libcli/security/access_check.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Andrew Tridgell 2004
   5    Copyright (C) Gerald Carter 2005
   6    Copyright (C) Volker Lendecke 2007
   7    Copyright (C) Jeremy Allison 2008
   8    Copyright (C) Andrew Bartlett 2010
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "libcli/security/security.h"
  26
  27 /* Map generic access rights to object specific rights.  This technique is
  28    used to give meaning to assigning read, write, execute and all access to
  29    objects.  Each type of object has its own mapping of generic to object
  30    specific access rights. */
  31
  32 void se_map_generic(uint32_t *access_mask, const struct generic_mapping *mapping)
  33 {
  34         uint32_t old_mask = *access_mask;
  35
  36         if (*access_mask & GENERIC_READ_ACCESS) {
  37                 *access_mask &= ~GENERIC_READ_ACCESS;
  38                 *access_mask |= mapping->generic_read;
  39         }
  40
  41         if (*access_mask & GENERIC_WRITE_ACCESS) {
  42                 *access_mask &= ~GENERIC_WRITE_ACCESS;
  43                 *access_mask |= mapping->generic_write;
  44         }
  45
  46         if (*access_mask & GENERIC_EXECUTE_ACCESS) {
  47                 *access_mask &= ~GENERIC_EXECUTE_ACCESS;
  48                 *access_mask |= mapping->generic_execute;
  49         }
  50
  51         if (*access_mask & GENERIC_ALL_ACCESS) {
  52                 *access_mask &= ~GENERIC_ALL_ACCESS;
  53                 *access_mask |= mapping->generic_all;
  54         }
  55
  56         if (old_mask != *access_mask) {
  57                 DEBUG(10, ("se_map_generic(): mapped mask 0x%08x to 0x%08x\n",
  58                            old_mask, *access_mask));
  59         }
  60 }
  61
  62 /* Map generic access rights to object specific rights for all the ACE's
  63  * in a security_acl.
  64  */
  65
  66 void security_acl_map_generic(struct security_acl *sa,
  67                                 const struct generic_mapping *mapping)
  68 {
  69         unsigned int i;
  70
  71         if (!sa) {
  72                 return;
  73         }
  74
  75         for (i = 0; i < sa->num_aces; i++) {
  76                 se_map_generic(&sa->aces[i].access_mask, mapping);
  77         }
  78 }
  79
  80 /* Map standard access rights to object specific rights.  This technique is
  81    used to give meaning to assigning read, write, execute and all access to
  82    objects.  Each type of object has its own mapping of standard to object
  83    specific access rights. */
  84
  85 void se_map_standard(uint32_t *access_mask, const struct standard_mapping *mapping)
  86 {
  87         uint32_t old_mask = *access_mask;
  88
  89         if (*access_mask & SEC_STD_READ_CONTROL) {
  90                 *access_mask &= ~SEC_STD_READ_CONTROL;
  91                 *access_mask |= mapping->std_read;
  92         }
  93
  94         if (*access_mask & (SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE)) {
  95                 *access_mask &= ~(SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE);
  96                 *access_mask |= mapping->std_all;
  97         }
  98
  99         if (old_mask != *access_mask) {
 100                 DEBUG(10, ("se_map_standard(): mapped mask 0x%08x to 0x%08x\n",
 101                            old_mask, *access_mask));
 102         }
 103 }
 104
 105 /*
 106   perform a SEC_FLAG_MAXIMUM_ALLOWED access check
 107 */
 108 static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
 109                                         const struct security_token *token)
 110 {
 111         uint32_t denied = 0, granted = 0;
 112         unsigned i;
 113
 114         if (security_token_has_sid(token, sd->owner_sid)) {
 115                 granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL;
 116         }
 117
 118         if (sd->dacl == NULL) {
 119                 return granted & ~denied;
 120         }
 121
 122         for (i = 0;i<sd->dacl->num_aces; i++) {
 123                 struct security_ace *ace = &sd->dacl->aces[i];
 124
 125                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 126                         continue;
 127                 }
 128
 129                 if (!security_token_has_sid(token, &ace->trustee)) {
 130                         continue;
 131                 }
 132
 133                 switch (ace->type) {
 134                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 135                         granted |= ace->access_mask;
 136                         break;
 137                 case SEC_ACE_TYPE_ACCESS_DENIED:
 138                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 139                         denied |= ace->access_mask;
 140                         break;
 141                 default:        /* Other ACE types not handled/supported */
 142                         break;
 143                 }
 144         }
 145
 146         return granted & ~denied;
 147 }
 148
 149 /*
 150   The main entry point for access checking. If returning ACCESS_DENIED
 151   this function returns the denied bits in the uint32_t pointed
 152   to by the access_granted pointer.
