4 Copyright (C) Simo Sorce 2006-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2007
6 Copyright (C) Nadezhda Ivanova 2009
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 * Component: DS Security descriptor module
28 * - Calculate the security descriptor of a newly created object
29 * - Perform sd recalculation on a move operation
30 * - Handle sd modification invariants
32 * Author: Nadezhda Ivanova
36 #include "ldb_module.h"
37 #include "dlinklist.h"
38 #include "dsdb/samdb/samdb.h"
39 #include "librpc/ndr/libndr.h"
40 #include "librpc/gen_ndr/ndr_security.h"
41 #include "libcli/security/security.h"
42 #include "auth/auth.h"
43 #include "param/param.h"
45 struct descriptor_context
{
46 struct ldb_module
*module
;
47 struct ldb_request
*req
;
48 struct ldb_reply
*search_res
;
49 int (*step_fn
)(struct descriptor_context
*);
52 static struct dsdb_class
* get_last_structural_class(const struct dsdb_schema
*schema
, struct ldb_message_element
*element
)
54 struct dsdb_class
*last_class
= NULL
;
56 for (i
= 0; i
< element
->num_values
; i
++){
58 last_class
= dsdb_class_by_lDAPDisplayName_ldb_val(schema
, &element
->values
[i
]);
60 struct dsdb_class
*tmp_class
= dsdb_class_by_lDAPDisplayName_ldb_val(schema
, &element
->values
[i
]);
61 if (tmp_class
->subClass_order
> last_class
->subClass_order
)
62 last_class
= tmp_class
;
68 struct dom_sid
*get_default_ag(TALLOC_CTX
*mem_ctx
,
70 struct security_token
*token
,
71 struct ldb_context
*ldb
)
73 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
74 struct ldb_dn
*root_base_dn
= ldb_get_root_basedn(ldb
);
75 struct ldb_dn
*schema_base_dn
= ldb_get_schema_basedn(ldb
);
76 struct ldb_dn
*config_base_dn
= ldb_get_config_basedn(ldb
);
77 const struct dom_sid
*domain_sid
= samdb_domain_sid(ldb
);
78 struct dom_sid
*da_sid
= dom_sid_add_rid(tmp_ctx
, domain_sid
, DOMAIN_RID_ADMINS
);
79 struct dom_sid
*ea_sid
= dom_sid_add_rid(tmp_ctx
, domain_sid
, DOMAIN_RID_ENTERPRISE_ADMINS
);
80 struct dom_sid
*sa_sid
= dom_sid_add_rid(tmp_ctx
, domain_sid
, DOMAIN_RID_SCHEMA_ADMINS
);
81 struct dom_sid
*dag_sid
;
83 if (ldb_dn_compare_base(schema_base_dn
, dn
) == 0){
84 if (security_token_has_sid(token
, sa_sid
))
85 dag_sid
= dom_sid_dup(mem_ctx
, sa_sid
);
86 else if (security_token_has_sid(token
, ea_sid
))
87 dag_sid
= dom_sid_dup(mem_ctx
, ea_sid
);
88 else if (security_token_has_sid(token
, da_sid
))
89 dag_sid
= dom_sid_dup(mem_ctx
, da_sid
);
93 else if (ldb_dn_compare_base(config_base_dn
, dn
) == 0){
94 if (security_token_has_sid(token
, ea_sid
))
95 dag_sid
= dom_sid_dup(mem_ctx
, ea_sid
);
96 else if (security_token_has_sid(token
, da_sid
))
97 dag_sid
= dom_sid_dup(mem_ctx
, da_sid
);
101 else if (ldb_dn_compare_base(root_base_dn
, dn
) == 0){
102 if (security_token_has_sid(token
, da_sid
))
103 dag_sid
= dom_sid_dup(mem_ctx
, da_sid
);
104 else if (security_token_has_sid(token
, ea_sid
))
105 dag_sid
= dom_sid_dup(mem_ctx
, ea_sid
);
112 talloc_free(tmp_ctx
);
116 static struct security_descriptor
*get_sd_unpacked(struct ldb_module
*module
, TALLOC_CTX
*mem_ctx
,
117 const struct dsdb_class
*objectclass
)
119 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
120 struct security_descriptor
*sd
;
121 const struct dom_sid
*domain_sid
= samdb_domain_sid(ldb
);
123 if (!objectclass
->defaultSecurityDescriptor
|| !domain_sid
) {
127 sd
= sddl_decode(mem_ctx
,
128 objectclass
->defaultSecurityDescriptor
,
133 static struct dom_sid
*get_default_group(TALLOC_CTX
*mem_ctx
,
134 struct ldb_context
*ldb
,
140 static DATA_BLOB
*get_new_descriptor(struct ldb_module
*module
,
143 const struct dsdb_class
*objectclass
,
144 struct ldb_val
*parent
,
145 struct ldb_val
*object
)
147 struct security_descriptor
*user_descriptor
= NULL
, *parent_descriptor
= NULL
;
148 struct security_descriptor
*new_sd
;
149 DATA_BLOB
