            handled it. */
402
403         if ( !sid_to_gid( &global_sid_Builtin_Users, &gid ) ) {
404                 /* We can only create a mapping if winbind is running
405                    and the nested group functionality has been enabled */
406
407                 if ( lp_winbind_nested_groups() && winbind_ping() ) {
408                         become_root();
409                         status = create_builtin_users( );
410                         if ( !NT_STATUS_IS_OK(status) ) {
411                                 DEBUG(2,("create_local_nt_token: Failed to create BUILTIN\\Users group!\n"));
412                                 /* don't fail, just log the message */
413                         }
414                         unbecome_root();
415                 }
416         }
417
418         /* Deal with local groups */
419
420         if (lp_winbind_nested_groups()) {
421
422                 become_root();
423
424                 /* Now add the aliases. First the one from our local SAM */
425
426                 status = add_aliases(get_global_sam_sid(), result);
427
428                 if (!NT_STATUS_IS_OK(status)) {
429                         unbecome_root();
430                         TALLOC_FREE(result);
431                         return NULL;
432                 }
433
434                 /* Finally the builtin ones */
435
436                 status = add_aliases(&global_sid_Builtin, result);
437
438                 if (!NT_STATUS_IS_OK(status)) {
439                         unbecome_root();
440                         TALLOC_FREE(result);
441                         return NULL;
442                 }
443
444                 unbecome_root();
445         }
446
447
448         get_privileges_for_sids(&result->privileges, result->user_sids,
449                                 result->num_sids);
450         return result;
451 }
452
453 /****************************************************************************
454  prints a NT_USER_TOKEN to debug output.
455 ****************************************************************************/
456
457 void debug_nt_user_token(int dbg_class, int dbg_lev, NT_USER_TOKEN *token)
458 {
459         size_t     i;
460
461         if (!token) {
462                 DEBUGC(dbg_class, dbg_lev, ("NT user token: (NULL)\n"));
463                 return;
464         }
465
466         DEBUGC(dbg_class, dbg_lev,
467                ("NT user token of user %s\n",
468                 sid_string_dbg(&token->user_sids[0]) ));
469         DEBUGADDC(dbg_class, dbg_lev,
470                   ("contains %lu SIDs\n", (unsigned long)token->num_sids));
471         for (i = 0; i < token->num_sids; i++)
472                 DEBUGADDC(dbg_class, dbg_lev,
473                           ("SID[%3lu]: %s\n", (unsigned long)i,
474                            sid_string_dbg(&token->user_sids[i])));
475
476         dump_se_priv( dbg_class, dbg_lev, &token->privileges );
477 }
478
479 /****************************************************************************
480  prints a UNIX 'token' to debug output.
481 ****************************************************************************/
482
483 void debug_unix_user_token(int dbg_class, int dbg_lev, uid_t uid, gid_t gid,
484                            int n_groups, gid_t *groups)
485 {
486         int     i;
487         DEBUGC(dbg_class, dbg_lev,
488                ("UNIX token of user %ld\n", (long int)uid));
489
490         DEBUGADDC(dbg_class, dbg_lev,
491                   ("Primary group is %ld and contains %i supplementary "
492                    "groups\n", (long int)gid, n_groups));
493         for (i = 0; i < n_groups; i++)
494                 DEBUGADDC(dbg_class, dbg_lev, ("Group[%3i]: %ld\n", i,
495                         (long int)groups[i]));
496 }
497
498 /* END */