source3/libgpo/gpo_reg.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2007-2008
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "../libgpo/gpo.h"
  22 #include "libgpo/gpo_proto.h"
  23 #include "registry.h"
  24 #include "registry/reg_backend_db.h"
  25 #include "registry/reg_api_util.h"
  26
  27
  28 /****************************************************************
  29 ****************************************************************/
  30
  31 struct security_token *registry_create_system_token(TALLOC_CTX *mem_ctx)
  32 {
  33         struct security_token *token = NULL;
  34
  35         token = TALLOC_ZERO_P(mem_ctx, struct security_token);
  36         if (!token) {
  37                 DEBUG(1,("talloc failed\n"));
  38                 return NULL;
  39         }
  40
  41         token->privilege_mask = SE_ALL_PRIVS;
  42
  43         if (!NT_STATUS_IS_OK(add_sid_to_array(token, &global_sid_System,
  44                          &token->sids, &token->num_sids))) {
  45                 DEBUG(1,("Error adding nt-authority system sid to token\n"));
  46                 return NULL;
  47         }
  48
  49         return token;
  50 }
  51
  52 /****************************************************************
  53 ****************************************************************/
  54
  55 WERROR gp_init_reg_ctx(TALLOC_CTX *mem_ctx,
  56                        const char *initial_path,
  57                        uint32_t desired_access,
  58                        const struct security_token *token,
  59                        struct gp_registry_context **reg_ctx)
  60 {
  61         struct gp_registry_context *tmp_ctx;
  62         WERROR werr;
  63
  64         if (!reg_ctx) {
  65                 return WERR_INVALID_PARAM;
  66         }
  67
  68         werr = registry_init_basic();
  69         if (!W_ERROR_IS_OK(werr)) {
  70                 return werr;
  71         }
  72
  73         tmp_ctx = TALLOC_ZERO_P(mem_ctx, struct gp_registry_context);
  74         W_ERROR_HAVE_NO_MEMORY(tmp_ctx);
  75
  76         if (token) {
  77                 tmp_ctx->token = token;
  78         } else {
  79                 tmp_ctx->token = registry_create_system_token(mem_ctx);
  80         }
  81         if (!tmp_ctx->token) {
  82                 TALLOC_FREE(tmp_ctx);
  83                 return WERR_NOMEM;
  84         }
  85
  86         werr = regdb_open();
  87         if (!W_ERROR_IS_OK(werr)) {
  88                 return werr;
  89         }
  90
  91         if (initial_path) {
  92                 tmp_ctx->path = talloc_strdup(mem_ctx, initial_path);
  93                 if (!tmp_ctx->path) {
  94                         TALLOC_FREE(tmp_ctx);
  95                         return WERR_NOMEM;
  96                 }
  97
  98                 werr = reg_open_path(mem_ctx, tmp_ctx->path, desired_access,
  99                                      tmp_ctx->token, &tmp_ctx->curr_key);
 100                 if (!W_ERROR_IS_OK(werr)) {
 101                         TALLOC_FREE(tmp_ctx);
 102                         return werr;
 103                 }
 104         }
 105
 106         *reg_ctx = tmp_ctx;
 107
 108         return WERR_OK;
 109 }
 110
 111 /****************************************************************
 112 ****************************************************************/
 113
 114 void gp_free_reg_ctx(struct gp_registry_context *reg_ctx)
 115 {
 116         TALLOC_FREE(reg_ctx);
 117 }
 118
 119 /****************************************************************
 120 ****************************************************************/
 121
 122 WERROR gp_store_reg_subkey(TALLOC_CTX *mem_ctx,
 123                            const char *subkeyname,
 124                            struct registry_key *curr_key,
 125                            struct registry_key **new_key)
 126 {
 127         enum winreg_CreateAction action = REG_ACTION_NONE;
 128         WERROR werr;
 129
 130         werr = reg_createkey(mem_ctx, curr_key, subkeyname,
 131                              REG_KEY_WRITE, new_key, &action);
 132         if (W_ERROR_IS_OK(werr) && (action != REG_CREATED_NEW_KEY)) {
 133                 return WERR_OK;
 134         }
 135
 136         return werr;
 137 }
 138
 139 /****************************************************************
 140 ****************************************************************/
 141
 142 WERROR gp_read_reg_subkey(TALLOC_CTX *mem_ctx,
 143                           struct gp_registry_context *reg_ctx,
 144                           const char *subkeyname,
 145                           struct registry_key **key)
 146 {
 147         const char *tmp = NULL;
 148
 149         if (!reg_ctx || !subkeyname || !key) {
 150                 return WERR_INVALID_PARAM;
 151         }
 152
 153         tmp = talloc_asprintf(mem_ctx, "%s\\%s", reg_ctx->path, subkeyname);
 154         W_ERROR_HAVE_NO_MEMORY(tmp);
 155
 156         return reg_open_path(mem_ctx, tmp, REG_KEY_READ,
 157                              reg_ctx->token, key);
