8c05b2f13212c39cc48f8088d4133917b9ffa93c
[kai/samba.git] / source3 / libgpo / gpo_reg.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Group Policy Object Support
4  *  Copyright (C) Guenther Deschner 2007-2008
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 3 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19
20 #include "includes.h"
21 #include "../libgpo/gpo.h"
22 #include "libgpo/gpo_proto.h"
23 #include "registry.h"
24 #include "registry/reg_backend_db.h"
25 #include "registry/reg_api_util.h"
26
27
28 /****************************************************************
29 ****************************************************************/
30
31 struct security_token *registry_create_system_token(TALLOC_CTX *mem_ctx)
32 {
33         struct security_token *token = NULL;
34
35         token = TALLOC_ZERO_P(mem_ctx, struct security_token);
36         if (!token) {
37                 DEBUG(1,("talloc failed\n"));
38                 return NULL;
39         }
40
41         token->privilege_mask = SE_ALL_PRIVS;
42
43         if (!NT_STATUS_IS_OK(add_sid_to_array(token, &global_sid_System,
44                          &token->sids, &token->num_sids))) {
45                 DEBUG(1,("Error adding nt-authority system sid to token\n"));
46                 return NULL;
47         }
48
49         return token;
50 }
51
52 /****************************************************************
53 ****************************************************************/
54
55 WERROR gp_init_reg_ctx(TALLOC_CTX *mem_ctx,
56                        const char *initial_path,
57                        uint32_t desired_access,
58                        const struct security_token *token,
59                        struct gp_registry_context **reg_ctx)
60 {
61         struct gp_registry_context *tmp_ctx;
62         WERROR werr;
63
64         if (!reg_ctx) {
65                 return WERR_INVALID_PARAM;
66         }
67
68         werr = registry_init_basic();
69         if (!W_ERROR_IS_OK(werr)) {
70                 return werr;
71         }
72
73         tmp_ctx = TALLOC_ZERO_P(mem_ctx, struct gp_registry_context);
74         W_ERROR_HAVE_NO_MEMORY(tmp_ctx);
75
76         if (token) {
77                 tmp_ctx->token = token;
78         } else {
79                 tmp_ctx->token = registry_create_system_token(mem_ctx);
80         }
81         if (!tmp_ctx->token) {
82                 TALLOC_FREE(tmp_ctx);
83                 return WERR_NOMEM;
84         }
85
86         werr = regdb_open();
87         if (!W_ERROR_IS_OK(werr)) {
88                 return werr;
89         }
90
91         if (initial_path) {
92                 tmp_ctx->path = talloc_strdup(mem_ctx, initial_path);
93                 if (!tmp_ctx->path) {
94                         TALLOC_FREE(tmp_ctx);
95                         return WERR_NOMEM;
96                 }
97
98                 werr = reg_open_path(mem_ctx, tmp_ctx->path, desired_access,
99                                      tmp_ctx->token, &tmp_ctx->curr_key);
100                 if (!W_ERROR_IS_OK(werr)) {
101                         TALLOC_FREE(tmp_ctx);
102                         return werr;
103                 }
104         }
105
106         *reg_ctx = tmp_ctx;
107
108         return WERR_OK;
109 }
110
111 /****************************************************************
112 ****************************************************************/
113
114 void gp_free_reg_ctx(struct gp_registry_context *reg_ctx)
115 {
116         TALLOC_FREE(reg_ctx);
117 }
118
119 /****************************************************************
120 ****************************************************************/
121
122 WERROR gp_store_reg_subkey(TALLOC_CTX *mem_ctx,
123                            const char *subkeyname,
124                            struct registry_key *curr_key,
125                            struct registry_key **new_key)
126 {
127         enum winreg_CreateAction action = REG_ACTION_NONE;
128         WERROR werr;
129
130         werr = reg_createkey(mem_ctx, curr_key, subkeyname,
131                              REG_KEY_WRITE, new_key, &action);
132         if (W_ERROR_IS_OK(werr) && (action != REG_CREATED_NEW_KEY)) {
133                 return WERR_OK;
134         }
135
136         return werr;
137 }
138
139 /****************************************************************
140 ****************************************************************/
141
142 WERROR gp_read_reg_subkey(TALLOC_CTX *mem_ctx,
143                           struct gp_registry_context *reg_ctx,
144                           const char *subkeyname,
145                           struct registry_key **key)
146 {
147         const char *tmp = NULL;
148
149         if (!reg_ctx || !subkeyname || !key) {
150                 return WERR_INVALID_PARAM;
151         }
152
153         tmp = talloc_asprintf(mem_ctx, "%s\\%s", reg_ctx->path, subkeyname);
154         W_ERROR_HAVE_NO_MEMORY(tmp);
