libcli/security Move source3/lib/util_seaccess.c into the common code

Signed-off-by: Andrew Tridgell <tridge@samba.org>

diff --git a/source3/lib/util_seaccess.c b/libcli/security/access_check.c
similarity index 95%
rename from source3/lib/util_seaccess.c
rename to libcli/security/access_check.c
index 6500f926fdc3f2d0ffc4f119d52f6bb2e96290f0..081efe8711a35982d4e04e30c8f0e8c635ae953f 100644 (file)
--- a/source3/lib/util_seaccess.c
+++ b/libcli/security/access_check.c
@@ -5,6 +5,7 @@
    Copyright (C) Gerald Carter 2005
    Copyright (C) Volker Lendecke 2007
    Copyright (C) Jeremy Allison 2008
+   Copyright (C) Andrew Bartlett 2010
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -28,9 +29,9 @@
    objects.  Each type of object has its own mapping of generic to object
    specific access rights. */
 
-void se_map_generic(uint32 *access_mask, const struct generic_mapping *mapping)
+void se_map_generic(uint32_t *access_mask, const struct generic_mapping *mapping)
 {
-       uint32 old_mask = *access_mask;
+       uint32_t old_mask = *access_mask;
 
        if (*access_mask & GENERIC_READ_ACCESS) {
                *access_mask &= ~GENERIC_READ_ACCESS;
@@ -81,9 +82,9 @@ void security_acl_map_generic(struct security_acl *sa,
    objects.  Each type of object has its own mapping of standard to object
    specific access rights. */
 
-void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping)
+void se_map_standard(uint32_t *access_mask, const struct standard_mapping *mapping)
 {
-       uint32 old_mask = *access_mask;
+       uint32_t old_mask = *access_mask;
 
        if (*access_mask & SEC_STD_READ_CONTROL) {
                *access_mask &= ~SEC_STD_READ_CONTROL;
@@ -104,7 +105,7 @@ void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping
 /*
   perform a SEC_FLAG_MAXIMUM_ALLOWED access check
 */
-static uint32_t access_check_max_allowed(const struct security_descriptor *sd, 
+static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
                                        const struct security_token *token)
 {
        uint32_t denied = 0, granted = 0;
@@ -152,7 +153,7 @@ static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
   this function returns the denied bits in the uint32_t pointed
   to by the access_granted pointer.
 */
-NTSTATUS se_access_check(const struct security_descriptor *sd, 
+NTSTATUS se_access_check(const struct security_descriptor *sd,
                          const struct security_token *token,
                          uint32_t access_desired,
                          uint32_t *access_granted)

diff --git a/libcli/security/access_check.h b/libcli/security/access_check.h
new file mode 100644 (file)
index 0000000..548e5a1
--- /dev/null
+++ b/libcli/security/access_check.h
@@ -0,0 +1,53 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Copyright (C) Andrew Tridgell 2004
+   Copyright (C) Gerald Carter 2005
+   Copyright (C) Volker Lendecke 2007
+   Copyright (C) Jeremy Allison 2008
+   Copyright (C) Andrew Bartlett 2010
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "libcli/security/security_token.h"
+
+/* Map generic access rights to object specific rights.  This technique is
+   used to give meaning to assigning read, write, execute and all access to
+   objects.  Each type of object has its own mapping of generic to object
+   specific access rights. */
+
+void se_map_generic(uint32_t *access_mask, const struct generic_mapping *mapping);
+
+/* Map generic access rights to object specific rights for all the ACE's
+ * in a security_acl.
+ */
+void security_acl_map_generic(struct security_acl *sa,
+                             const struct generic_mapping *mapping);
+
+/* Map standard access rights to object specific rights.  This technique is
+   used to give meaning to assigning read, write, execute and all access to
+   objects.  Each type of object has its own mapping of standard to object
+   specific access rights. */
+void se_map_standard(uint32_t *access_mask, const struct standard_mapping *mapping);
+
+/*
+  The main entry point for access checking. If returning ACCESS_DENIED
+  this function returns the denied bits in the uint32_t pointed
+  to by the access_granted pointer.
+*/
+NTSTATUS se_access_check(const struct security_descriptor *sd,
+                        const struct security_token *token,
+                        uint32_t access_desired,
+                        uint32_t *access_granted);

diff --git a/libcli/security/security.h b/libcli/security/security.h
index 8018bee893bcf0b3abb5422353abe30e71ad79dd..63ddf45e80efbffea9d03c08ee41d9630b1a05eb 100644 (file)
--- a/libcli/security/security.h
+++ b/libcli/security/security.h
@@ -40,6 +40,7 @@ struct object_tree {
 #include "libcli/security/security_token.h"
 #include "libcli/security/sddl.h"
 #include "libcli/security/privileges.h"
+#include "libcli/security/access_check.h"
 
 #if _SAMBA_BUILD_ >= 4
 #include "libcli/security/proto.h"

diff --git a/source3/Makefile.in b/source3/Makefile.in
index 18335cf1c789609f027be9038d1dbb02396d5838..a73ce26a3ab8dd28d177a68cc87c4c7328859394 100644 (file)
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -470,7 +470,7 @@ LIB_OBJ = $(LIBSAMBAUTIL_OBJ) $(UTIL_OBJ) $(CRYPTO_OBJ) \
          lib/module.o lib/events.o @LIBTEVENT_OBJ0@ \
          lib/server_contexts.o \
          lib/ldap_escape.o @CHARSET_STATIC@ \
-         lib/secdesc.o lib/util_seaccess.o ../libcli/security/secace.o \
+         lib/secdesc.o ../libcli/security/access_check.o ../libcli/security/secace.o \
          ../libcli/security/sddl.o \
          ../libcli/security/secacl.o @PTHREADPOOL_OBJ@ \
          lib/fncall.o \

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 42ff86751af4a44f1755383a3059905fb2271ec5..81e190952112e01f9f64ab4a9bdeb5205657d47b 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1237,14 +1237,6 @@ bool push_reg_multi_sz(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, const char **a);
 bool pull_reg_sz(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, const char **s);
 bool pull_reg_multi_sz(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, const char ***a);
 
-/* The following definitions come from lib/util_seaccess.c  */
-
-void se_map_generic(uint32 *access_mask, const struct generic_mapping *mapping);
-void security_acl_map_generic(struct security_acl *sa, const struct generic_mapping *mapping);
-void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping);
-NTSTATUS se_access_check(const struct security_descriptor *sd, const struct security_token *token,
-                    uint32 acc_desired, uint32 *acc_granted);
-
 /* The following definitions come from lib/util_sec.c  */
 
 void sec_init(void);