 158 }
 159
 160 /****************************************************************
 161 ****************************************************************/
 162
 163 WERROR gp_store_reg_val_sz(TALLOC_CTX *mem_ctx,
 164                            struct registry_key *key,
 165                            const char *val_name,
 166                            const char *val)
 167 {
 168         struct registry_value reg_val;
 169
 170         reg_val.type = REG_SZ;
 171         if (!push_reg_sz(mem_ctx, &reg_val.data, val)) {
 172                 return WERR_NOMEM;
 173         }
 174
 175         return reg_setvalue(key, val_name, &reg_val);
 176 }
 177
 178 /****************************************************************
 179 ****************************************************************/
 180
 181 static WERROR gp_store_reg_val_dword(TALLOC_CTX *mem_ctx,
 182                                      struct registry_key *key,
 183                                      const char *val_name,
 184                                      uint32_t val)
 185 {
 186         struct registry_value reg_val;
 187
 188         reg_val.type = REG_DWORD;
 189         reg_val.data = data_blob_talloc(mem_ctx, NULL, 4);
 190         SIVAL(reg_val.data.data, 0, val);
 191
 192         return reg_setvalue(key, val_name, &reg_val);
 193 }
 194
 195 /****************************************************************
 196 ****************************************************************/
 197
 198 WERROR gp_read_reg_val_sz(TALLOC_CTX *mem_ctx,
 199                           struct registry_key *key,
 200                           const char *val_name,
 201                           const char **val)
 202 {
 203         WERROR werr;
 204         struct registry_value *reg_val = NULL;
 205
 206         werr = reg_queryvalue(mem_ctx, key, val_name, &reg_val);
 207         W_ERROR_NOT_OK_RETURN(werr);
 208
 209         if (reg_val->type != REG_SZ) {
 210                 return WERR_INVALID_DATATYPE;
 211         }
 212
 213         if (!pull_reg_sz(mem_ctx, &reg_val->data, val)) {
 214                 return WERR_NOMEM;
 215         }
 216
 217         return WERR_OK;
 218 }
 219
 220 /****************************************************************
 221 ****************************************************************/
 222
 223 static WERROR gp_read_reg_val_dword(TALLOC_CTX *mem_ctx,
 224                                     struct registry_key *key,
 225                                     const char *val_name,
 226                                     uint32_t *val)
 227 {
 228         WERROR werr;
 229         struct registry_value *reg_val = NULL;
 230
 231         werr = reg_queryvalue(mem_ctx, key, val_name, &reg_val);
 232         W_ERROR_NOT_OK_RETURN(werr);
 233
 234         if (reg_val->type != REG_DWORD) {
 235                 return WERR_INVALID_DATATYPE;
 236         }
 237
 238         if (reg_val->data.length < 4) {
 239                 return WERR_INSUFFICIENT_BUFFER;
 240         }
 241         *val = IVAL(reg_val->data.data, 0);
 242
 243         return WERR_OK;
 244 }
 245
 246 /****************************************************************
 247 ****************************************************************/
 248
 249 static WERROR gp_store_reg_gpovals(TALLOC_CTX *mem_ctx,
 250                                    struct registry_key *key,
 251                                    struct GROUP_POLICY_OBJECT *gpo)
 252 {
 253         WERROR werr;
 254
 255         if (!key || !gpo) {
 256                 return WERR_INVALID_PARAM;
 257         }
 258
 259         werr = gp_store_reg_val_dword(mem_ctx, key, "Version",
 260                                       gpo->version);
 261         W_ERROR_NOT_OK_RETURN(werr);
 262
 263         werr = gp_store_reg_val_dword(mem_ctx, key, "WQLFilterPass",
 264                                       true); /* fake */
 265         W_ERROR_NOT_OK_RETURN(werr);
 266
 267         werr = gp_store_reg_val_dword(mem_ctx, key, "AccessDenied",
 268                                       false); /* fake */
 269         W_ERROR_NOT_OK_RETURN(werr);
 270
 271         werr = gp_store_reg_val_dword(mem_ctx, key, "GPO-Disabled",
 272                                       (gpo->options & GPO_FLAG_DISABLE));
 273         W_ERROR_NOT_OK_RETURN(werr);
 274
 275         werr = gp_store_reg_val_dword(mem_ctx, key, "Options",
 276                                       gpo->options);
 277         W_ERROR_NOT_OK_RETURN(werr);
 278
 279         werr = gp_store_reg_val_sz(mem_ctx, key, "GPOID",
 280                                    gpo->name);
 281         W_ERROR_NOT_OK_RETURN(werr);
 282
 283         werr = gp_store_reg_val_sz(mem_ctx, key, "SOM",
 284                                    gpo->link);
 285         W_ERROR_NOT_OK_RETURN(werr);
 286
 287         werr = gp_store_reg_val_sz(mem_ctx, key, "DisplayName",
 288                                    gpo->display_name);
 289         W_ERROR_NOT_OK_RETURN(werr);
 290
 291         werr = gp_store_reg_val_sz(mem_ctx, key, "WQL-Id",