155
156         return reg_open_path(mem_ctx, tmp, REG_KEY_READ,
157                              reg_ctx->token, key);
158 }
159
160 /****************************************************************
161 ****************************************************************/
162
163 WERROR gp_store_reg_val_sz(TALLOC_CTX *mem_ctx,
164                            struct registry_key *key,
165                            const char *val_name,
166                            const char *val)
167 {
168         struct registry_value reg_val;
169
170         reg_val.type = REG_SZ;
171         if (!push_reg_sz(mem_ctx, &reg_val.data, val)) {
172                 return WERR_NOMEM;
173         }
174
175         return reg_setvalue(key, val_name, &reg_val);
176 }
177
178 /****************************************************************
179 ****************************************************************/
180
181 static WERROR gp_store_reg_val_dword(TALLOC_CTX *mem_ctx,
182                                      struct registry_key *key,
183                                      const char *val_name,
184                                      uint32_t val)
185 {
186         struct registry_value reg_val;
187
188         reg_val.type = REG_DWORD;
189         reg_val.data = data_blob_talloc(mem_ctx, NULL, 4);
190         SIVAL(reg_val.data.data, 0, val);
191
192         return reg_setvalue(key, val_name, &reg_val);
193 }
194
195 /****************************************************************
196 ****************************************************************/
197
198 WERROR gp_read_reg_val_sz(TALLOC_CTX *mem_ctx,
199                           struct registry_key *key,
200                           const char *val_name,
201                           const char **val)
202 {
203         WERROR werr;
204         struct registry_value *reg_val = NULL;
205
206         werr = reg_queryvalue(mem_ctx, key, val_name, &reg_val);
207         W_ERROR_NOT_OK_RETURN(werr);
208
209         if (reg_val->type != REG_SZ) {
210                 return WERR_INVALID_DATATYPE;
211         }
212
213         if (!pull_reg_sz(mem_ctx, &reg_val->data, val)) {
214                 return WERR_NOMEM;
215         }
216
217         return WERR_OK;
218 }
219
220 /****************************************************************
221 ****************************************************************/
222
223 static WERROR gp_read_reg_val_dword(TALLOC_CTX *mem_ctx,
224                                     struct registry_key *key,
225                                     const char *val_name,
226                                     uint32_t *val)
227 {
228         WERROR werr;
229         struct registry_value *reg_val = NULL;
230
231         werr = reg_queryvalue(mem_ctx, key, val_name, &reg_val);
232         W_ERROR_NOT_OK_RETURN(werr);
233
234         if (reg_val->type != REG_DWORD) {
235                 return WERR_INVALID_DATATYPE;
236         }
237
238         if (reg_val->data.length < 4) {
239                 return WERR_INSUFFICIENT_BUFFER;
240         }
241         *val = IVAL(reg_val->data.data, 0);
242
243         return WERR_OK;
244 }
245
246 /****************************************************************
247 ****************************************************************/
248
249 static WERROR gp_store_reg_gpovals(TALLOC_CTX *mem_ctx,
250                                    struct registry_key *key,
251                                    struct GROUP_POLICY_OBJECT *gpo)
252 {
253         WERROR werr;
254
255         if (!key || !gpo) {
256                 return WERR_INVALID_PARAM;
257         }
258
259         werr = gp_store_reg_val_dword(mem_ctx, key, "Version",
260                                       gpo->version);
261         W_ERROR_NOT_OK_RETURN(werr);
262
263         werr = gp_store_reg_val_dword(mem_ctx, key, "WQLFilterPass",
264                                       true); /* fake */
265         W_ERROR_NOT_OK_RETURN(werr);
266
267         werr = gp_store_reg_val_dword(mem_ctx, key, "AccessDenied",
268                                       false); /* fake */
269         W_ERROR_NOT_OK_RETURN(werr);
270
271         werr = gp_store_reg_val_dword(mem_ctx, key, "GPO-Disabled",
272                                       (gpo->options & GPO_FLAG_DISABLE));
273         W_ERROR_NOT_OK_RETURN(werr);
274
275         werr = gp_store_reg_val_dword(mem_ctx, key, "Options",
276                                       gpo->options);
277         W_ERROR_NOT_OK_RETURN(werr);
278
279         werr = gp_store_reg_val_sz(mem_ctx, key, "GPOID",
280                                    gpo->name);
281         W_ERROR_NOT_OK_RETURN(werr);
282
283         werr = gp_store_reg_val_sz(mem_ctx, key, "SOM",
284                                    gpo->link);
285         W_ERROR_NOT_OK_RETURN(werr);
286
287         werr = gp_store_reg_val_sz(mem_ctx, key, "DisplayName",
288                                    gpo->display_name);