 153 */
 154 NTSTATUS se_access_check(const struct security_descriptor *sd,
 155                           const struct security_token *token,
 156                           uint32_t access_desired,
 157                           uint32_t *access_granted)
 158 {
 159         uint32_t i;
 160         uint32_t bits_remaining;
 161         uint32_t explicitly_denied_bits = 0;
 162         /*
 163          * Up until Windows Server 2008, owner always had these rights. Now
 164          * we have to use Owner Rights perms if they are on the file.
 165          *
 166          * In addition we have to accumulate these bits and apply them
 167          * correctly. See bug #8795
 168          */
 169         uint32_t owner_rights_allowed = 0;
 170         uint32_t owner_rights_denied = 0;
 171         bool owner_rights_default = true;
 172
 173         *access_granted = access_desired;
 174         bits_remaining = access_desired;
 175
 176         /* handle the maximum allowed flag */
 177         if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
 178                 uint32_t orig_access_desired = access_desired;
 179
 180                 access_desired |= access_check_max_allowed(sd, token);
 181                 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
 182                 *access_granted = access_desired;
 183                 bits_remaining = access_desired;
 184
 185                 DEBUG(10,("se_access_check: MAX desired = 0x%x, granted = 0x%x, remaining = 0x%x\n",
 186                         orig_access_desired,
 187                         *access_granted,
 188                         bits_remaining));
 189         }
 190
 191         /* a NULL dacl allows access */
 192         if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
 193                 *access_granted = access_desired;
 194                 return NT_STATUS_OK;
 195         }
 196
 197         if (sd->dacl == NULL) {
 198                 goto done;
 199         }
 200
 201         /* check each ace in turn. */
 202         for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
 203                 struct security_ace *ace = &sd->dacl->aces[i];
 204
 205                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 206                         continue;
 207                 }
 208
 209                 /*
 210                  * We need the Owner Rights permissions to ensure we
 211                  * give or deny the correct permissions to the owner. Replace
 212                  * owner_rights with the perms here if it is present.
 213                  *
 214                  * We don't care if we are not the owner because that is taken
 215                  * care of below when we check if our token has the owner SID.
 216                  *
 217                  */
 218                 if (dom_sid_equal(&ace->trustee, &global_sid_Owner_Rights)) {
 219                         if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
 220                                 owner_rights_allowed |= ace->access_mask;
 221                                 owner_rights_default = false;
 222                         } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
 223                                 owner_rights_denied |= ace->access_mask;
 224                                 owner_rights_default = false;
 225                         }
 226                         continue;
 227                 }
 228
 229                 if (!security_token_has_sid(token, &ace->trustee)) {
 230                         continue;
 231                 }
 232
 233                 switch (ace->type) {
 234                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 235                         bits_remaining &= ~ace->access_mask;
 236                         break;
 237                 case SEC_ACE_TYPE_ACCESS_DENIED:
 238                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 239                         explicitly_denied_bits |= (bits_remaining & ace->access_mask);
 240                         break;
 241                 default:        /* Other ACE types not handled/supported */
 242                         break;
 243                 }
 244         }
 245
 246         /* Explicitly denied bits always override */
 247         bits_remaining |= explicitly_denied_bits;
 248
 249         /* The owner always gets owner rights as defined above. */
 250         if (security_token_has_sid(token, sd->owner_sid)) {
 251                 if (owner_rights_default) {
 252                         /*
 253                          * Just remove them, no need to check if they are
 254                          * there.