 292                                    NULL);
 293         W_ERROR_NOT_OK_RETURN(werr);
 294
 295         return werr;
 296 }
 297
 298 /****************************************************************
 299 ****************************************************************/
 300
 301 static const char *gp_reg_groupmembership_path(TALLOC_CTX *mem_ctx,
 302                                                const struct dom_sid *sid,
 303                                                uint32_t flags)
 304 {
 305         if (flags & GPO_LIST_FLAG_MACHINE) {
 306                 return "GroupMembership";
 307         }
 308
 309         return talloc_asprintf(mem_ctx, "%s\\%s", sid_string_tos(sid),
 310                                "GroupMembership");
 311 }
 312
 313 /****************************************************************
 314 ****************************************************************/
 315
 316 static WERROR gp_reg_del_groupmembership(TALLOC_CTX *mem_ctx,
 317                                          struct registry_key *key,
 318                                          const struct security_token *token,
 319                                          uint32_t flags)
 320 {
 321         const char *path = NULL;
 322
 323         path = gp_reg_groupmembership_path(mem_ctx, &token->sids[0],
 324                                            flags);
 325         W_ERROR_HAVE_NO_MEMORY(path);
 326
 327         return reg_deletekey_recursive(mem_ctx, key, path);
 328
 329 }
 330
 331 /****************************************************************
 332 ****************************************************************/
 333
 334 static WERROR gp_reg_store_groupmembership(TALLOC_CTX *mem_ctx,
 335                                            struct gp_registry_context *reg_ctx,
 336                                            const struct security_token *token,
 337                                            uint32_t flags)
 338 {
 339         struct registry_key *key = NULL;
 340         WERROR werr;
 341         int i = 0;
 342         const char *valname = NULL;
 343         const char *path = NULL;
 344         const char *val = NULL;
 345         int count = 0;
 346
 347         path = gp_reg_groupmembership_path(mem_ctx, &token->sids[0],
 348                                            flags);
 349         W_ERROR_HAVE_NO_MEMORY(path);
 350
 351         gp_reg_del_groupmembership(mem_ctx, reg_ctx->curr_key, token, flags);
 352
 353         werr = gp_store_reg_subkey(mem_ctx, path,
 354                                    reg_ctx->curr_key, &key);
 355         W_ERROR_NOT_OK_RETURN(werr);
 356
 357         for (i=0; i<token->num_sids; i++) {
 358
 359                 valname = talloc_asprintf(mem_ctx, "Group%d", count++);
 360                 W_ERROR_HAVE_NO_MEMORY(valname);
 361
 362                 val = sid_string_talloc(mem_ctx, &token->sids[i]);
 363                 W_ERROR_HAVE_NO_MEMORY(val);
 364                 werr = gp_store_reg_val_sz(mem_ctx, key, valname, val);
 365                 W_ERROR_NOT_OK_RETURN(werr);
 366         }
 367
 368         werr = gp_store_reg_val_dword(mem_ctx, key, "Count", count);
 369         W_ERROR_NOT_OK_RETURN(werr);
 370
 371         return WERR_OK;
 372 }
 373
 374 /****************************************************************
 375 ****************************************************************/
 376 #if 0
 377 /* not used yet */
 378 static WERROR gp_reg_read_groupmembership(TALLOC_CTX *mem_ctx,
 379                                           struct gp_registry_context *reg_ctx,
 380                                           const struct dom_sid *object_sid,
 381                                           struct security_token **token,
 382                                           uint32_t flags)
 383 {
 384         struct registry_key *key = NULL;
 385         WERROR werr;
 386         int i = 0;
 387         const char *valname = NULL;
 388         const char *val = NULL;
 389         const char *path = NULL;
 390         uint32_t count = 0;
 391         int num_token_sids = 0;
 392         struct security_token *tmp_token = NULL;
 393
 394         tmp_token = TALLOC_ZERO_P(mem_ctx, struct security_token);
 395         W_ERROR_HAVE_NO_MEMORY(tmp_token);
 396
 397         path = gp_reg_groupmembership_path(mem_ctx, object_sid, flags);
 398         W_ERROR_HAVE_NO_MEMORY(path);
 399
 400         werr = gp_read_reg_subkey(mem_ctx, reg_ctx, path, &key);
 401         W_ERROR_NOT_OK_RETURN(werr);
 402
 403         werr = gp_read_reg_val_dword(mem_ctx, key, "Count", &count);
 404         W_ERROR_NOT_OK_RETURN(werr);
 405
 406         for (i=0; i<count; i++) {
 407
 408                 valname = talloc_asprintf(mem_ctx, "Group%d", i);
 409                 W_ERROR_HAVE_NO_MEMORY(valname);
 410
 411                 werr = gp_read_reg_val_sz(mem_ctx, key, valname, &val);
 412                 W_ERROR_NOT_OK_RETURN(werr);
 413
 414                 if (!string_to_sid(&tmp_token->sids[num_token_sids++],
