libgpo/gpo_sec.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2007
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "libcli/security/dom_sid.h"
  22 #if _SAMBA_BUILD_ == 4
  23 #include "libgpo/ads_convenience.h"
  24 #include "librpc/gen_ndr/security.h"
  25 #include "librpc/gen_ndr/ndr_misc.h"
  26 #include "../libcli/security/secace.h"
  27 #include "../libgpo/gpo.h"
  28 #endif
  29
  30 /****************************************************************
  31 ****************************************************************/
  32
  33 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
  34 {
  35         struct GUID ext_right_apg_guid;
  36         NTSTATUS status;
  37
  38         if (!object) {
  39                 return false;
  40         }
  41
  42         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
  43                                   &ext_right_apg_guid);
  44         if (!NT_STATUS_IS_OK(status)) {
  45                 return false;
  46         }
  47
  48         switch (object->flags) {
  49                 case SEC_ACE_OBJECT_TYPE_PRESENT:
  50                         if (GUID_equal(&object->type.type,
  51                                        &ext_right_apg_guid)) {
  52                                 return true;
  53                         }
  54                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
  55                         if (GUID_equal(&object->inherited_type.inherited_type,
  56                                        &ext_right_apg_guid)) {
  57                                 return true;
  58                         }
  59                 default:
  60                         break;
  61         }
  62
  63         return false;
  64 }
  65
  66 /****************************************************************
  67 ****************************************************************/
  68
  69 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
  70 {
  71         if (!sec_ace_object(ace->type)) {
  72                 return false;
  73         }
  74
  75         return gpo_sd_check_agp_object_guid(&ace->object.object);
  76 }
  77
  78 /****************************************************************
  79 ****************************************************************/
  80
  81 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
  82 {
  83 #if _SAMBA_BUILD_ == 4
  84         return (access_mask & SEC_ADS_CONTROL_ACCESS);
  85 #else
  86         return (access_mask & SEC_RIGHTS_EXTENDED);
  87 #endif
  88 }
  89
  90 #if 0
  91 /****************************************************************
  92 ****************************************************************/
  93
  94 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
  95 {
  96         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
  97                            SEC_RIGHTS_READ_ALL_PROP |
  98                            SEC_RIGHTS_READ_PERMS;
  99
 100         return (read_bits == (access_mask & read_bits));
 101 }
 102 #endif
 103
 104 /****************************************************************
 105 ****************************************************************/
 106
 107 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
 108                                                const NT_USER_TOKEN *token)
 109 {
 110         char *sid_str;
 111
 112         if (gpo_sd_check_agp_object(ace) &&
 113             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 114             nt_token_check_sid(&ace->trustee, token)) {
 115                 sid_str = dom_sid_string(NULL, &ace->trustee);
 116                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
 117                         "Access denied as of ace for %s\n",
 118                         sid_str));
 119                 talloc_free(sid_str);
 120                 return NT_STATUS_ACCESS_DENIED;
 121         }
 122
 123         return STATUS_MORE_ENTRIES;
 124 }
 125
 126 /****************************************************************
 127 ****************************************************************/
 128
 129 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
 130                                                 const NT_USER_TOKEN *token)
 131 {
 132         char *sid_str;
 133
 134         if (gpo_sd_check_agp_object(ace) &&
 135             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 136             nt_token_check_sid(&ace->trustee, token)) {
 137                 sid_str = dom_sid_string(NULL, &ace->trustee);
 138                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
 139                         "Access granted as of ace for %s\n",
 140                         sid_str));
 141                 talloc_free(sid_str);
 142
 143                 return NT_STATUS_OK;
 144         }
 145
 146         return STATUS_MORE_ENTRIES;
 147 }
 148
 149 /****************************************************************
 150 ****************************************************************/
 151
 152 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
 153                                  const NT_USER_TOKEN *token)
 154 {
 155         switch (ace->type) {
 156                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 157                         return gpo_sd_check_ace_denied_object(ace, token);
 158                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 159                         return gpo_sd_check_ace_allowed_object(ace, token);
 160                 default:
 161                         return STATUS_MORE_ENTRIES;
 162         }
 163 }
 164
 165 /****************************************************************
 166 ****************************************************************/
 167
 168 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
 169                                       const NT_USER_TOKEN *token)
 170 {
 171         struct security_descriptor *sd = gpo->security_descriptor;
 172         struct security_acl *dacl = NULL;
 173         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 174         int i;
 175
 176         if (!token) {
 177                 return NT_STATUS_INVALID_USER_BUFFER;
 178         }
 179
 180         if (!sd) {
 181                 return NT_STATUS_INVALID_SECURITY_DESCR;
 182         }
 183
 184         dacl = sd->dacl;
 185         if (!dacl) {
 186                 return NT_STATUS_INVALID_SECURITY_DESCR;
 187         }
 188
 189         /* check all aces and only return NT_STATUS_OK (== Access granted) or
 190          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
 191          * deny access */
 192
 193         for (i = 0; i < dacl->num_aces; i ++) {
 194
 195                 status = gpo_sd_check_ace(&dacl->aces[i], token);
 196
 197                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 198                         return status;
 199                 } else if (NT_STATUS_IS_OK(status)) {
 200                         return status;
 201                 }
 202
 203                 continue;
 204         }
 205
 206         return NT_STATUS_ACCESS_DENIED;
 207 }