289         W_ERROR_NOT_OK_RETURN(werr);
290
291         werr = gp_store_reg_val_sz(mem_ctx, key, "WQL-Id",
292                                    NULL);
293         W_ERROR_NOT_OK_RETURN(werr);
294
295         return werr;
296 }
297
298 /****************************************************************
299 ****************************************************************/
300
301 static const char *gp_reg_groupmembership_path(TALLOC_CTX *mem_ctx,
302                                                const struct dom_sid *sid,
303                                                uint32_t flags)
304 {
305         if (flags & GPO_LIST_FLAG_MACHINE) {
306                 return "GroupMembership";
307         }
308
309         return talloc_asprintf(mem_ctx, "%s\\%s", sid_string_tos(sid),
310                                "GroupMembership");
311 }
312
313 /****************************************************************
314 ****************************************************************/
315
316 static WERROR gp_reg_del_groupmembership(TALLOC_CTX *mem_ctx,
317                                          struct registry_key *key,
318                                          const struct security_token *token,
319                                          uint32_t flags)
320 {
321         const char *path = NULL;
322
323         path = gp_reg_groupmembership_path(mem_ctx, &token->sids[0],
324                                            flags);
325         W_ERROR_HAVE_NO_MEMORY(path);
326
327         return reg_deletekey_recursive(mem_ctx, key, path);
328
329 }
330
331 /****************************************************************
332 ****************************************************************/
333
334 static WERROR gp_reg_store_groupmembership(TALLOC_CTX *mem_ctx,
335                                            struct gp_registry_context *reg_ctx,
336                                            const struct security_token *token,
337                                            uint32_t flags)
338 {
339         struct registry_key *key = NULL;
340         WERROR werr;
341         int i = 0;
342         const char *valname = NULL;
343         const char *path = NULL;
344         const char *val = NULL;
345         int count = 0;
346
347         path = gp_reg_groupmembership_path(mem_ctx, &token->sids[0],
348                                            flags);
349         W_ERROR_HAVE_NO_MEMORY(path);
350
351         gp_reg_del_groupmembership(mem_ctx, reg_ctx->curr_key, token, flags);
352
353         werr = gp_store_reg_subkey(mem_ctx, path,
354                                    reg_ctx->curr_key, &key);
355         W_ERROR_NOT_OK_RETURN(werr);
356
357         for (i=0; i<token->num_sids; i++) {
358
359                 valname = talloc_asprintf(mem_ctx, "Group%d", count++);
360                 W_ERROR_HAVE_NO_MEMORY(valname);
361
362                 val = sid_string_talloc(mem_ctx, &token->sids[i]);
363                 W_ERROR_HAVE_NO_MEMORY(val);
364                 werr = gp_store_reg_val_sz(mem_ctx, key, valname, val);
365                 W_ERROR_NOT_OK_RETURN(werr);
366         }
367
368         werr = gp_store_reg_val_dword(mem_ctx, key, "Count", count);
369         W_ERROR_NOT_OK_RETURN(werr);
370
371         return WERR_OK;
372 }
373
374 /****************************************************************
375 ****************************************************************/
376 #if 0
377 /* not used yet */
378 static WERROR gp_reg_read_groupmembership(TALLOC_CTX *mem_ctx,
379                                           struct gp_registry_context *reg_ctx,
380                                           const struct dom_sid *object_sid,
381                                           struct security_token **token,
382                                           uint32_t flags)
383 {
384         struct registry_key *key = NULL;
385         WERROR werr;
386         int i = 0;
387         const char *valname = NULL;
388         const char *val = NULL;
389         const char *path = NULL;
390         uint32_t count = 0;
391         int num_token_sids = 0;
392         struct security_token *tmp_token = NULL;
393
394         tmp_token = TALLOC_ZERO_P(mem_ctx, struct security_token);
395         W_ERROR_HAVE_NO_MEMORY(tmp_token);
396
397         path = gp_reg_groupmembership_path(mem_ctx, object_sid, flags);
398         W_ERROR_HAVE_NO_MEMORY(path);
399
400         werr = gp_read_reg_subkey(mem_ctx, reg_ctx, path, &key);
401         W_ERROR_NOT_OK_RETURN(werr);
402
403         werr = gp_read_reg_val_dword(mem_ctx, key, "Count", &count);
404         W_ERROR_NOT_OK_RETURN(werr);
405
406         for (i=0; i<count; i++) {
407
408                 valname = talloc_asprintf(mem_ctx, "Group%d", i);
409                 W_ERROR_HAVE_NO_MEMORY(valname);
410
411                 werr = gp_read_reg_val_sz(mem_ctx, key, valname, &val);