 415                                    val)) {
 416                         return WERR_INSUFFICIENT_BUFFER;
 417                 }
 418         }
 419
 420         tmp_token->num_sids = num_token_sids;
 421
 422         *token = tmp_token;
 423
 424         return WERR_OK;
 425 }
 426 #endif
 427 /****************************************************************
 428 ****************************************************************/
 429
 430 static const char *gp_req_state_path(TALLOC_CTX *mem_ctx,
 431                                      const struct dom_sid *sid,
 432                                      uint32_t flags)
 433 {
 434         if (flags & GPO_LIST_FLAG_MACHINE) {
 435                 return GPO_REG_STATE_MACHINE;
 436         }
 437
 438         return talloc_asprintf(mem_ctx, "%s\\%s", "State", sid_string_tos(sid));
 439 }
 440
 441 /****************************************************************
 442 ****************************************************************/
 443
 444 static WERROR gp_del_reg_state(TALLOC_CTX *mem_ctx,
 445                                struct registry_key *key,
 446                                const char *path)
 447 {
 448         return reg_deletesubkeys_recursive(mem_ctx, key, path);
 449 }
 450
 451 /****************************************************************
 452 ****************************************************************/
 453
 454 WERROR gp_reg_state_store(TALLOC_CTX *mem_ctx,
 455                           uint32_t flags,
 456                           const char *dn,
 457                           const struct security_token *token,
 458                           struct GROUP_POLICY_OBJECT *gpo_list)
 459 {
 460         struct gp_registry_context *reg_ctx = NULL;
 461         WERROR werr = WERR_GENERAL_FAILURE;
 462         const char *subkeyname = NULL;
 463         struct GROUP_POLICY_OBJECT *gpo;
 464         int count = 0;
 465         struct registry_key *key;
 466
 467         werr = gp_init_reg_ctx(mem_ctx, KEY_GROUP_POLICY, REG_KEY_WRITE,
 468                                token, &reg_ctx);
 469         W_ERROR_NOT_OK_RETURN(werr);
 470
 471         werr = gp_secure_key(mem_ctx, flags, reg_ctx->curr_key,
 472                              &token->sids[0]);
 473         if (!W_ERROR_IS_OK(werr)) {
 474                 DEBUG(0,("failed to secure key: %s\n", win_errstr(werr)));
 475                 goto done;
 476         }
 477
 478         werr = gp_reg_store_groupmembership(mem_ctx, reg_ctx, token, flags);
 479         if (!W_ERROR_IS_OK(werr)) {
 480                 DEBUG(0,("failed to store group membership: %s\n", win_errstr(werr)));
 481                 goto done;
 482         }
 483
 484         subkeyname = gp_req_state_path(mem_ctx, &token->sids[0], flags);
 485         if (!subkeyname) {
 486                 werr = WERR_NOMEM;
 487                 goto done;
 488         }
 489
 490         werr = gp_del_reg_state(mem_ctx, reg_ctx->curr_key, subkeyname);
 491         if (!W_ERROR_IS_OK(werr)) {
 492                 DEBUG(0,("failed to delete old state: %s\n", win_errstr(werr)));
 493                 /* goto done; */
 494         }
 495
 496         werr = gp_store_reg_subkey(mem_ctx, subkeyname,
 497                                    reg_ctx->curr_key, &reg_ctx->curr_key);
 498         if (!W_ERROR_IS_OK(werr)) {
 499                 goto done;
 500         }
 501
 502         werr = gp_store_reg_val_sz(mem_ctx, reg_ctx->curr_key,
 503                                    "Distinguished-Name", dn);
 504         if (!W_ERROR_IS_OK(werr)) {
 505                 goto done;
 506         }
 507
 508         /* store link list */
 509
 510         werr = gp_store_reg_subkey(mem_ctx, "GPLink-List",
 511                                    reg_ctx->curr_key, &key);
 512         if (!W_ERROR_IS_OK(werr)) {
 513                 goto done;
 514         }
 515
 516         /* store gpo list */
 517
 518         werr = gp_store_reg_subkey(mem_ctx, "GPO-List",
 519                                    reg_ctx->curr_key, &reg_ctx->curr_key);
 520         if (!W_ERROR_IS_OK(werr)) {
 521                 goto done;
 522         }
 523
 524         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 525
 526                 subkeyname = talloc_asprintf(mem_ctx, "%d", count++);
 527                 if (!subkeyname) {
 528                         werr = WERR_NOMEM;
 529                         goto done;
 530                 }
 531
 532                 werr = gp_store_reg_subkey(mem_ctx, subkeyname,
 533                                            reg_ctx->curr_key, &key);
 534                 if (!W_ERROR_IS_OK(werr)) {
 535                         goto done;
 536                 }
 537
 538                 werr = gp_store_reg_gpovals(mem_ctx, key, gpo);
 539                 if (!W_ERROR_IS_OK(werr)) {
 540                         DEBUG(0,("gp_reg_state_store: "
 541                                 "gpo_store_reg_gpovals failed for %s: %s\n",
 542                                 gpo->display_name, win_errstr(werr)));