 255                          */
 256                         bits_remaining &= ~(SEC_STD_WRITE_DAC |
 257                                                 SEC_STD_READ_CONTROL);
 258                 } else {
 259                         bits_remaining &= ~owner_rights_allowed;
 260                         bits_remaining |= owner_rights_denied;
 261                 }
 262         }
 263
 264         /*
 265          * We check privileges here because they override even DENY entries.
 266          */
 267
 268         /* Does the user have the privilege to gain SEC_PRIV_SECURITY? */
 269         if (bits_remaining & SEC_FLAG_SYSTEM_SECURITY) {
 270                 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
 271                         bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
 272                 } else {
 273                         return NT_STATUS_PRIVILEGE_NOT_HELD;
 274                 }
 275         }
 276
 277         if ((bits_remaining & SEC_STD_WRITE_OWNER) &&
 278              security_token_has_privilege(token, SEC_PRIV_TAKE_OWNERSHIP)) {
 279                 bits_remaining &= ~(SEC_STD_WRITE_OWNER);
 280         }
 281
 282 done:
 283         if (bits_remaining != 0) {
 284                 *access_granted = bits_remaining;
 285                 return NT_STATUS_ACCESS_DENIED;
 286         }
 287
 288         return NT_STATUS_OK;
 289 }
 290
 291 /*
 292   The main entry point for access checking FOR THE FILE SERVER ONLY !
 293   If returning ACCESS_DENIED this function returns the denied bits in
 294   the uint32_t pointed to by the access_granted pointer.
 295 */
 296 NTSTATUS se_file_access_check(const struct security_descriptor *sd,
 297                           const struct security_token *token,
 298                           bool priv_open_requested,
 299                           uint32_t access_desired,
 300                           uint32_t *access_granted)
 301 {
 302         uint32_t bits_remaining;
 303         NTSTATUS status;
 304
 305         if (!priv_open_requested) {
 306                 /* Fall back to generic se_access_check(). */
 307                 return se_access_check(sd,
 308                                 token,
 309                                 access_desired,
 310                                 access_granted);
 311         }
 312
 313         /*
 314          * We need to handle the maximum allowed flag
 315          * outside of se_access_check(), as we need to
 316          * add in the access allowed by the privileges
 317          * as well.
 318          */
 319
 320         if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
 321                 uint32_t orig_access_desired = access_desired;
 322
 323                 access_desired |= access_check_max_allowed(sd, token);
 324                 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
 325
 326                 if (security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
 327                         access_desired |= SEC_RIGHTS_PRIV_BACKUP;
 328                 }
 329
 330                 if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
 331                         access_desired |= SEC_RIGHTS_PRIV_RESTORE;
 332                 }
 333
 334                 DEBUG(10,("se_file_access_check: MAX desired = 0x%x "
 335                         "mapped to 0x%x\n",
 336                         orig_access_desired,
 337                         access_desired));
 338         }
 339
 340         status = se_access_check(sd,
 341                                 token,
 342                                 access_desired,
 343                                 access_granted);
 344
 345         if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 346                 return status;
 347         }
 348
 349         bits_remaining = *access_granted;
 350
 351         /* Check if we should override with privileges. */
 352         if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
 353             security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
 354                 bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
 355         }
 356         if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
 357             security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
 358                 bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
 359         }
 360         if (bits_remaining != 0) {
 361                 *access_granted = bits_remaining;
 362                 return NT_STATUS_ACCESS_DENIED;
 363         }
 364
 365         return NT_STATUS_OK;
 366 }
 367
 368 static const struct GUID *get_ace_object_type(struct security_ace *ace)
 369 {
 370         if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
 371                 return &ace->object.object.type.type;
 372         }
 373
 374         return NULL;
 375 }
 376
 377 /**
 378  * @brief Perform directoryservice (DS) related access checks for a given user
 379  *
 380  * Perform DS access checks for the user represented by its security_token, on
 381  * the provided security descriptor. If an tree associating GUID and access
 382  * required is provided then object access (OA) are checked as well. *
 383  * @param[in]   sd             The security descritor against which the required
 384  *                             access are requested
 385  *
 386  * @param[in]   token          The security_token associated with the user to
 387  *                             test
 388  *
 389  * @param[in]   access_desired A bitfield of rights that must be granted for the
 390  *                             given user in the specified SD.