412                 W_ERROR_NOT_OK_RETURN(werr);
413
414                 if (!string_to_sid(&tmp_token->sids[num_token_sids++],
415                                    val)) {
416                         return WERR_INSUFFICIENT_BUFFER;
417                 }
418         }
419
420         tmp_token->num_sids = num_token_sids;
421
422         *token = tmp_token;
423
424         return WERR_OK;
425 }
426 #endif
427 /****************************************************************
428 ****************************************************************/
429
430 static const char *gp_req_state_path(TALLOC_CTX *mem_ctx,
431                                      const struct dom_sid *sid,
432                                      uint32_t flags)
433 {
434         if (flags & GPO_LIST_FLAG_MACHINE) {
435                 return GPO_REG_STATE_MACHINE;
436         }
437
438         return talloc_asprintf(mem_ctx, "%s\\%s", "State", sid_string_tos(sid));
439 }
440
441 /****************************************************************
442 ****************************************************************/
443
444 static WERROR gp_del_reg_state(TALLOC_CTX *mem_ctx,
445                                struct registry_key *key,
446                                const char *path)
447 {
448         return reg_deletesubkeys_recursive(mem_ctx, key, path);
449 }
450
451 /****************************************************************
452 ****************************************************************/
453
454 WERROR gp_reg_state_store(TALLOC_CTX *mem_ctx,
455                           uint32_t flags,
456                           const char *dn,
457                           const struct security_token *token,
458                           struct GROUP_POLICY_OBJECT *gpo_list)
459 {
460         struct gp_registry_context *reg_ctx = NULL;
461         WERROR werr = WERR_GENERAL_FAILURE;
462         const char *subkeyname = NULL;
463         struct GROUP_POLICY_OBJECT *gpo;
464         int count = 0;
465         struct registry_key *key;
466
467         werr = gp_init_reg_ctx(mem_ctx, KEY_GROUP_POLICY, REG_KEY_WRITE,
468                                token, &reg_ctx);
469         W_ERROR_NOT_OK_RETURN(werr);
470
471         werr = gp_secure_key(mem_ctx, flags, reg_ctx->curr_key,
472                              &token->sids[0]);
473         if (!W_ERROR_IS_OK(werr)) {
474                 DEBUG(0,("failed to secure key: %s\n", win_errstr(werr)));
475                 goto done;
476         }
477
478         werr = gp_reg_store_groupmembership(mem_ctx, reg_ctx, token, flags);
479         if (!W_ERROR_IS_OK(werr)) {
480                 DEBUG(0,("failed to store group membership: %s\n", win_errstr(werr)));
481                 goto done;
482         }
483
484         subkeyname = gp_req_state_path(mem_ctx, &token->sids[0], flags);
485         if (!subkeyname) {
486                 werr = WERR_NOMEM;
487                 goto done;
488         }
489
490         werr = gp_del_reg_state(mem_ctx, reg_ctx->curr_key, subkeyname);
491         if (!W_ERROR_IS_OK(werr)) {
492                 DEBUG(0,("failed to delete old state: %s\n", win_errstr(werr)));
493                 /* goto done; */
494         }
495
496         werr = gp_store_reg_subkey(mem_ctx, subkeyname,
497                                    reg_ctx->curr_key, &reg_ctx->curr_key);
498         if (!W_ERROR_IS_OK(werr)) {
499                 goto done;
500         }
501
502         werr = gp_store_reg_val_sz(mem_ctx, reg_ctx->curr_key,
503                                    "Distinguished-Name", dn);
504         if (!W_ERROR_IS_OK(werr)) {
505                 goto done;
506         }
507
508         /* store link list */
509
510         werr = gp_store_reg_subkey(mem_ctx, "GPLink-List",
511                                    reg_ctx->curr_key, &key);
512         if (!W_ERROR_IS_OK(werr)) {
513                 goto done;
514         }
515
516         /* store gpo list */
517
518         werr = gp_store_reg_subkey(mem_ctx, "GPO-List",
519                                    reg_ctx->curr_key, &reg_ctx->curr_key);
520         if (!W_ERROR_IS_OK(werr)) {
521                 goto done;
522         }
523
524         for (gpo = gpo_list; gpo; gpo = gpo->next) {
525
526                 subkeyname = talloc_asprintf(mem_ctx, "%d", count++);
527                 if (!subkeyname) {
528                         werr = WERR_NOMEM;
529                         goto done;
530                 }
531
532                 werr = gp_store_reg_subkey(mem_ctx, subkeyname,
533                                            reg_ctx->curr_key, &key);
534                 if (!W_ERROR_IS_OK(werr)) {
535                         goto done;
536                 }
537
538                 werr = gp_store_reg_gpovals(mem_ctx, key, gpo);
539                 if (!W_ERROR_IS_OK(werr)) {
540                         DEBUG(0,("gp_reg_state_store: "
541                                 "gpo_store_reg_gpovals failed for %s: %s\n",