*linear_sd
;
150 enum ndr_err_code ndr_err
;
151 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
152 struct auth_session_info
*session_info
153 = ldb_get_opaque(ldb
, "sessionInfo");
154 const struct dom_sid
*domain_sid
= samdb_domain_sid(ldb
);
156 struct dom_sid
*default_owner
;
157 struct dom_sid
*default_group
;
160 user_descriptor
= talloc(mem_ctx
, struct security_descriptor
);
163 ndr_err
= ndr_pull_struct_blob(object
, user_descriptor
, NULL
,
165 (ndr_pull_flags_fn_t
)ndr_pull_security_descriptor
);
167 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)){
168 talloc_free(user_descriptor
);
173 user_descriptor
= get_sd_unpacked(module
, mem_ctx
, objectclass
);
176 parent_descriptor
= talloc(mem_ctx
, struct security_descriptor
);
177 if(!parent_descriptor
)
179 ndr_err
= ndr_pull_struct_blob(parent
, parent_descriptor
, NULL
,
181 (ndr_pull_flags_fn_t
)ndr_pull_security_descriptor
);
183 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)){
184 talloc_free(parent_descriptor
);
188 default_owner
= get_default_ag(mem_ctx
, dn
,
189 session_info
->security_token
, ldb
);
190 default_group
= get_default_group(mem_ctx
, ldb
, default_owner
);
191 new_sd
= create_security_descriptor(mem_ctx
, parent_descriptor
, user_descriptor
, true,
192 NULL
, SEC_DACL_AUTO_INHERIT
|SEC_SACL_AUTO_INHERIT
,
193 session_info
->security_token
,
194 default_owner
, default_group
,
195 map_generic_rights_ds
);
200 sddl_sd
= sddl_encode(mem_ctx
, new_sd
, domain_sid
);
201 DEBUG(10, ("Object %s created with desriptor %s", ldb_dn_get_linearized(dn
), sddl_sd
));
203 linear_sd
= talloc(mem_ctx
, DATA_BLOB
);
208 ndr_err
= ndr_push_struct_blob(linear_sd
, mem_ctx
,
209 lp_iconv_convenience(ldb_get_opaque(ldb
, "loadparm")),
211 (ndr_push_flags_fn_t
)ndr_push_security_descriptor
);
212 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
219 static struct descriptor_context
*descriptor_init_context(struct ldb_module
*module
,
220 struct ldb_request
*req
)
222 struct ldb_context
*ldb
;
223 struct descriptor_context
*ac
;
225 ldb
= ldb_module_get_ctx(module
);
227 ac
= talloc_zero(req
, struct descriptor_context
);
229 ldb_set_errstring(ldb
, "Out of Memory");
238 static int get_search_callback(struct ldb_request
*req
, struct ldb_reply
*ares
)
240 struct ldb_context
*ldb
;
241 struct descriptor_context
*ac
;
244 ac
= talloc_get_type(req
->context
, struct descriptor_context
);
245 ldb
= ldb_module_get_ctx(ac
->module
);
248 return ldb_module_done(ac
->req
, NULL
, NULL
,
249 LDB_ERR_OPERATIONS_ERROR
);
251 if (ares
->error
!= LDB_SUCCESS
&&
252 ares
->error
!= LDB_ERR_NO_SUCH_OBJECT
) {
253 return ldb_module_done(ac
->req
, ares
->controls
,
254 ares
->response
, ares
->error
);
257 switch (ares
->type
) {
258 case LDB_REPLY_ENTRY
:
259 if (ac
->search_res
!= NULL
) {
260 ldb_set_errstring(ldb
, "Too many results");
262 return ldb_module_done(ac
->req
, NULL
, NULL
,
263 LDB_ERR_OPERATIONS_ERROR
);
266 ac
->search_res
= talloc_steal(ac
, ares
);
269 case LDB_REPLY_REFERRAL
:
276 ret
= ac
->step_fn(ac
);
277 if (ret
!= LDB_SUCCESS
) {
278 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
285 static int descriptor_op_callback(struct ldb_request
*req
, struct ldb_reply
*ares
)
287 struct descriptor_context
*ac
;
289 ac
= talloc_get_type(req
->context
, struct descriptor_context
);
292 return ldb_module_done(ac
->req
, NULL
, NULL
,
293 LDB_ERR_OPERATIONS_ERROR
);
295 if (ares
->error
!= LDB_SUCCESS
) {
296 return ldb_module_done(ac
->req
, ares
->controls
,
297 ares
->response
, ares
->error
);
300 if (ares
->type
!= LDB_REPLY_DONE
) {
302 return ldb_module_done(ac
->req
, NULL
, NULL
,
303 LDB_ERR_OPERATIONS_ERROR
);
306 return ldb_module_done(ac
->req
, ares
->controls
,
307 ares
->response
, ares
->error
);
310 static int descriptor_do_add(struct descriptor_context
