source4/dsdb/samdb/ldb_modules/acl.c

   1 /*
   2   ldb database library
   3
   4   Copyright (C) Simo Sorce 2006-2008
   5   Copyright (C) Nadezhda Ivanova 2009
   6   Copyright (C) Anatoliy Atanasov  2009
   7
   8   This program is free software; you can redistribute it and/or modify
   9   it under the terms of the GNU General Public License as published by
  10   the Free Software Foundation; either version 3 of the License, or
  11   (at your option) any later version.
  12
  13   This program is distributed in the hope that it will be useful,
  14   but WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16   GNU General Public License for more details.
  17
  18   You should have received a copy of the GNU General Public License
  19   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23  *  Name: ldb
  24  *
  25  *  Component: ldb ACL module
  26  *
  27  *  Description: Module that performs authorisation access checks based on the
  28  *               account's security context and the DACL of the object being polled.
  29  *               Only DACL checks implemented at this point
  30  *
  31  *  Authors: Nadezhda Ivanova, Anatoliy Atanasov
  32  */
  33
  34 #include "includes.h"
  35 #include "ldb_module.h"
  36 #include "auth/auth.h"
  37 #include "libcli/security/security.h"
  38 #include "dsdb/samdb/samdb.h"
  39 #include "librpc/gen_ndr/ndr_security.h"
  40 #include "param/param.h"
  41 #include "dsdb/samdb/ldb_modules/util.h"
  42 #include "lib/util/tsort.h"
  43 #include "system/kerberos.h"
  44 #include "auth/kerberos/kerberos.h"
  45
  46 struct extended_access_check_attribute {
  47         const char *oa_name;
  48         const uint32_t requires_rights;
  49 };
  50
  51 struct acl_private {
  52         bool acl_search;
  53         const char **password_attrs;
  54         void *cached_schema_ptr;
  55         uint64_t cached_schema_metadata_usn;
  56         uint64_t cached_schema_loaded_usn;
  57         const char **confidential_attrs;
  58 };
  59
  60 struct acl_context {
  61         struct ldb_module *module;
  62         struct ldb_request *req;
  63         bool am_system;
  64         bool am_administrator;
  65         bool modify_search;
  66         bool constructed_attrs;
  67         bool allowedAttributes;
  68         bool allowedAttributesEffective;
  69         bool allowedChildClasses;
  70         bool allowedChildClassesEffective;
  71         bool sDRightsEffective;
  72         bool userPassword;
  73         const char * const *attrs;
  74         struct dsdb_schema *schema;
  75 };
  76
  77 static int acl_module_init(struct ldb_module *module)
  78 {
  79         struct ldb_context *ldb;
  80         struct acl_private *data;
  81         int ret;
  82         unsigned int i;
  83         TALLOC_CTX *mem_ctx;
  84         static const char *attrs[] = { "passwordAttribute", NULL };
  85         struct ldb_result *res;
  86         struct ldb_message *msg;
  87         struct ldb_message_element *password_attributes;
  88
  89         ldb = ldb_module_get_ctx(module);
  90
  91         ret = ldb_mod_register_control(module, LDB_CONTROL_SD_FLAGS_OID);
  92         if (ret != LDB_SUCCESS) {
  93                 ldb_debug(ldb, LDB_DEBUG_ERROR,
  94                           "acl_module_init: Unable to register control with rootdse!\n");
  95                 return ldb_operr(ldb);
  96         }
  97
  98         data = talloc_zero(module, struct acl_private);
  99         if (data == NULL) {
 100                 return ldb_oom(ldb);
 101         }
 102
 103         data->acl_search = lpcfg_parm_bool(ldb_get_opaque(ldb, "loadparm"),
 104                                         NULL, "acl", "search", false);
 105         ldb_module_set_private(module, data);
 106
 107         mem_ctx = talloc_new(module);
 108         if (!mem_ctx) {
 109                 return ldb_oom(ldb);
 110         }
 111
 112         ret = dsdb_module_search_dn(module, mem_ctx, &res,
 113                                     ldb_dn_new(mem_ctx, ldb, "@KLUDGEACL"),
 114                                     attrs,
 115                                     DSDB_FLAG_NEXT_MODULE |
 116                                     DSDB_FLAG_AS_SYSTEM,
 117                                     NULL);
 118         if (ret != LDB_SUCCESS) {
 119                 goto done;
 120         }
 121         if (res->count == 0) {
 122                 goto done;
 123         }
 124
 125         if (res->count > 1) {
 126                 talloc_free(mem_ctx);
 127                 return LDB_ERR_CONSTRAINT_VIOLATION;