 543                         goto done;
 544                 }
 545         }
 546  done:
 547         gp_free_reg_ctx(reg_ctx);
 548         return werr;
 549 }
 550
 551 /****************************************************************
 552 ****************************************************************/
 553
 554 static WERROR gp_read_reg_gpovals(TALLOC_CTX *mem_ctx,
 555                                   struct registry_key *key,
 556                                   struct GROUP_POLICY_OBJECT *gpo)
 557 {
 558         WERROR werr;
 559
 560         if (!key || !gpo) {
 561                 return WERR_INVALID_PARAM;
 562         }
 563
 564         werr = gp_read_reg_val_dword(mem_ctx, key, "Version",
 565                                      &gpo->version);
 566         W_ERROR_NOT_OK_RETURN(werr);
 567
 568         werr = gp_read_reg_val_dword(mem_ctx, key, "Options",
 569                                      &gpo->options);
 570         W_ERROR_NOT_OK_RETURN(werr);
 571
 572         werr = gp_read_reg_val_sz(mem_ctx, key, "GPOID",
 573                                   &gpo->name);
 574         W_ERROR_NOT_OK_RETURN(werr);
 575
 576         werr = gp_read_reg_val_sz(mem_ctx, key, "SOM",
 577                                   &gpo->link);
 578         W_ERROR_NOT_OK_RETURN(werr);
 579
 580         werr = gp_read_reg_val_sz(mem_ctx, key, "DisplayName",
 581                                   &gpo->display_name);
 582         W_ERROR_NOT_OK_RETURN(werr);
 583
 584         return werr;
 585 }
 586
 587 /****************************************************************
 588 ****************************************************************/
 589
 590 static WERROR gp_read_reg_gpo(TALLOC_CTX *mem_ctx,
 591                               struct registry_key *key,
 592                               struct GROUP_POLICY_OBJECT **gpo_ret)
 593 {
 594         struct GROUP_POLICY_OBJECT *gpo = NULL;
 595         WERROR werr;
 596
 597         if (!gpo_ret || !key) {
 598                 return WERR_INVALID_PARAM;
 599         }
 600
 601         gpo = TALLOC_ZERO_P(mem_ctx, struct GROUP_POLICY_OBJECT);
 602         W_ERROR_HAVE_NO_MEMORY(gpo);
 603
 604         werr = gp_read_reg_gpovals(mem_ctx, key, gpo);
 605         W_ERROR_NOT_OK_RETURN(werr);
 606
 607         *gpo_ret = gpo;
 608
 609         return werr;
 610 }
 611
 612 /****************************************************************
 613 ****************************************************************/
 614
 615 WERROR gp_reg_state_read(TALLOC_CTX *mem_ctx,
 616                          uint32_t flags,
 617                          const struct dom_sid *sid,
 618                          struct GROUP_POLICY_OBJECT **gpo_list)
 619 {
 620         struct gp_registry_context *reg_ctx = NULL;
 621         WERROR werr = WERR_GENERAL_FAILURE;
 622         const char *subkeyname = NULL;
 623         struct GROUP_POLICY_OBJECT *gpo = NULL;
 624         int count = 0;
 625         struct registry_key *key = NULL;
 626         const char *path = NULL;
 627         const char *gp_state_path = NULL;
 628
 629         if (!gpo_list) {
 630                 return WERR_INVALID_PARAM;
 631         }
 632
 633         ZERO_STRUCTP(gpo_list);
 634
 635         gp_state_path = gp_req_state_path(mem_ctx, sid, flags);
 636         if (!gp_state_path) {
 637                 werr = WERR_NOMEM;
 638                 goto done;
 639         }
 640
 641         path = talloc_asprintf(mem_ctx, "%s\\%s\\%s",
 642                                KEY_GROUP_POLICY,
 643                                gp_state_path,
 644                                "GPO-List");
 645         if (!path) {
 646                 werr = WERR_NOMEM;
 647                 goto done;
 648         }
 649
 650         werr = gp_init_reg_ctx(mem_ctx, path, REG_KEY_READ, NULL, &reg_ctx);
 651         if (!W_ERROR_IS_OK(werr)) {
 652                 goto done;
 653         }
 654
 655         while (1) {
 656
 657                 subkeyname = talloc_asprintf(mem_ctx, "%d", count++);
 658                 if (!subkeyname) {
 659                         werr = WERR_NOMEM;
 660                         goto done;
 661                 }
 662
 663                 werr = gp_read_reg_subkey(mem_ctx, reg_ctx, subkeyname, &key);
 664                 if (W_ERROR_EQUAL(werr, WERR_BADFILE)) {
 665                         werr = WERR_OK;
 666                         break;
 667                 }
 668                 if (!W_ERROR_IS_OK(werr)) {
 669                         DEBUG(0,("gp_reg_state_read: "
 670                                 "gp_read_reg_subkey gave: %s\n",
 671                                 win_errstr(werr)));
 672                         goto done;
 673                 }
 674
 675                 werr = gp_read_reg_gpo(mem_ctx, key, &gpo);
 676                 if (!W_ERROR_IS_OK(werr)) {
 677                         goto done;
 678                 }
 679
 680                 DLIST_ADD(*gpo_list, gpo);
 681         }
 682
 683  done:
 684         gp_free_reg_ctx(reg_ctx);