542                                 gpo->display_name, win_errstr(werr)));
543                         goto done;
544                 }
545         }
546  done:
547         gp_free_reg_ctx(reg_ctx);
548         return werr;
549 }
550
551 /****************************************************************
552 ****************************************************************/
553
554 static WERROR gp_read_reg_gpovals(TALLOC_CTX *mem_ctx,
555                                   struct registry_key *key,
556                                   struct GROUP_POLICY_OBJECT *gpo)
557 {
558         WERROR werr;
559
560         if (!key || !gpo) {
561                 return WERR_INVALID_PARAM;
562         }
563
564         werr = gp_read_reg_val_dword(mem_ctx, key, "Version",
565                                      &gpo->version);
566         W_ERROR_NOT_OK_RETURN(werr);
567
568         werr = gp_read_reg_val_dword(mem_ctx, key, "Options",
569                                      &gpo->options);
570         W_ERROR_NOT_OK_RETURN(werr);
571
572         werr = gp_read_reg_val_sz(mem_ctx, key, "GPOID",
573                                   &gpo->name);
574         W_ERROR_NOT_OK_RETURN(werr);
575
576         werr = gp_read_reg_val_sz(mem_ctx, key, "SOM",
577                                   &gpo->link);
578         W_ERROR_NOT_OK_RETURN(werr);
579
580         werr = gp_read_reg_val_sz(mem_ctx, key, "DisplayName",
581                                   &gpo->display_name);
582         W_ERROR_NOT_OK_RETURN(werr);
583
584         return werr;
585 }
586
587 /****************************************************************
588 ****************************************************************/
589
590 static WERROR gp_read_reg_gpo(TALLOC_CTX *mem_ctx,
591                               struct registry_key *key,
592                               struct GROUP_POLICY_OBJECT **gpo_ret)
593 {
594         struct GROUP_POLICY_OBJECT *gpo = NULL;
595         WERROR werr;
596
597         if (!gpo_ret || !key) {
598                 return WERR_INVALID_PARAM;
599         }
600
601         gpo = TALLOC_ZERO_P(mem_ctx, struct GROUP_POLICY_OBJECT);
602         W_ERROR_HAVE_NO_MEMORY(gpo);
603
604         werr = gp_read_reg_gpovals(mem_ctx, key, gpo);
605         W_ERROR_NOT_OK_RETURN(werr);
606
607         *gpo_ret = gpo;
608
609         return werr;
610 }
611
612 /****************************************************************
613 ****************************************************************/
614
615 WERROR gp_reg_state_read(TALLOC_CTX *mem_ctx,
616                          uint32_t flags,
617                          const struct dom_sid *sid,
618                          struct GROUP_POLICY_OBJECT **gpo_list)
619 {
620         struct gp_registry_context *reg_ctx = NULL;
621         WERROR werr = WERR_GENERAL_FAILURE;
622         const char *subkeyname = NULL;
623         struct GROUP_POLICY_OBJECT *gpo = NULL;
624         int count = 0;
625         struct registry_key *key = NULL;
626         const char *path = NULL;
627         const char *gp_state_path = NULL;
628
629         if (!gpo_list) {
630                 return WERR_INVALID_PARAM;
631         }
632
633         ZERO_STRUCTP(gpo_list);
634
635         gp_state_path = gp_req_state_path(mem_ctx, sid, flags);
636         if (!gp_state_path) {
637                 werr = WERR_NOMEM;
638                 goto done;
639         }
640
641         path = talloc_asprintf(mem_ctx, "%s\\%s\\%s",
642                                KEY_GROUP_POLICY,
643                                gp_state_path,
644                                "GPO-List");
645         if (!path) {
646                 werr = WERR_NOMEM;
647                 goto done;
648         }
649
650         werr = gp_init_reg_ctx(mem_ctx, path, REG_KEY_READ, NULL, &reg_ctx);
651         if (!W_ERROR_IS_OK(werr)) {
652                 goto done;
653         }
654
655         while (1) {
656
657                 subkeyname = talloc_asprintf(mem_ctx, "%d", count++);
658                 if (!subkeyname) {
659                         werr = WERR_NOMEM;
660                         goto done;
661                 }
662
663                 werr = gp_read_reg_subkey(mem_ctx, reg_ctx, subkeyname, &key);
664                 if (W_ERROR_EQUAL(werr, WERR_BADFILE)) {
665                         werr = WERR_OK;
666                         break;
667                 }
668                 if (!W_ERROR_IS_OK(werr)) {
669                         DEBUG(0,("gp_reg_state_read: "
670                                 "gp_read_reg_subkey gave: %s\n",
671                                 win_errstr(werr)));
672                         goto done;
673                 }
674
675                 werr = gp_read_reg_gpo(mem_ctx, key, &gpo);
676                 if (!W_ERROR_IS_OK(werr)) {
677                         goto done;
678                 }
679
680                 DLIST_ADD(*gpo_list, gpo);