 391  *
 392  * If one
 393  * of the entry in the tree grants all the requested rights for the given GUID
 394  * FIXME
 395  * tree can be null if not null it's the
 396  * Lots of code duplication, it will ve united in just one
 397  * function eventually */
 398
 399 NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
 400                              const struct security_token *token,
 401                              uint32_t access_desired,
 402                              uint32_t *access_granted,
 403                              struct object_tree *tree,
 404                              struct dom_sid *replace_sid)
 405 {
 406         uint32_t i;
 407         uint32_t bits_remaining;
 408         struct object_tree *node;
 409         const struct GUID *type;
 410         struct dom_sid self_sid;
 411
 412         dom_sid_parse(SID_NT_SELF, &self_sid);
 413
 414         *access_granted = access_desired;
 415         bits_remaining = access_desired;
 416
 417         /* handle the maximum allowed flag */
 418         if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
 419                 access_desired |= access_check_max_allowed(sd, token);
 420                 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
 421                 *access_granted = access_desired;
 422                 bits_remaining = access_desired;
 423         }
 424
 425         if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
 426                 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
 427                         bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
 428                 } else {
 429                         return NT_STATUS_PRIVILEGE_NOT_HELD;
 430                 }
 431         }
 432
 433         /* the owner always gets SEC_STD_WRITE_DAC and SEC_STD_READ_CONTROL */
 434         if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL)) &&
 435             security_token_has_sid(token, sd->owner_sid)) {
 436                 bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL);
 437         }
 438
 439         /* TODO: remove this, as it is file server specific */
 440         if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
 441             security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
 442                 bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
 443         }
 444         if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
 445             security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
 446                 bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
 447         }
 448
 449         /* a NULL dacl allows access */
 450         if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
 451                 *access_granted = access_desired;
 452                 return NT_STATUS_OK;
 453         }
 454
 455         if (sd->dacl == NULL) {
 456                 goto done;
 457         }
 458
 459         /* check each ace in turn. */
 460         for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
 461                 struct dom_sid *trustee;
 462                 struct security_ace *ace = &sd->dacl->aces[i];
 463
 464                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 465                         continue;
 466                 }
 467
 468                 if (dom_sid_equal(&ace->trustee, &self_sid) && replace_sid) {
 469                         trustee = replace_sid;
 470                 } else {
 471                         trustee = &ace->trustee;
 472                 }
 473
 474                 if (!security_token_has_sid(token, trustee)) {
 475                         continue;
 476                 }
 477
 478                 switch (ace->type) {
 479                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 480                         if (tree) {
 481                                 object_tree_modify_access(tree, ace->access_mask);
 482                         }
 483
 484                         bits_remaining &= ~ace->access_mask;
 485                         break;
 486                 case SEC_ACE_TYPE_ACCESS_DENIED:
 487                         if (bits_remaining & ace->access_mask) {
 488                                 return NT_STATUS_ACCESS_DENIED;
 489                         }
 490                         break;
 491                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 492                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 493                         /*
 494                          * check only in case we have provided a tree,
 495                          * the ACE has an object type and that type
 496                          * is in the tree
 497                          */
 498                         type = get_ace_object_type(ace);
 499
 500                         if (!tree) {
 501                                 continue;
 502                         }
 503
 504                         if (!type) {
 505                                 node = tree;
 506                         } else {
 507                                 if (!(node = get_object_tree_by_GUID(tree, type))) {
 508                                         continue;
 509                                 }
 510                         }
 511
 512                         if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
 513                                 object_tree_modify_access(node, ace->access_mask);
 514                                 if (node->remaining_access == 0) {
 515                                         return NT_STATUS_OK;
 516                                 }
 517                         } else {
 518                                 if (node->remaining_access & ace->access_mask){
 519                                         return NT_STATUS_ACCESS_DENIED;
 520                                 }
 521                         }
 522                         break;
 523                 default:        /* Other ACE types not handled/supported */
 524                         break;
 525                 }
 526         }
 527
 528 done:
 529         if (bits_remaining != 0) {
 530                 return NT_STATUS_ACCESS_DENIED;
 531         }
 532
 533         return NT_STATUS_OK;
 534 }