extern int DEBUGLEVEL;
-/*
- * Guest token used when there is no NT_USER_TOKEN available.
- */
-
-static DOM_SID builtin_guest = {
- 1, /* sid_rev_num */
- 2, /* num_auths */
- { 0, 0, 0, 0, 0, 5}, /* id_auth[6] */
- { 32, 546, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} /* sub_auth[15] */
-};
-
-static NT_USER_TOKEN guest_token = {
- 1,
- &builtin_guest
-};
-
/**********************************************************************************
Check if this ACE has a SID in common with the token.
**********************************************************************************/
size_t i;
for (i = 0; i < token->num_sids; i++) {
- if (sid_equal(&ace->sid, &token->user_sids[i])) {
+ if (sid_equal(&ace->sid, &token->user_sids[i]))
return True;
- }
}
return False;
{
uint32 mask = ace->info.mask;
+#if 0
+
+ /* I think there is some aspect of inheritable ACEs that we don't
+ understand. A 'Manage Documents' permission has the following
+ ACE entries (after generic mapping has been applied):
+
+ S-1-5-21-1067277791-1719175008-3000797951-1033 0 9 0x000f000c
+ S-1-5-21-1067277791-1719175008-3000797951-1033 0 2 0x00020000
+
+ Now a user wanting to print calls se_access_check() with desired
+ access PRINTER_ACCESS_USE (0x00000008). This is only allowed if
+ the inherit only ACE, flags & SEC_ACE_FLAG_INHERIT_ONLY (0x8) is
+ checked. A similar argument is used to explain how a user with
+ 'Full Control' permission can print.
+
+ Having both the flags SEC_ACE_FLAG_INHERIT_ONLY and
+ SEC_ACE_FLAG_OBJECT_INHERIT set in an ACE doesn't seem to make
+ sense. According to the MSDN, an inherit only ACE "indicates an
+ [...] ACE which does not control access to the object to which
+ it is attached" and an object inherit ACE for "non-container
+ child objects [they] inherit the ACE as an effective ACE".
+ These two flags don't seem to make sense when combined. Does
+ the object inherit override the inherit only flag? We are also
+ talking about access to a printer object, not a printer job so
+ inheritance shouldn't even be involved. -tpot */
+
/*
* Inherit only is ignored.
*/
return acc_desired;
}
+#endif
/*
* If this ACE has no SID in common with the token,
return True;
}
-/*********************************************************************************
+/* Map generic access rights to object specific rights. This technique is
+ used to give meaning to assigning read, write, execute and all access to
+ objects. Each type of object has its own mapping of generic to object
+ specific access rights. */
+
+void se_map_generic(uint32 *access_mask, struct generic_mapping *mapping)
+{
+ uint32 old_mask = *access_mask;
+
+ if (*access_mask & GENERIC_READ_ACCESS) {
+ *access_mask &= ~GENERIC_READ_ACCESS;
+ *access_mask |= mapping->generic_read;
+ }
+
+ if (*access_mask & GENERIC_WRITE_ACCESS) {
+ *access_mask &= ~GENERIC_WRITE_ACCESS;
+ *access_mask |= mapping->generic_write;
+ }
+
+ if (*access_mask & GENERIC_EXECUTE_ACCESS) {
+ *access_mask &= ~GENERIC_EXECUTE_ACCESS;
+ *access_mask |= mapping->generic_execute;
+ }
+
+ if (*access_mask & GENERIC_ALL_ACCESS) {
+ *access_mask &= ~GENERIC_ALL_ACCESS;
+ *access_mask |= mapping->generic_all;
+ }
+
+ if (old_mask != *access_mask) {
+ DEBUG(10, ("se_map_generic(): mapped mask 0x%08x to 0x%08x\n",
+ old_mask, *access_mask));
+ }
+}
+
+/*****************************************************************************
Check access rights of a user against a security descriptor. Look at
each ACE in the security descriptor until an access denied ACE denies
any of the desired rights to the user or any of the users groups, or one
or more ACEs explicitly grant all requested access rights. See
"Access-Checking" document in MSDN.