 128         }
 129
 130         msg = res->msgs[0];
 131
 132         password_attributes = ldb_msg_find_element(msg, "passwordAttribute");
 133         if (!password_attributes) {
 134                 goto done;
 135         }
 136         data->password_attrs = talloc_array(data, const char *, password_attributes->num_values + 1);
 137         if (!data->password_attrs) {
 138                 talloc_free(mem_ctx);
 139                 return ldb_oom(ldb);
 140         }
 141         for (i=0; i < password_attributes->num_values; i++) {
 142                 data->password_attrs[i] = (const char *)password_attributes->values[i].data;
 143                 talloc_steal(data->password_attrs, password_attributes->values[i].data);
 144         }
 145         data->password_attrs[i] = NULL;
 146
 147 done:
 148         talloc_free(mem_ctx);
 149         return ldb_next_init(module);
 150 }
 151
 152 static int acl_allowedAttributes(struct ldb_module *module,
 153                                  const struct dsdb_schema *schema,
 154                                  struct ldb_message *sd_msg,
 155                                  struct ldb_message *msg,
 156                                  struct acl_context *ac)
 157 {
 158         struct ldb_message_element *oc_el;
 159         struct ldb_context *ldb = ldb_module_get_ctx(module);
 160         TALLOC_CTX *mem_ctx;
 161         const char **attr_list;
 162         int i, ret;
 163
 164         /* If we don't have a schema yet, we can't do anything... */
 165         if (schema == NULL) {
 166                 ldb_asprintf_errstring(ldb, "cannot add allowedAttributes to %s because no schema is loaded", ldb_dn_get_linearized(msg->dn));
 167                 return LDB_ERR_OPERATIONS_ERROR;
 168         }
 169
 170         /* Must remove any existing attribute */
 171         if (ac->allowedAttributes) {
 172                 ldb_msg_remove_attr(msg, "allowedAttributes");
 173         }
 174
 175         mem_ctx = talloc_new(msg);
 176         if (!mem_ctx) {
 177                 return ldb_oom(ldb);
 178         }
 179
 180         oc_el = ldb_msg_find_element(sd_msg, "objectClass");
 181         attr_list = dsdb_full_attribute_list(mem_ctx, schema, oc_el, DSDB_SCHEMA_ALL);
 182         if (!attr_list) {
 183                 ldb_asprintf_errstring(ldb, "acl: Failed to get list of attributes");
 184                 talloc_free(mem_ctx);
 185                 return LDB_ERR_OPERATIONS_ERROR;
 186         }
 187         if (ac->allowedAttributes) {
 188                 for (i=0; attr_list && attr_list[i]; i++) {
 189                         ldb_msg_add_string(msg, "allowedAttributes", attr_list[i]);
 190                 }
 191         }
 192         if (ac->allowedAttributesEffective) {
 193                 struct security_descriptor *sd;
 194                 struct dom_sid *sid = NULL;
 195                 struct ldb_control *as_system = ldb_request_get_control(ac->req,
 196                                                                         LDB_CONTROL_AS_SYSTEM_OID);
 197
 198                 if (as_system != NULL) {
 199                         as_system->critical = 0;
 200                 }
 201
 202                 ldb_msg_remove_attr(msg, "allowedAttributesEffective");
 203                 if (ac->am_system || as_system) {
 204                         for (i=0; attr_list && attr_list[i]; i++) {
 205                                 ldb_msg_add_string(msg, "allowedAttributesEffective", attr_list[i]);
 206                         }
 207                         return LDB_SUCCESS;
 208                 }
 209
 210                 ret = dsdb_get_sd_from_ldb_message(ldb_module_get_ctx(module), mem_ctx, sd_msg, &sd);
 211
 212                 if (ret != LDB_SUCCESS) {
 213                         return ret;
 214                 }
 215
 216                 sid = samdb_result_dom_sid(mem_ctx, sd_msg, "objectSid");
 217                 for (i=0; attr_list && attr_list[i]; i++) {
 218                         const struct dsdb_attribute *attr = dsdb_attribute_by_lDAPDisplayName(schema,
 219                                                                                         attr_list[i]);
 220                         if (!attr) {
 221                                 return ldb_operr(ldb);
 222                         }
 223                         /* remove constructed attributes */
 224                         if (attr->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED
 225                             || attr->systemOnly
 226                             || (attr->linkID != 0 && attr->linkID % 2 != 0 )) {
