libgpo/gpo_sec.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2007
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "libcli/security/dom_sid.h"
  22 #if _SAMBA_BUILD_ == 4
  23 #include "libgpo/ads_convenience.h"
  24 #include "librpc/gen_ndr/security.h"
  25 #include "librpc/gen_ndr/ndr_misc.h"
  26 #include "../libgpo/gpo.h"
  27 #endif
  28
  29 /****************************************************************
  30 ****************************************************************/
  31
  32 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
  33 {
  34         struct GUID ext_right_apg_guid;
  35         NTSTATUS status;
  36
  37         if (!object) {
  38                 return false;
  39         }
  40
  41         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
  42                                   &ext_right_apg_guid);
  43         if (!NT_STATUS_IS_OK(status)) {
  44                 return false;
  45         }
  46
  47         switch (object->flags) {
  48                 case SEC_ACE_OBJECT_TYPE_PRESENT:
  49                         if (GUID_equal(&object->type.type,
  50                                        &ext_right_apg_guid)) {
  51                                 return true;
  52                         }
  53                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
  54                         if (GUID_equal(&object->inherited_type.inherited_type,
  55                                        &ext_right_apg_guid)) {
  56                                 return true;
  57                         }
  58                 default:
  59                         break;
  60         }
  61
  62         return false;
  63 }
  64
  65 /****************************************************************
  66 ****************************************************************/
  67
  68 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
  69 {
  70         if (!sec_ace_object(ace->type)) {
  71                 return false;
  72         }
  73
  74         return gpo_sd_check_agp_object_guid(&ace->object.object);
  75 }
  76
  77 /****************************************************************
  78 ****************************************************************/
  79
  80 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
  81 {
  82 #if _SAMBA_BUILD_ == 4
  83         return (access_mask & SEC_ADS_CONTROL_ACCESS);
  84 #else
  85         return (access_mask & SEC_RIGHTS_EXTENDED);
  86 #endif
  87 }
  88
  89 #if 0
  90 /****************************************************************
  91 ****************************************************************/
  92
  93 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
  94 {
  95         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
  96                            SEC_RIGHTS_READ_ALL_PROP |
  97                            SEC_RIGHTS_READ_PERMS;
  98
  99         return (read_bits == (access_mask & read_bits));
 100 }
 101 #endif
 102
 103 /****************************************************************
 104 ****************************************************************/
 105
 106 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
 107                                                const NT_USER_TOKEN *token)
 108 {
 109         char *sid_str;
 110
 111         if (gpo_sd_check_agp_object(ace) &&
 112             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 113             nt_token_check_sid(&ace->trustee, token)) {
 114                 sid_str = dom_sid_string(NULL, &ace->trustee);
 115                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
 116                         "Access denied as of ace for %s\n",
 117                         sid_str));
 118                 talloc_free(sid_str);
 119                 return NT_STATUS_ACCESS_DENIED;
 120         }
 121
 122         return STATUS_MORE_ENTRIES;
 123 }
 124
 125 /****************************************************************
 126 ****************************************************************/
 127
 128 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
 129                                                 const NT_USER_TOKEN *token)
 130 {
 131         char *sid_str;
 132
 133         if (gpo_sd_check_agp_object(ace) &&
 134             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 135             nt_token_check_sid(&ace->trustee, token)) {
 136                 sid_str = dom_sid_string(NULL, &ace->trustee);
 137                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
 138                         "Access granted as of ace for %s\n",
 139                         sid_str));
 140                 talloc_free(sid_str);
 141
 142                 return NT_STATUS_OK;
 143         }
 144
 145         return STATUS_MORE_ENTRIES;
 146 }
 147
 148 /****************************************************************
 149 ****************************************************************/
 150
 151 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
 152                                  const NT_USER_TOKEN *token)
 153 {
 154         switch (ace->type) {
 155                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 156                         return gpo_sd_check_ace_denied_object(ace, token);
 157                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 158                         return gpo_sd_check_ace_allowed_object(ace, token);
 159                 default:
 160                         return STATUS_MORE_ENTRIES;
 161         }
 162 }
 163
 164 /****************************************************************
 165 ****************************************************************/
 166
 167 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
 168                                       const NT_USER_TOKEN *token)
 169 {
 170         struct security_descriptor *sd = gpo->security_descriptor;
 171         struct security_acl *dacl = NULL;
 172         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 173         int i;
 174
 175         if (!token) {
 176                 return NT_STATUS_INVALID_USER_BUFFER;
 177         }
 178
 179         if (!sd) {
 180                 return NT_STATUS_INVALID_SECURITY_DESCR;
 181         }
 182
 183         dacl = sd->dacl;
 184         if (!dacl) {
 185                 return NT_STATUS_INVALID_SECURITY_DESCR;
 186         }
 187
 188         /* check all aces and only return NT_STATUS_OK (== Access granted) or
 189          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
 190          * deny access */
 191
 192         for (i = 0; i < dacl->num_aces; i ++) {
 193
 194                 status = gpo_sd_check_ace(&dacl->aces[i], token);
 195
 196                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 197                         return status;
 198                 } else if (NT_STATUS_IS_OK(status)) {
 199                         return status;
 200                 }
 201
 202                 continue;
 203         }
 204
 205         return NT_STATUS_ACCESS_DENIED;
 206 }