 685         return werr;
 686 }
 687
 688 /****************************************************************
 689 ****************************************************************/
 690
 691 static WERROR gp_reg_generate_sd(TALLOC_CTX *mem_ctx,
 692                                  const struct dom_sid *sid,
 693                                  struct security_descriptor **sd,
 694                                  size_t *sd_size)
 695 {
 696         struct security_ace ace[6];
 697         uint32_t mask;
 698
 699         struct security_acl *theacl = NULL;
 700
 701         uint8_t inherit_flags;
 702
 703         mask = REG_KEY_ALL;
 704         init_sec_ace(&ace[0],
 705                      &global_sid_System,
 706                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 707                      mask, 0);
 708
 709         mask = REG_KEY_ALL;
 710         init_sec_ace(&ace[1],
 711                      &global_sid_Builtin_Administrators,
 712                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 713                      mask, 0);
 714
 715         mask = REG_KEY_READ;
 716         init_sec_ace(&ace[2],
 717                      sid ? sid : &global_sid_Authenticated_Users,
 718                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 719                      mask, 0);
 720
 721         inherit_flags = SEC_ACE_FLAG_OBJECT_INHERIT |
 722                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 723                         SEC_ACE_FLAG_INHERIT_ONLY;
 724
 725         mask = REG_KEY_ALL;
 726         init_sec_ace(&ace[3],
 727                      &global_sid_System,
 728                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 729                      mask, inherit_flags);
 730
 731         mask = REG_KEY_ALL;
 732         init_sec_ace(&ace[4],
 733                      &global_sid_Builtin_Administrators,
 734                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 735                      mask, inherit_flags);
 736
 737         mask = REG_KEY_READ;
 738         init_sec_ace(&ace[5],
 739                      sid ? sid : &global_sid_Authenticated_Users,
 740                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 741                      mask, inherit_flags);
 742
 743         theacl = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 6, ace);
 744         W_ERROR_HAVE_NO_MEMORY(theacl);
 745
 746         *sd = make_sec_desc(mem_ctx, SD_REVISION,
 747                             SEC_DESC_SELF_RELATIVE |
 748                             SEC_DESC_DACL_AUTO_INHERITED | /* really ? */
 749                             SEC_DESC_DACL_AUTO_INHERIT_REQ, /* really ? */
 750                             NULL, NULL, NULL,
 751                             theacl, sd_size);
 752         W_ERROR_HAVE_NO_MEMORY(*sd);
 753
 754         return WERR_OK;
 755 }
 756
 757 /****************************************************************
 758 ****************************************************************/
 759
 760 WERROR gp_secure_key(TALLOC_CTX *mem_ctx,
 761                      uint32_t flags,
 762                      struct registry_key *key,
 763                      const struct dom_sid *sid)
 764 {
 765         struct security_descriptor *sd = NULL;
 766         size_t sd_size = 0;
 767         const struct dom_sid *sd_sid = NULL;
 768         WERROR werr;
 769
 770         if (!(flags & GPO_LIST_FLAG_MACHINE)) {
 771                 sd_sid = sid;
 772         }
 773
 774         werr = gp_reg_generate_sd(mem_ctx, sd_sid, &sd, &sd_size);
 775         W_ERROR_NOT_OK_RETURN(werr);
 776
 777         return reg_setkeysecurity(key, sd);
 778 }
 779
 780 /****************************************************************
 781 ****************************************************************/
 782
 783 void dump_reg_val(int lvl, const char *direction,
 784                   const char *key, const char *subkey,
 785                   struct registry_value *val)
 786 {
 787         int i = 0;
 788         const char *type_str = NULL;
 789
 790         if (!val) {
 791                 DEBUG(lvl,("no val!\n"));
 792                 return;
 793         }
 794
 795         type_str = str_regtype(val->type);
 796
 797         DEBUG(lvl,("\tdump_reg_val:\t%s '%s'\n\t\t\t'%s' %s: ",
 798                 direction, key, subkey, type_str));
 799
 800         switch (val->type) {
 801                 case REG_DWORD: {
 802                         uint32_t v;
 803                         if (val->data.length < 4) {
 804                                 break;
 805                         }
 806                         v = IVAL(val->data.data, 0);
 807                         DEBUG(lvl,("%d (0x%08x)\n",
 808                                 (int)v, v));
 809                         break;
 810                 }
 811                 case REG_QWORD: {
 812                         uint64_t v;
 813                         if (val->data.length < 8) {
 814                                 break;