-**********************************************************************************/
+*****************************************************************************/
BOOL se_access_check(SEC_DESC *sd, struct current_user *user,
uint32 acc_desired, uint32 *acc_granted, uint32 *status)
{
+ extern NT_USER_TOKEN anonymous_token;
size_t i;
SEC_ACL *acl;
fstring sid_str;
- NT_USER_TOKEN *token = user->nt_user_token ? user->nt_user_token : &guest_token;
+ NT_USER_TOKEN *token = user->nt_user_token ? user->nt_user_token : &anonymous_token;
uint32 tmp_acc_desired = acc_desired;
if (!status || !acc_granted)
*status = NT_STATUS_NOPROBLEMO;
*acc_granted = 0;
+ DEBUG(10,("se_access_check: requested access %x, for uid %u\n",
+ (unsigned int)acc_desired, (unsigned int)user->uid ));
+
/*
* No security descriptor or security descriptor with no DACL
* present allows all access.
if (!sd || (sd && (!(sd->type & SEC_DESC_DACL_PRESENT) || sd->dacl == NULL))) {
*status = NT_STATUS_NOPROBLEMO;
*acc_granted = acc_desired;
- DEBUG(3, ("se_access_check: no sd or blank DACL, access allowed\n"));
+ DEBUG(5, ("se_access_check: no sd or blank DACL, access allowed\n"));
return True;
}
-
- /* We must know the owner sid */
-
- if (sd->owner_sid == NULL) {
- DEBUG(1, ("no owner for security descriptor\n"));
- *acc_granted = 0;
- *status = NT_STATUS_ACCESS_DENIED;
- return False;
- }
-
/* The user sid is the first in the token */
DEBUG(3, ("se_access_check: user sid is %s\n", sid_to_string(sid_str, &token->user_sids[0]) ));
+ for (i = 1; i < token->num_sids; i++) {
+ DEBUG(3, ("se_access_check: also %s\n",
+ sid_to_string(sid_str, &token->user_sids[i])));
+ }
+
/* Is the token the owner of the SID ? */
- for (i = 0; i < token->num_sids; i++) {
- if (sid_equal(&token->user_sids[i], sd->owner_sid)) {
- /*
- * The owner always has SEC_RIGHTS_WRITE_DAC.
- */
- if (tmp_acc_desired & SEC_RIGHTS_WRITE_DAC)
- tmp_acc_desired &= ~SEC_RIGHTS_WRITE_DAC;
+ if (sd->owner_sid) {
+ for (i = 0; i < token->num_sids; i++) {
+ if (sid_equal(&token->user_sids[i], sd->owner_sid)) {
+ /*
+ * The owner always has SEC_RIGHTS_WRITE_DAC & READ_CONTROL.
+ */
+ if (tmp_acc_desired & WRITE_DAC_ACCESS)
+ tmp_acc_desired &= ~WRITE_DAC_ACCESS;
+ if (tmp_acc_desired & READ_CONTROL_ACCESS)
+ tmp_acc_desired &= ~READ_CONTROL_ACCESS;
+ }
}
}
acl = sd->dacl;
- if (tmp_acc_desired & SEC_RIGHTS_MAXIMUM_ALLOWED) {
- tmp_acc_desired &= ~SEC_RIGHTS_MAXIMUM_ALLOWED;
+ if (tmp_acc_desired & MAXIMUM_ALLOWED_ACCESS) {
+ tmp_acc_desired &= ~MAXIMUM_ALLOWED_ACCESS;
return get_max_access( acl, token, acc_granted, tmp_acc_desired, status);
}
for ( i = 0 ; i < acl->num_aces && tmp_acc_desired != 0; i++) {
- tmp_acc_desired = check_ace( &acl->ace[i], token, tmp_acc_desired, status);
+ SEC_ACE *ace = &acl->ace[i];
+
+ DEBUG(10,("se_access_check: ACE %u: type %d, flags = 0x%02x, SID = %s mask = %x, current desired = %x\n",
+ (unsigned int)i, ace->type, ace->flags,
+ sid_to_string(sid_str, &ace->sid),
+ (unsigned int) ace->info.mask,
+ (unsigned int)tmp_acc_desired ));
+
+ tmp_acc_desired = check_ace( ace, token, tmp_acc_desired, status);
if (*status != NT_STATUS_NOPROBLEMO) {
*acc_granted = 0;
+ DEBUG(5,("se_access_check: ACE %u denied with status %x.\n", (unsigned int)i, (unsigned int)*status ));
return False;
}
}
if (tmp_acc_desired == 0) {
*acc_granted = acc_desired;
*status = NT_STATUS_NOPROBLEMO;
+ DEBUG(5,("se_access_check: access (%x) granted.\n", (unsigned int)acc_desired ));
return True;
}
*acc_granted = 0;
*status = NT_STATUS_ACCESS_DENIED;
+ DEBUG(5,("se_access_check: access (%x) denied.\n", (unsigned int)acc_desired ));
return False;
}
git.samba.org / ira / wip.git / blobdiff