681         }
682
683  done:
684         gp_free_reg_ctx(reg_ctx);
685         return werr;
686 }
687
688 /****************************************************************
689 ****************************************************************/
690
691 static WERROR gp_reg_generate_sd(TALLOC_CTX *mem_ctx,
692                                  const struct dom_sid *sid,
693                                  struct security_descriptor **sd,
694                                  size_t *sd_size)
695 {
696         struct security_ace ace[6];
697         uint32_t mask;
698
699         struct security_acl *theacl = NULL;
700
701         uint8_t inherit_flags;
702
703         mask = REG_KEY_ALL;
704         init_sec_ace(&ace[0],
705                      &global_sid_System,
706                      SEC_ACE_TYPE_ACCESS_ALLOWED,
707                      mask, 0);
708
709         mask = REG_KEY_ALL;
710         init_sec_ace(&ace[1],
711                      &global_sid_Builtin_Administrators,
712                      SEC_ACE_TYPE_ACCESS_ALLOWED,
713                      mask, 0);
714
715         mask = REG_KEY_READ;
716         init_sec_ace(&ace[2],
717                      sid ? sid : &global_sid_Authenticated_Users,
718                      SEC_ACE_TYPE_ACCESS_ALLOWED,
719                      mask, 0);
720
721         inherit_flags = SEC_ACE_FLAG_OBJECT_INHERIT |
722                         SEC_ACE_FLAG_CONTAINER_INHERIT |
723                         SEC_ACE_FLAG_INHERIT_ONLY;
724
725         mask = REG_KEY_ALL;
726         init_sec_ace(&ace[3],
727                      &global_sid_System,
728                      SEC_ACE_TYPE_ACCESS_ALLOWED,
729                      mask, inherit_flags);
730
731         mask = REG_KEY_ALL;
732         init_sec_ace(&ace[4],
733                      &global_sid_Builtin_Administrators,
734                      SEC_ACE_TYPE_ACCESS_ALLOWED,
735                      mask, inherit_flags);
736
737         mask = REG_KEY_READ;
738         init_sec_ace(&ace[5],
739                      sid ? sid : &global_sid_Authenticated_Users,
740                      SEC_ACE_TYPE_ACCESS_ALLOWED,
741                      mask, inherit_flags);
742
743         theacl = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 6, ace);
744         W_ERROR_HAVE_NO_MEMORY(theacl);
745
746         *sd = make_sec_desc(mem_ctx, SD_REVISION,
747                             SEC_DESC_SELF_RELATIVE |
748                             SEC_DESC_DACL_AUTO_INHERITED | /* really ? */
749                             SEC_DESC_DACL_AUTO_INHERIT_REQ, /* really ? */
750                             NULL, NULL, NULL,
751                             theacl, sd_size);
752         W_ERROR_HAVE_NO_MEMORY(*sd);
753
754         return WERR_OK;
755 }
756
757 /****************************************************************
758 ****************************************************************/
759
760 WERROR gp_secure_key(TALLOC_CTX *mem_ctx,
761                      uint32_t flags,
762                      struct registry_key *key,
763                      const struct dom_sid *sid)
764 {
765         struct security_descriptor *sd = NULL;
766         size_t sd_size = 0;
767         const struct dom_sid *sd_sid = NULL;
768         WERROR werr;
769
770         if (!(flags & GPO_LIST_FLAG_MACHINE)) {
771                 sd_sid = sid;
772         }
773
774         werr = gp_reg_generate_sd(mem_ctx, sd_sid, &sd, &sd_size);
775         W_ERROR_NOT_OK_RETURN(werr);
776
777         return reg_setkeysecurity(key, sd);
778 }
779
780 /****************************************************************
781 ****************************************************************/
782
783 void dump_reg_val(int lvl, const char *direction,
784                   const char *key, const char *subkey,
785                   struct registry_value *val)
786 {
787         int i = 0;
788         const char *type_str = NULL;
789
790         if (!val) {
791                 DEBUG(lvl,("no val!\n"));
792                 return;
793         }
794
795         type_str = str_regtype(val->type);
796
797         DEBUG(lvl,("\tdump_reg_val:\t%s '%s'\n\t\t\t'%s' %s: ",
798                 direction, key, subkey, type_str));
799
800         switch (val->type) {
801                 case REG_DWORD: {
802                         uint32_t v;
803                         if (val->data.length < 4) {
804                                 break;
805                         }
806                         v = IVAL(val->data.data, 0);
807                         DEBUG(lvl,("%d (0x%08x)\n",
808                                 (int)v, v));
809                         break;
810                 }
811                 case REG_QWORD: {
812                         uint64_t v;
813                         if (val->data.length < 8) {
814                                 break;
815                         }
816                         v = BVAL(val->data.data, 0);