*ac
)
312 struct ldb_context
*ldb
;
313 const struct dsdb_schema
*schema
;
314 struct ldb_request
*add_req
;
315 struct ldb_message_element
*objectclass_element
, *sd_element
= NULL
;
316 struct ldb_message
*msg
;
319 struct ldb_val
*sd_val
= NULL
, *parentsd_val
= NULL
;
321 struct dsdb_class
*objectclass
;
323 ldb
= ldb_module_get_ctx(ac
->module
);
324 schema
= dsdb_get_schema(ldb
);
326 mem_ctx
= talloc_new(ac
);
327 if (mem_ctx
== NULL
) {
328 return LDB_ERR_OPERATIONS_ERROR
;
331 msg
= ldb_msg_copy_shallow(ac
, ac
->req
->op
.add
.message
);
333 /* get the security descriptor values*/
334 sd_element
= ldb_msg_find_element(msg
, "nTSecurityDescriptor");
335 objectclass_element
= ldb_msg_find_element(msg
, "objectClass");
336 objectclass
= get_last_structural_class(schema
, objectclass_element
);
339 return LDB_ERR_OPERATIONS_ERROR
;
342 sd_val
= &sd_element
->values
[0];
343 /* NC's have no parent */
344 if ((ldb_dn_compare(msg
->dn
, (ldb_get_schema_basedn(ldb
))) == 0) ||
345 (ldb_dn_compare(msg
->dn
, (ldb_get_config_basedn(ldb
))) == 0) ||
346 (ldb_dn_compare(msg
->dn
, (ldb_get_root_basedn(ldb
))) == 0))
348 else if (ac
->search_res
!= NULL
)
349 parentsd_val
= ldb_msg_find_ldb_val(ac
->search_res
->message
, "nTSecurityDescriptor");
352 /* get the parent descriptor and the one provided. If not provided, get the default.*/
353 /* convert to security descriptor and calculate */
354 sd
= get_new_descriptor(ac
->module
, msg
->dn
, mem_ctx
, objectclass
,
355 parentsd_val
, sd_val
);
357 ldb_msg_add_steal_value(msg
, "nTSecurityDescriptor", sd
);
360 talloc_free(mem_ctx
);
361 ret
= ldb_msg_sanity_check(ldb
, msg
);
363 if (ret
!= LDB_SUCCESS
) {
367 ret
= ldb_build_add_req(&add_req
, ldb
, ac
,
370 ac
, descriptor_op_callback
,
372 if (ret
!= LDB_SUCCESS
) {
376 /* perform the add */
377 return ldb_next_request(ac
->module
, add_req
);
380 static int descriptor_add(struct ldb_module
*module
, struct ldb_request
*req
)
382 struct ldb_context
*ldb
;
383 struct ldb_request
*search_req
;
384 struct descriptor_context
*ac
;
385 struct ldb_dn
*parent_dn
;
387 static const char * const descr_attrs
[] = { "nTSecurityDescriptor", NULL
};
389 ldb
= ldb_module_get_ctx(module
);
391 ldb_debug(ldb
, LDB_DEBUG_TRACE
, "descriptor_add\n");
393 if (ldb_dn_is_special(req
->op
.add
.message
->dn
)) {
394 return ldb_next_request(module
, req
);
397 ac
= descriptor_init_context(module
, req
);
399 return LDB_ERR_OPERATIONS_ERROR
;
402 /* If there isn't a parent, just go on to the add processing */
403 if (ldb_dn_get_comp_num(ac
->req
->op
.add
.message
->dn
) == 1) {
404 return descriptor_do_add(ac
);
407 /* get copy of parent DN */
408 parent_dn
= ldb_dn_get_parent(ac
, ac
->req
->op
.add
.message
->dn
);
409 if (parent_dn
== NULL
) {
411 return LDB_ERR_OPERATIONS_ERROR
;
414 ret
= ldb_build_search_req(&search_req
, ldb
,
415 ac
, parent_dn
, LDB_SCOPE_BASE
,
416 "(objectClass=*)", descr_attrs
,
418 ac
, get_search_callback
,
420 if (ret
!= LDB_SUCCESS
) {
423 talloc_steal(search_req
, parent_dn
);
425 ac
->step_fn
= descriptor_do_add
;
427 return ldb_next_request(ac
->module
, search_req
);
430 static int descriptor_modify(struct ldb_module
*module
, struct ldb_request
*req
)
432 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
433 ldb_debug(ldb
, LDB_DEBUG_TRACE
, "descriptor_modify\n");
434 return ldb_next_request(module
, req
);
437 static int descriptor_rename(struct ldb_module
*module
, struct ldb_request
*req
)
439 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
440 ldb_debug(ldb
, LDB_DEBUG_TRACE
, "descriptor_rename\n");
441 return ldb_next_request(module
, req
);
444 _PUBLIC_
const struct ldb_module_ops ldb_descriptor_module_ops
= {
445 .name
= "descriptor",
446 .add
= descriptor_add
,
447 .modify
= descriptor_modify
,
448 .rename
= descriptor_rename
,