 815                         }
 816                         v = BVAL(val->data.data, 0);
 817                         DEBUG(lvl,("%d (0x%016llx)\n",
 818                                 (int)v,
 819                                 (unsigned long long)v));
 820                         break;
 821                 }
 822                 case REG_SZ: {
 823                         const char *s;
 824                         if (!pull_reg_sz(talloc_tos(), &val->data, &s)) {
 825                                 break;
 826                         }
 827                         DEBUG(lvl,("%s (length: %d)\n",
 828                                    s, (int)strlen_m(s)));
 829                         break;
 830                 }
 831                 case REG_MULTI_SZ: {
 832                         const char **a;
 833                         if (!pull_reg_multi_sz(talloc_tos(), &val->data, &a)) {
 834                                 break;
 835                         }
 836                         for (i=0; a[i] != NULL; i++) {
 837                                 ;;
 838                         }
 839                         DEBUG(lvl,("(num_strings: %d)\n", i));
 840                         for (i=0; a[i] != NULL; i++) {
 841                                 DEBUGADD(lvl,("\t%s\n", a[i]));
 842                         }
 843                         break;
 844                 }
 845                 case REG_NONE:
 846                         DEBUG(lvl,("\n"));
 847                         break;
 848                 case REG_BINARY:
 849                         dump_data(lvl, val->data.data,
 850                                   val->data.length);
 851                         break;
 852                 default:
 853                         DEBUG(lvl,("unsupported type: %d\n", val->type));
 854                         break;
 855         }
 856 }
 857
 858 /****************************************************************
 859 ****************************************************************/
 860
 861 void dump_reg_entry(uint32_t flags,
 862                     const char *dir,
 863                     struct gp_registry_entry *entry)
 864 {
 865         if (!(flags & GPO_INFO_FLAG_VERBOSE))
 866                 return;
 867
 868         dump_reg_val(1, dir,
 869                      entry->key,
 870                      entry->value,
 871                      entry->data);
 872 }
 873
 874 /****************************************************************
 875 ****************************************************************/
 876
 877 void dump_reg_entries(uint32_t flags,
 878                       const char *dir,
 879                       struct gp_registry_entry *entries,
 880                       size_t num_entries)
 881 {
 882         size_t i;
 883
 884         if (!(flags & GPO_INFO_FLAG_VERBOSE))
 885                 return;
 886
 887         for (i=0; i < num_entries; i++) {
 888                 dump_reg_entry(flags, dir, &entries[i]);
 889         }
 890 }
 891
 892 /****************************************************************
 893 ****************************************************************/
 894
 895 bool add_gp_registry_entry_to_array(TALLOC_CTX *mem_ctx,
 896                                     struct gp_registry_entry *entry,
 897                                     struct gp_registry_entry **entries,
 898                                     size_t *num)
 899 {
 900         *entries = TALLOC_REALLOC_ARRAY(mem_ctx, *entries,
 901                                         struct gp_registry_entry,
 902                                         (*num)+1);
 903
 904         if (*entries == NULL) {
 905                 *num = 0;
 906                 return false;
 907         }
 908
 909         (*entries)[*num].action = entry->action;
 910         (*entries)[*num].key = entry->key;
 911         (*entries)[*num].value = entry->value;
 912         (*entries)[*num].data = entry->data;
 913
 914         *num += 1;
 915         return true;
 916 }
 917
 918 /****************************************************************
 919 ****************************************************************/
 920
 921 static const char *gp_reg_action_str(enum gp_reg_action action)
 922 {
 923         switch (action) {
 924                 case GP_REG_ACTION_NONE:
 925                         return "GP_REG_ACTION_NONE";
 926                 case GP_REG_ACTION_ADD_VALUE:
 927                         return "GP_REG_ACTION_ADD_VALUE";
 928                 case GP_REG_ACTION_ADD_KEY:
 929                         return "GP_REG_ACTION_ADD_KEY";
 930                 case GP_REG_ACTION_DEL_VALUES:
 931                         return "GP_REG_ACTION_DEL_VALUES";
 932                 case GP_REG_ACTION_DEL_VALUE:
 933                         return "GP_REG_ACTION_DEL_VALUE";
 934                 case GP_REG_ACTION_DEL_ALL_VALUES:
 935                         return "GP_REG_ACTION_DEL_ALL_VALUES";
 936                 case GP_REG_ACTION_DEL_KEYS:
 937                         return "GP_REG_ACTION_DEL_KEYS";
