2 * Unix SMB/CIFS implementation.
4 * Copyright (C) Guenther Deschner 2005-2008
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "../libgpo/gpo_ini.h"
22 #include "../libgpo/gpo.h"
23 #include "libgpo/gpo_proto.h"
25 #define GP_EXT_NAME "security"
27 #define GPTTMPL_UNIX_PATH "Microsoft/Windows NT/SecEdit/GptTmpl.inf"
29 #define GPTTMPL_SECTION_UNICODE "Unicode"
30 #define GPTTMPL_SECTION_VERSION "Version"
32 #define GPTTMPL_SECTION_REGISTRY_VALUES "Registry Values"
33 #define GPTTMPL_SECTION_SYSTEM_ACCESS "System Access"
34 #define GPTTMPL_SECTION_KERBEROS_POLICY "Kerberos Policy"
35 #define GPTTMPL_SECTION_EVENT_AUDIT "Event Audit"
36 #define GPTTMPL_SECTION_PRIVILEGE_RIGHTS "Privilege Rights"
37 #define GPTTMPL_SECTION_APPLICATION_LOG "Application Log"
38 #define GPTTMPL_SECTION_SECURITY_LOG "Security Log"
39 #define GPTTMPL_SECTION_SYSTEM_LOG "System Log"
40 #define GPTTMPL_SECTION_GROUP_MEMBERSHIP "Group Membership"
41 #define GPTTMPL_SECTION_FILE_SECURITY "File Security"
42 #define GPTTMPL_SECTION_SERVICE_GENERAL_SETTING "Service General Setting"
44 static TALLOC_CTX *ctx = NULL;
46 struct gpttmpl_table {
48 const char *parameter;
49 enum winreg_Type type;
52 /****************************************************************
53 parse the Version section from gpttmpl file
54 ****************************************************************/
56 #define GPTTMPL_PARAMETER_REVISION "Revision"
57 #define GPTTMPL_PARAMETER_SIGNATURE "signature"
58 #define GPTTMPL_VALUE_CHICAGO "\"$CHICAGO$\"" /* whatever this is good for... */
59 #define GPTTMPL_PARAMETER_UNICODE "Unicode"
61 static NTSTATUS gpttmpl_parse_header(struct gp_inifile_context *ini_ctx,
62 uint32_t *version_out)
64 char *signature = NULL;
67 bool is_unicode = false;
70 return NT_STATUS_INVALID_PARAMETER;
73 result = gp_inifile_getstring(ini_ctx, GPTTMPL_SECTION_VERSION
74 ":"GPTTMPL_PARAMETER_SIGNATURE, &signature);
75 if (!NT_STATUS_IS_OK(result)) {
76 return NT_STATUS_INTERNAL_DB_CORRUPTION;
79 if (!strequal(signature, GPTTMPL_VALUE_CHICAGO)) {
80 return NT_STATUS_INTERNAL_DB_CORRUPTION;
82 result = gp_inifile_getint(ini_ctx, GPTTMPL_SECTION_VERSION
83 ":"GPTTMPL_PARAMETER_REVISION, &version);
84 if (!NT_STATUS_IS_OK(result)) {
85 return NT_STATUS_INTERNAL_DB_CORRUPTION;
89 *version_out = version;
92 result = gp_inifile_getbool(ini_ctx, GPTTMPL_SECTION_UNICODE
93 ":"GPTTMPL_PARAMETER_UNICODE, &is_unicode);
94 if (!NT_STATUS_IS_OK(result) || !is_unicode) {
95 return NT_STATUS_INTERNAL_DB_CORRUPTION;
101 /****************************************************************
102 ****************************************************************/
104 static NTSTATUS gpttmpl_init_context(TALLOC_CTX *mem_ctx,
106 const char *unix_path,
107 struct gp_inifile_context **ini_ctx)
111 struct gp_inifile_context *tmp_ctx = NULL;
113 status = gp_inifile_init_context(mem_ctx, flags, unix_path,
114 GPTTMPL_UNIX_PATH, &tmp_ctx);
115 NT_STATUS_NOT_OK_RETURN(status);
117 status = gpttmpl_parse_header(tmp_ctx, &version);
118 if (!NT_STATUS_IS_OK(status)) {
119 DEBUG(1,("gpttmpl_init_context: failed: %s\n",
121 TALLOC_FREE(tmp_ctx);
130 /****************************************************************
131 ****************************************************************/
