Owner and group defaulting.
[ira/wip.git] / source4 / libcli / security / create_descriptor.c
1 /*
2    Copyright (C) Nadezhda Ivanova 2009
3
4    This program is free software; you can redistribute it and/or modify
5    it under the terms of the GNU General Public License as published by
6    the Free Software Foundation; either version 3 of the License, or
7    (at your option) any later version.
8
9    This program is distributed in the hope that it will be useful,
10    but WITHOUT ANY WARRANTY; without even the implied warranty of
11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12    GNU General Public License for more details.
13
14    You should have received a copy of the GNU General Public License
15    along with this program.  If not, see <http://www.gnu.org/licenses/>.
16 */
17
18 /*
19  *  Name: create_descriptor
20  *
21  *  Component: routines for calculating and creating security descriptors
22  *  as described in MS-DTYP 2.5.2.2
23  *
24  *  Description:
25  *
26  *
27  *  Author: Nadezhda Ivanova
28  */
29 #include "includes.h"
30 #include "libcli/security/security.h"
31
32 /* the mapping function for generic rights for DS.(GA,GR,GW,GX)
33  * The mapping function is passed as an argument to the
34  * descriptor calculating routine and depends on the security
35  * manager that calls the calculating routine.
36  * TODO: need similar mappings for the file system and
37  * registry security managers in order to make this code
38  * generic for all security managers
39  */
40
41 uint32_t map_generic_rights_ds(uint32_t access_mask)
42 {
43         if (access_mask & SEC_GENERIC_ALL){
44                 access_mask |= SEC_ADS_GENERIC_ALL;
45                 access_mask = ~SEC_GENERIC_ALL;
46         }
47
48         if (access_mask & SEC_GENERIC_EXECUTE){
49                 access_mask |= SEC_ADS_GENERIC_EXECUTE;
50                 access_mask = ~SEC_GENERIC_EXECUTE;
51         }
52
53         if (access_mask & SEC_GENERIC_WRITE){
54                 access_mask |= SEC_ADS_GENERIC_WRITE;
55                 access_mask &= ~SEC_GENERIC_WRITE;
56         }
57
58         if (access_mask & SEC_GENERIC_READ){
59                 access_mask |= SEC_ADS_GENERIC_READ;
60                 access_mask &= ~SEC_GENERIC_READ;
61         }
62
63         return access_mask;
64 }
65
66 struct security_descriptor *create_security_descriptor(TALLOC_CTX *mem_ctx,
67                                                        struct security_descriptor *parent_sd,
68                                                        struct security_descriptor *creator_sd,
69                                                        bool is_container,
70                                                        struct GUID *object_list,
71                                                        uint32_t inherit_flags,
72                                                        struct security_token *token,
73                                                        struct dom_sid *default_owner, /* valid only for DS, NULL for the other RSs */
74                                                        struct dom_sid *default_group, /* valid only for DS, NULL for the other RSs */
75                                                        uint32_t (*generic_map)(uint32_t access_mask))
76 {
77         struct security_descriptor *new_sd;
78         struct dom_sid *new_owner = NULL;
79         struct dom_sid *new_group = NULL;
80
81         new_sd = security_descriptor_initialise(mem_ctx);
82         if (!new_sd)
83                 return NULL;
84         if (!creator_sd || !creator_sd->owner_sid){
85                 if (inherit_flags & SEC_OWNER_FROM_PARENT)
86                         new_owner = parent_sd->owner_sid;
87                 else if (!default_owner)
88                         new_owner = token->user_sid;
89                 else
90                         new_owner = default_owner;
91         }
92         else
93                 new_owner = creator_sd->owner_sid;
94
95         if (!creator_sd || !creator_sd->group_sid){
96                 if (inherit_flags & SEC_GROUP_FROM_PARENT && parent_sd)
97                         new_group = parent_sd->group_sid;
98                 else if (!default_group)
99                         new_group = token->group_sid;
100                 else new_group = default_group;
101         }
102         else
103                 new_group = creator_sd->group_sid;
104
105         new_sd->owner_sid = talloc_memdup(new_sd, new_owner, sizeof(struct dom_sid));
106         new_sd->group_sid = talloc_memdup(new_sd, new_group, sizeof(struct dom_sid));
107         if (!new_sd->owner_sid || !new_sd->group_sid){
108                 talloc_free(new_sd);
109                 return NULL;
110         }
111         /* Todo remove */
112         if (creator_sd && creator_sd->type & SEC_DESC_DACL_PRESENT){
113                 new_sd->dacl = security_acl_dup(new_sd, creator_sd->dacl);
114                 new_sd->type |= SEC_DESC_DACL_PRESENT;
115         }
116         return new_sd;
117 }