2 Unix SMB/CIFS implementation.
4 security access checking routines
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libcli/security/security.h"
27 perform a SEC_FLAG_MAXIMUM_ALLOWED access check
29 static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
30 const struct security_token *token)
32 uint32_t denied = 0, granted = 0;
35 if (security_token_has_sid(token, sd->owner_sid)) {
36 granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL | SEC_STD_DELETE;
37 } else if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
38 granted |= SEC_STD_DELETE;
41 if (sd->dacl == NULL) {
42 return granted & ~denied;
45 for (i = 0;i<sd->dacl->num_aces; i++) {
46 struct security_ace *ace = &sd->dacl->aces[i];
48 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
52 if (!security_token_has_sid(token, &ace->trustee)) {
57 case SEC_ACE_TYPE_ACCESS_ALLOWED:
58 granted |= ace->access_mask;
60 case SEC_ACE_TYPE_ACCESS_DENIED:
61 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
62 denied |= ace->access_mask;
64 default: /* Other ACE types not handled/supported */
69 return granted & ~denied;
72 static const struct GUID *get_ace_object_type(struct security_ace *ace)
76 if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT)
77 type = &ace->object.object.type.type;
78 else if (ace->object.object.flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)
79 type = &ace->object.object.inherited_type.inherited_type; /* This doesn't look right. Is something wrong with the IDL? */
88 the main entry point for access checking.
90 NTSTATUS sec_access_check(const struct security_descriptor *sd,
91 const struct security_token *token,
92 uint32_t access_desired,
93 uint32_t *access_granted)
96 uint32_t bits_remaining;
98 *access_granted = access_desired;
99 bits_remaining = access_desired;
101 /* handle the maximum allowed flag */
102 if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
103 access_desired |= access_check_max_allowed(sd, token);
104 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
105 *access_granted = access_desired;
106 bits_remaining = access_desired & ~SEC_STD_DELETE;
109 if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
110 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
111 bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
113 return NT_STATUS_PRIVILEGE_NOT_HELD;
117 /* a NULL dacl allows access */
118 if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
119 *access_granted = access_desired;
123 /* the owner always gets SEC_STD_WRITE_DAC, SEC_STD_READ_CONTROL and SEC_STD_DELETE */
124 if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE)) &&
125 security_token_has_sid(token, sd->owner_sid)) {
126 bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE);
128 if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
129 security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
130 bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
132 if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
133 security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
134 bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
137 if (sd->dacl == NULL) {
141 /* check each ace in turn. */
142 for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
143 struct security_ace *ace = &sd->dacl->aces[i];
145 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
149 if (!security_token_has_sid(token, &ace->trustee)) {
154 case SEC_ACE_TYPE_ACCESS_ALLOWED:
155 bits_remaining &= ~ace->access_mask;
157 case SEC_ACE_TYPE_ACCESS_DENIED:
158 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
159 if (bits_remaining & ace->access_mask) {
160 return NT_STATUS_ACCESS_DENIED;
163 default: /* Other ACE types not handled/supported */
169 if (bits_remaining != 0) {
170 return NT_STATUS_ACCESS_DENIED;
176 /* modified access check for the purposes of DS security
177 * Lots of code duplication, it will ve united in just one
178 * function eventually */
180 NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
181 const struct security_token *token,
182 uint32_t access_desired,
183 uint32_t *access_granted,
184 struct object_tree *tree)
187 uint32_t bits_remaining;
188 struct object_tree *node;
189 const struct GUID *type;
191 *access_granted = access_desired;
192 bits_remaining = access_desired;
194 /* handle the maximum allowed flag */
195 if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
196 access_desired |= access_check_max_allowed(sd, token);
197 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
198 *access_granted = access_desired;
199 bits_remaining = access_desired & ~SEC_STD_DELETE;
202 if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
203 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
204 bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
206 return NT_STATUS_PRIVILEGE_NOT_HELD;
210 /* a NULL dacl allows access */
211 if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
212 *access_granted = access_desired;
216 /* the owner always gets SEC_STD_WRITE_DAC, SEC_STD_READ_CONTROL and SEC_STD_DELETE */
217 if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE)) &&
218 security_token_has_sid(token, sd->owner_sid)) {
219 bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE);
221 if ((bits_remaining & SEC_STD_DELETE) &&
222 security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
223 bits_remaining &= ~SEC_STD_DELETE;
226 if (sd->dacl == NULL) {
230 /* check each ace in turn. */
231 for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
232 struct security_ace *ace = &sd->dacl->aces[i];
234 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
238 if (!security_token_has_sid(token, &ace->trustee)) {
243 case SEC_ACE_TYPE_ACCESS_ALLOWED:
245 object_tree_modify_access(tree, ace->access_mask);
247 bits_remaining &= ~ace->access_mask;
249 case SEC_ACE_TYPE_ACCESS_DENIED:
250 if (bits_remaining & ace->access_mask) {
251 return NT_STATUS_ACCESS_DENIED;
254 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
255 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
256 /* check only in case we have provided a tree,
257 * the ACE has an object type and that type
259 type = get_ace_object_type(ace);
267 if (!(node = get_object_tree_by_GUID(tree, type)))
270 if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT){
271 object_tree_modify_access(node, ace->access_mask);
274 if (node->remaining_access & ace->access_mask){
275 return NT_STATUS_ACCESS_DENIED;
279 default: /* Other ACE types not handled/supported */
285 if (bits_remaining != 0) {
286 return NT_STATUS_ACCESS_DENIED;