libgpo/gpo_sec.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2007
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "libcli/security/security.h"
  22 #include "../libgpo/gpo.h"
  23 #include "auth.h"
  24 #if _SAMBA_BUILD_ == 4
  25 #include "libgpo/ads_convenience.h"
  26 #include "librpc/gen_ndr/security.h"
  27 #include "librpc/gen_ndr/ndr_misc.h"
  28 #include "../libcli/security/secace.h"
  29 #endif
  30
  31 /****************************************************************
  32 ****************************************************************/
  33
  34 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
  35 {
  36         struct GUID ext_right_apg_guid;
  37         NTSTATUS status;
  38
  39         if (!object) {
  40                 return false;
  41         }
  42
  43         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
  44                                   &ext_right_apg_guid);
  45         if (!NT_STATUS_IS_OK(status)) {
  46                 return false;
  47         }
  48
  49         switch (object->flags) {
  50                 case SEC_ACE_OBJECT_TYPE_PRESENT:
  51                         if (GUID_equal(&object->type.type,
  52                                        &ext_right_apg_guid)) {
  53                                 return true;
  54                         }
  55                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
  56                         if (GUID_equal(&object->inherited_type.inherited_type,
  57                                        &ext_right_apg_guid)) {
  58                                 return true;
  59                         }
  60                 default:
  61                         break;
  62         }
  63
  64         return false;
  65 }
  66
  67 /****************************************************************
  68 ****************************************************************/
  69
  70 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
  71 {
  72         if (!sec_ace_object(ace->type)) {
  73                 return false;
  74         }
  75
  76         return gpo_sd_check_agp_object_guid(&ace->object.object);
  77 }
  78
  79 /****************************************************************
  80 ****************************************************************/
  81
  82 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
  83 {
  84         return (access_mask & SEC_ADS_CONTROL_ACCESS);
  85 }
  86
  87 #if 0
  88 /****************************************************************
  89 ****************************************************************/
  90
  91 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
  92 {
  93         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
  94                            SEC_RIGHTS_READ_ALL_PROP |
  95                            SEC_RIGHTS_READ_PERMS;
  96
  97         return (read_bits == (access_mask & read_bits));
  98 }
  99 #endif
 100
 101 /****************************************************************
 102 ****************************************************************/
 103
 104 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
 105                                                const struct security_token *token)
 106 {
 107         char *sid_str;
 108
 109         if (gpo_sd_check_agp_object(ace) &&
 110             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 111             nt_token_check_sid(&ace->trustee, token)) {
 112                 sid_str = dom_sid_string(NULL, &ace->trustee);
 113                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
 114                         "Access denied as of ace for %s\n",
 115                         sid_str));
 116                 talloc_free(sid_str);
 117                 return NT_STATUS_ACCESS_DENIED;
 118         }
 119
 120         return STATUS_MORE_ENTRIES;
 121 }
 122
 123 /****************************************************************
 124 ****************************************************************/
 125
 126 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
 127                                                 const struct security_token *token)
 128 {
 129         char *sid_str;
 130
 131         if (gpo_sd_check_agp_object(ace) &&
 132             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 133             nt_token_check_sid(&ace->trustee, token)) {
 134                 sid_str = dom_sid_string(NULL, &ace->trustee);
 135                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
 136                         "Access granted as of ace for %s\n",
 137                         sid_str));
 138                 talloc_free(sid_str);
 139
 140                 return NT_STATUS_OK;
 141         }
 142
 143         return STATUS_MORE_ENTRIES;
 144 }
 145
 146 /****************************************************************
 147 ****************************************************************/
 148
 149 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
 150                                  const struct security_token *token)
 151 {
 152         switch (ace->type) {
 153                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 154                         return gpo_sd_check_ace_denied_object(ace, token);
 155                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 156                         return gpo_sd_check_ace_allowed_object(ace, token);
 157                 default:
 158                         return STATUS_MORE_ENTRIES;
 159         }
 160 }
 161
 162 /****************************************************************
 163 ****************************************************************/
 164
 165 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
 166                                       const struct security_token *token)
 167 {
 168         struct security_descriptor *sd = gpo->security_descriptor;
 169         struct security_acl *dacl = NULL;
 170         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 171         int i;
 172
 173         if (!token) {
 174                 return NT_STATUS_INVALID_USER_BUFFER;
 175         }
 176
 177         if (!sd) {
 178                 return NT_STATUS_INVALID_SECURITY_DESCR;
 179         }
 180
 181         dacl = sd->dacl;
 182         if (!dacl) {
 183                 return NT_STATUS_INVALID_SECURITY_DESCR;
 184         }
 185
 186         /* check all aces and only return NT_STATUS_OK (== Access granted) or
 187          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
 188          * deny access */
 189
 190         for (i = 0; i < dacl->num_aces; i ++) {
 191
 192                 status = gpo_sd_check_ace(&dacl->aces[i], token);
 193
 194                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 195                         return status;
 196                 } else if (NT_STATUS_IS_OK(status)) {
 197                         return status;
 198                 }
 199
 200                 continue;
 201         }
 202
 203         return NT_STATUS_ACCESS_DENIED;
 204 }