source4/libcli/security/create_descriptor.c

   1 /*
   2    Copyright (C) Nadezhda Ivanova 2009
   3
   4    This program is free software; you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation; either version 3 of the License, or
   7    (at your option) any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16 */
  17
  18 /*
  19  *  Name: create_descriptor
  20  *
  21  *  Component: routines for calculating and creating security descriptors
  22  *  as described in MS-DTYP 2.5.2.2
  23  *
  24  *  Description:
  25  *
  26  *
  27  *  Author: Nadezhda Ivanova
  28  */
  29 #include "includes.h"
  30 #include "libcli/security/security.h"
  31
  32 /* the mapping function for generic rights for DS.(GA,GR,GW,GX)
  33  * The mapping function is passed as an argument to the
  34  * descriptor calculating routine and depends on the security
  35  * manager that calls the calculating routine.
  36  * TODO: need similar mappings for the file system and
  37  * registry security managers in order to make this code
  38  * generic for all security managers
  39  */
  40
  41 uint32_t map_generic_rights_ds(uint32_t access_mask)
  42 {
  43         if (access_mask & SEC_GENERIC_ALL){
  44                 access_mask |= SEC_ADS_GENERIC_ALL;
  45                 access_mask = ~SEC_GENERIC_ALL;
  46         }
  47
  48         if (access_mask & SEC_GENERIC_EXECUTE){
  49                 access_mask |= SEC_ADS_GENERIC_EXECUTE;
  50                 access_mask = ~SEC_GENERIC_EXECUTE;
  51         }
  52
  53         if (access_mask & SEC_GENERIC_WRITE){
  54                 access_mask |= SEC_ADS_GENERIC_WRITE;
  55                 access_mask &= ~SEC_GENERIC_WRITE;
  56         }
  57
  58         if (access_mask & SEC_GENERIC_READ){
  59                 access_mask |= SEC_ADS_GENERIC_READ;
  60                 access_mask &= ~SEC_GENERIC_READ;
  61         }
  62
  63         return access_mask;
  64 }
  65
  66 struct security_descriptor *create_security_descriptor(TALLOC_CTX *mem_ctx,
  67                                                        struct security_descriptor *parent_sd,
  68                                                        struct security_descriptor *creator_sd,
  69                                                        bool is_container,
  70                                                        struct GUID *object_list,
  71                                                        uint32_t inherit_flags,
  72                                                        struct security_token *token,
  73                                                        struct dom_sid *default_owner, /* valid only for DS, NULL for the other RSs */
  74                                                        struct dom_sid *default_group, /* valid only for DS, NULL for the other RSs */
  75                                                        uint32_t (*generic_map)(uint32_t access_mask))
  76 {
  77         struct security_descriptor *new_sd;
  78         struct dom_sid *new_owner = NULL;
  79         struct dom_sid *new_group = NULL;
  80
  81         new_sd = security_descriptor_initialise(mem_ctx);
  82         if (!new_sd)
  83                 return NULL;
  84         if (!creator_sd || !creator_sd->owner_sid){
  85                 if (inherit_flags & SEC_OWNER_FROM_PARENT)
  86                         new_owner = parent_sd->owner_sid;
  87                 else if (!default_owner)
  88                         new_owner = token->user_sid;
  89                 else
  90                         new_owner = default_owner;
  91         }
  92         else
  93                 new_owner = creator_sd->owner_sid;
  94
  95         if (!creator_sd || !creator_sd->group_sid){
  96                 if (inherit_flags & SEC_GROUP_FROM_PARENT && parent_sd)
  97                         new_group = parent_sd->group_sid;
  98                 else if (!default_group)
  99                         new_group = token->group_sid;
 100                 else new_group = default_group;
 101         }
 102         else
 103                 new_group = creator_sd->group_sid;
 104
 105         new_sd->owner_sid = talloc_memdup(new_sd, new_owner, sizeof(struct dom_sid));
 106         new_sd->group_sid = talloc_memdup(new_sd, new_group, sizeof(struct dom_sid));
 107         if (!new_sd->owner_sid || !new_sd->group_sid){
 108                 talloc_free(new_sd);
 109                 return NULL;
 110         }
 111         /* Todo remove */
 112         if (creator_sd && creator_sd->type & SEC_DESC_DACL_PRESENT){
 113                 new_sd->dacl = security_acl_dup(new_sd, creator_sd->dacl);
 114                 new_sd->type |= SEC_DESC_DACL_PRESENT;
 115         }
 116         return new_sd;
 117 }