817                         DEBUG(lvl,("%d (0x%016llx)\n",
818                                 (int)v,
819                                 (unsigned long long)v));
820                         break;
821                 }
822                 case REG_SZ: {
823                         const char *s;
824                         if (!pull_reg_sz(talloc_tos(), &val->data, &s)) {
825                                 break;
826                         }
827                         DEBUG(lvl,("%s (length: %d)\n",
828                                    s, (int)strlen_m(s)));
829                         break;
830                 }
831                 case REG_MULTI_SZ: {
832                         const char **a;
833                         if (!pull_reg_multi_sz(talloc_tos(), &val->data, &a)) {
834                                 break;
835                         }
836                         for (i=0; a[i] != NULL; i++) {
837                                 ;;
838                         }
839                         DEBUG(lvl,("(num_strings: %d)\n", i));
840                         for (i=0; a[i] != NULL; i++) {
841                                 DEBUGADD(lvl,("\t%s\n", a[i]));
842                         }
843                         break;
844                 }
845                 case REG_NONE:
846                         DEBUG(lvl,("\n"));
847                         break;
848                 case REG_BINARY:
849                         dump_data(lvl, val->data.data,
850                                   val->data.length);
851                         break;
852                 default:
853                         DEBUG(lvl,("unsupported type: %d\n", val->type));
854                         break;
855         }
856 }
857
858 /****************************************************************
859 ****************************************************************/
860
861 void dump_reg_entry(uint32_t flags,
862                     const char *dir,
863                     struct gp_registry_entry *entry)
864 {
865         if (!(flags & GPO_INFO_FLAG_VERBOSE))
866                 return;
867
868         dump_reg_val(1, dir,
869                      entry->key,
870                      entry->value,
871                      entry->data);
872 }
873
874 /****************************************************************
875 ****************************************************************/
876
877 void dump_reg_entries(uint32_t flags,
878                       const char *dir,
879                       struct gp_registry_entry *entries,
880                       size_t num_entries)
881 {
882         size_t i;
883
884         if (!(flags & GPO_INFO_FLAG_VERBOSE))
885                 return;
886
887         for (i=0; i < num_entries; i++) {
888                 dump_reg_entry(flags, dir, &entries[i]);
889         }
890 }
891
892 /****************************************************************
893 ****************************************************************/
894
895 bool add_gp_registry_entry_to_array(TALLOC_CTX *mem_ctx,
896                                     struct gp_registry_entry *entry,
897                                     struct gp_registry_entry **entries,
898                                     size_t *num)
899 {
900         *entries = TALLOC_REALLOC_ARRAY(mem_ctx, *entries,
901                                         struct gp_registry_entry,
902                                         (*num)+1);
903
904         if (*entries == NULL) {
905                 *num = 0;
906                 return false;
907         }
908
909         (*entries)[*num].action = entry->action;
910         (*entries)[*num].key = entry->key;
911         (*entries)[*num].value = entry->value;
912         (*entries)[*num].data = entry->data;
913
914         *num += 1;
915         return true;
916 }
917
918 /****************************************************************
919 ****************************************************************/
920
921 static const char *gp_reg_action_str(enum gp_reg_action action)
922 {
923         switch (action) {
924                 case GP_REG_ACTION_NONE:
925                         return "GP_REG_ACTION_NONE";
926                 case GP_REG_ACTION_ADD_VALUE:
927                         return "GP_REG_ACTION_ADD_VALUE";
928                 case GP_REG_ACTION_ADD_KEY:
929                         return "GP_REG_ACTION_ADD_KEY";
930                 case GP_REG_ACTION_DEL_VALUES:
931                         return "GP_REG_ACTION_DEL_VALUES";
932                 case GP_REG_ACTION_DEL_VALUE:
933                         return "GP_REG_ACTION_DEL_VALUE";
934                 case GP_REG_ACTION_DEL_ALL_VALUES:
935                         return "GP_REG_ACTION_DEL_ALL_VALUES";
936                 case GP_REG_ACTION_DEL_KEYS:
937                         return "GP_REG_ACTION_DEL_KEYS";
938                 case GP_REG_ACTION_SEC_KEY_SET:
939                         return "GP_REG_ACTION_SEC_KEY_SET";
940                 case GP_REG_ACTION_SEC_KEY_RESET:
941                         return "GP_REG_ACTION_SEC_KEY_RESET";
942                 default:
943                         return "unknown";
944         }
945 }
946
947 /****************************************************************
948 ****************************************************************/
949
950 WERROR reg_apply_registry_entry(TALLOC_CTX *mem_ctx,
951                                 struct registry_key *root_key,
952                                 struct gp_registry_context *reg_ctx,
953                                 struct gp_registry_entry *entry,
954                                 const struct security_token *token,
955                                 uint32_t flags)
956 {
957         WERROR werr;
958         struct registry_key *key = NULL;
959
960         if (flags & GPO_INFO_FLAG_VERBOSE) {
961                 printf("about to store key:    [%s]\n", entry->key);
962                 printf("               value:  [%s]\n", entry->value);
963                 printf("               data:   [%s]\n", str_regtype(entry->data->type));
964                 printf("               action: [%s]\n", gp_reg_action_str(entry->action));
965         }
966
967         werr = gp_store_reg_subkey(mem_ctx, entry->key,
968                                    root_key, &key);
969                                    /* reg_ctx->curr_key, &key); */
970         if (!W_ERROR_IS_OK(werr)) {
971                 DEBUG(0,("gp_store_reg_subkey failed: %s\n", win_errstr(werr)));
972                 return werr;
973         }
974
975         switch (entry->action) {
976                 case GP_REG_ACTION_NONE:
977                 case GP_REG_ACTION_ADD_KEY:
978                         return WERR_OK;
979
980                 case GP_REG_ACTION_SEC_KEY_SET:
981                         werr = gp_secure_key(mem_ctx, flags,
982                                              key,
983                                              &token->sids[0]);
984                         if (!W_ERROR_IS_OK(werr)) {
985                                 DEBUG(0,("reg_apply_registry_entry: "
986                                         "gp_secure_key failed: %s\n",
987                                         win_errstr(werr)));
988                                 return werr;
989                         }
990                         break;
991                 case GP_REG_ACTION_ADD_VALUE:
992                         werr = reg_setvalue(key, entry->value, entry->data);
993                         if (!W_ERROR_IS_OK(werr)) {
994                                 DEBUG(0,("reg_apply_registry_entry: "
995                                         "reg_setvalue failed: %s\n",
996                                         win_errstr(werr)));
997                                 dump_reg_entry(flags, "STORE", entry);
998                                 return werr;
999                         }
1000                         break;
1001                 case GP_REG_ACTION_DEL_VALUE:
1002                         werr = reg_deletevalue(key, entry->value);
1003                         if (!W_ERROR_IS_OK(werr)) {
1004                                 DEBUG(0,("reg_apply_registry_entry: "
1005                                         "reg_deletevalue failed: %s\n",
1006                                         win_errstr(werr)));
1007                                 dump_reg_entry(flags, "STORE", entry);
1008                                 return werr;
1009                         }
1010                         break;
1011                 case GP_REG_ACTION_DEL_ALL_VALUES:
1012                         werr = reg_deleteallvalues(key);
1013                         if (!W_ERROR_IS_OK(werr)) {
1014                                 DEBUG(0,("reg_apply_registry_entry: "
1015                                         "reg_deleteallvalues failed: %s\n",
1016                                         win_errstr(werr)));
1017                                 dump_reg_entry(flags, "STORE", entry);
1018                                 return werr;
1019                         }
1020                         break;
1021                 case GP_REG_ACTION_DEL_VALUES:
1022                 case GP_REG_ACTION_DEL_KEYS:
1023                 case GP_REG_ACTION_SEC_KEY_RESET:
1024                         DEBUG(0,("reg_apply_registry_entry: "
1025                                 "not yet supported: %s (%d)\n",
1026                                 gp_reg_action_str(entry->action),
1027                                 entry->action));
1028                         return WERR_NOT_SUPPORTED;
1029                 default:
1030                         DEBUG(0,("invalid action: %d\n", entry->action));
1031                         return WERR_INVALID_PARAM;
1032         }
1033
1034         return werr;
1035 }
1036