133 static NTSTATUS gpttmpl_process(struct gp_inifile_context *ini_ctx,
134 struct registry_key *root_key,
140 /****************************************************************
141 ****************************************************************/
143 static NTSTATUS security_process_group_policy(TALLOC_CTX *mem_ctx,
145 struct registry_key *root_key,
146 const struct security_token *token,
147 struct GROUP_POLICY_OBJECT *gpo,
148 const char *extension_guid,
149 const char *snapin_guid)
152 char *unix_path = NULL;
153 struct gp_inifile_context *ini_ctx = NULL;
155 debug_gpext_header(0, "security_process_group_policy", flags, gpo,
156 extension_guid, snapin_guid);
158 /* this handler processes the gpttmpl files and merge output to the
161 status = gpo_get_unix_path(mem_ctx, cache_path(GPO_CACHE_DIR), gpo, &unix_path);
162 if (!NT_STATUS_IS_OK(status)) {
166 status = gpttmpl_init_context(mem_ctx, flags, unix_path, &ini_ctx);
167 if (!NT_STATUS_IS_OK(status)) {
171 status = gpttmpl_process(ini_ctx, root_key, flags);
172 if (!NT_STATUS_IS_OK(status)) {
177 if (!NT_STATUS_IS_OK(status)) {
178 DEBUG(0,("security_process_group_policy: %s\n",
181 TALLOC_FREE(ini_ctx);
186 /****************************************************************
187 ****************************************************************/
189 static NTSTATUS security_get_reg_config(TALLOC_CTX *mem_ctx,
190 struct gp_extension_reg_info **reg_info)
193 struct gp_extension_reg_info *info = NULL;
195 struct gp_extension_reg_table table[] = {
196 /* FIXME: how can we store the "(Default)" value ??? */
197 /* { "", REG_SZ, "Security" }, */
198 { "ProcessGroupPolicy", REG_SZ, "security_process_group_policy" },
199 { "NoUserPolicy", REG_DWORD, "1" },
200 { "ExtensionDebugLevel", REG_DWORD, "1" },
201 { NULL, REG_NONE, NULL }
204 info = talloc_zero(mem_ctx, struct gp_extension_reg_info);
205 NT_STATUS_HAVE_NO_MEMORY(info);
207 status = gp_ext_info_add_entry(mem_ctx, GP_EXT_NAME,
208 GP_EXT_GUID_SECURITY,
210 NT_STATUS_NOT_OK_RETURN(status);
218 /****************************************************************
219 ****************************************************************/
221 static NTSTATUS security_initialize(TALLOC_CTX *mem_ctx)
226 /****************************************************************
227 ****************************************************************/
229 static NTSTATUS security_shutdown(void)
233 status = unregister_gp_extension(GP_EXT_NAME);
234 if (NT_STATUS_IS_OK(status)) {
243 /****************************************************************
244 ****************************************************************/
246 static struct gp_extension_methods security_methods = {
247 .initialize = security_initialize,
248 .process_group_policy = security_process_group_policy,
249 .get_reg_config = security_get_reg_config,
250 .shutdown = security_shutdown
253 /****************************************************************
254 ****************************************************************/
256 NTSTATUS gpext_security_init(void)
260 ctx = talloc_init("gpext_security_init");
261 NT_STATUS_HAVE_NO_MEMORY(ctx);
263 status = register_gp_extension(ctx, SMB_GPEXT_INTERFACE_VERSION,
264 GP_EXT_NAME, GP_EXT_GUID_SECURITY,
266 if (!NT_STATUS_IS_OK(status)) {