 938                 case GP_REG_ACTION_SEC_KEY_SET:
 939                         return "GP_REG_ACTION_SEC_KEY_SET";
 940                 case GP_REG_ACTION_SEC_KEY_RESET:
 941                         return "GP_REG_ACTION_SEC_KEY_RESET";
 942                 default:
 943                         return "unknown";
 944         }
 945 }
 946
 947 /****************************************************************
 948 ****************************************************************/
 949
 950 WERROR reg_apply_registry_entry(TALLOC_CTX *mem_ctx,
 951                                 struct registry_key *root_key,
 952                                 struct gp_registry_context *reg_ctx,
 953                                 struct gp_registry_entry *entry,
 954                                 const struct security_token *token,
 955                                 uint32_t flags)
 956 {
 957         WERROR werr;
 958         struct registry_key *key = NULL;
 959
 960         if (flags & GPO_INFO_FLAG_VERBOSE) {
 961                 printf("about to store key:    [%s]\n", entry->key);
 962                 printf("               value:  [%s]\n", entry->value);
 963                 printf("               data:   [%s]\n", str_regtype(entry->data->type));
 964                 printf("               action: [%s]\n", gp_reg_action_str(entry->action));
 965         }
 966
 967         werr = gp_store_reg_subkey(mem_ctx, entry->key,
 968                                    root_key, &key);
 969                                    /* reg_ctx->curr_key, &key); */
 970         if (!W_ERROR_IS_OK(werr)) {
 971                 DEBUG(0,("gp_store_reg_subkey failed: %s\n", win_errstr(werr)));
 972                 return werr;
 973         }
 974
 975         switch (entry->action) {
 976                 case GP_REG_ACTION_NONE:
 977                 case GP_REG_ACTION_ADD_KEY:
 978                         return WERR_OK;
 979
 980                 case GP_REG_ACTION_SEC_KEY_SET:
 981                         werr = gp_secure_key(mem_ctx, flags,
 982                                              key,
 983                                              &token->sids[0]);
 984                         if (!W_ERROR_IS_OK(werr)) {
 985                                 DEBUG(0,("reg_apply_registry_entry: "
 986                                         "gp_secure_key failed: %s\n",
 987                                         win_errstr(werr)));
 988                                 return werr;
 989                         }
 990                         break;
 991                 case GP_REG_ACTION_ADD_VALUE:
 992                         werr = reg_setvalue(key, entry->value, entry->data);
 993                         if (!W_ERROR_IS_OK(werr)) {
 994                                 DEBUG(0,("reg_apply_registry_entry: "
 995                                         "reg_setvalue failed: %s\n",
 996                                         win_errstr(werr)));
 997                                 dump_reg_entry(flags, "STORE", entry);
 998                                 return werr;
 999                         }
1000                         break;
1001                 case GP_REG_ACTION_DEL_VALUE:
1002                         werr = reg_deletevalue(key, entry->value);
1003                         if (!W_ERROR_IS_OK(werr)) {
1004                                 DEBUG(0,("reg_apply_registry_entry: "
1005                                         "reg_deletevalue failed: %s\n",
1006                                         win_errstr(werr)));
1007                                 dump_reg_entry(flags, "STORE", entry);
1008                                 return werr;
1009                         }
1010                         break;
1011                 case GP_REG_ACTION_DEL_ALL_VALUES:
1012                         werr = reg_deleteallvalues(key);
1013                         if (!W_ERROR_IS_OK(werr)) {
1014                                 DEBUG(0,("reg_apply_registry_entry: "
1015                                         "reg_deleteallvalues failed: %s\n",
1016                                         win_errstr(werr)));
1017                                 dump_reg_entry(flags, "STORE", entry);
1018                                 return werr;
1019                         }
1020                         break;
1021                 case GP_REG_ACTION_DEL_VALUES:
1022                 case GP_REG_ACTION_DEL_KEYS:
1023                 case GP_REG_ACTION_SEC_KEY_RESET:
1024                         DEBUG(0,("reg_apply_registry_entry: "
1025                                 "not yet supported: %s (%d)\n",
1026                                 gp_reg_action_str(entry->action),
1027                                 entry->action));
1028                         return WERR_NOT_SUPPORTED;
1029                 default:
1030                         DEBUG(0,("invalid action: %d\n", entry->action));
1031                         return WERR_INVALID_PARAM;
1032         }
1033
1034         return werr;
1035 }
1036