 227                                 continue;
 228                         }
 229                         ret = acl_check_access_on_attribute(module,
 230                                                             msg,
 231                                                             sd,
 232                                                             sid,
 233                                                             SEC_ADS_WRITE_PROP,
 234                                                             attr);
 235                         if (ret == LDB_SUCCESS) {
 236                                 ldb_msg_add_string(msg, "allowedAttributesEffective", attr_list[i]);
 237                         }
 238                 }
 239         }
 240         return LDB_SUCCESS;
 241 }
 242
 243 static int acl_childClasses(struct ldb_module *module,
 244                             const struct dsdb_schema *schema,
 245                             struct ldb_message *sd_msg,
 246                             struct ldb_message *msg,
 247                             const char *attrName)
 248 {
 249         struct ldb_message_element *oc_el;
 250         struct ldb_message_element *allowedClasses;
 251         const struct dsdb_class *sclass;
 252         unsigned int i, j;
 253         int ret;
 254
 255         /* If we don't have a schema yet, we can't do anything... */
 256         if (schema == NULL) {
 257                 ldb_asprintf_errstring(ldb_module_get_ctx(module), "cannot add childClassesEffective to %s because no schema is loaded", ldb_dn_get_linearized(msg->dn));
 258                 return LDB_ERR_OPERATIONS_ERROR;
 259         }
 260
 261         /* Must remove any existing attribute, or else confusion reins */
 262         ldb_msg_remove_attr(msg, attrName);
 263         ret = ldb_msg_add_empty(msg, attrName, 0, &allowedClasses);
 264         if (ret != LDB_SUCCESS) {
 265                 return ret;
 266         }
 267
 268         oc_el = ldb_msg_find_element(sd_msg, "objectClass");
 269
 270         for (i=0; oc_el && i < oc_el->num_values; i++) {
 271                 sclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &oc_el->values[i]);
 272                 if (!sclass) {
 273                         /* We don't know this class?  what is going on? */
 274                         continue;
 275                 }
 276
 277                 for (j=0; sclass->possibleInferiors && sclass->possibleInferiors[j]; j++) {
 278                         ldb_msg_add_string(msg, attrName, sclass->possibleInferiors[j]);
 279                 }
 280         }
 281         if (allowedClasses->num_values > 1) {
 282                 TYPESAFE_QSORT(allowedClasses->values, allowedClasses->num_values, data_blob_cmp);
 283                 for (i=1 ; i < allowedClasses->num_values; i++) {
 284                         struct ldb_val *val1 = &allowedClasses->values[i-1];
 285                         struct ldb_val *val2 = &allowedClasses->values[i];
 286                         if (data_blob_cmp(val1, val2) == 0) {
 287                                 memmove(val1, val2, (allowedClasses->num_values - i) * sizeof(struct ldb_val));
 288                                 allowedClasses->num_values--;
 289                                 i--;
 290                         }
 291                 }
 292         }
 293
 294         return LDB_SUCCESS;
 295 }
 296
 297 static int acl_check_access_on_class(struct ldb_module *module,
 298                                      const struct dsdb_schema *schema,
 299                                      TALLOC_CTX *mem_ctx,
 300                                      struct security_descriptor *sd,
 301                                      struct security_token *token,
 302                                      struct dom_sid *rp_sid,
 303                                      uint32_t access_mask,
 304                                      const char *class_name)
 305 {
 306         int ret;
 307         NTSTATUS status;
 308         uint32_t access_granted;
 309         struct object_tree *root = NULL;
 310         struct object_tree *new_node = NULL;
 311         const struct GUID *guid;
 312
 313         if (class_name != NULL) {
 314                 guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
 315                 if (!guid) {
 316                         DEBUG(10, ("acl_search: cannot find class %s\n",
 317                                    class_name));
 318                         goto fail;
 319                 }
 320                 if (!insert_in_object_tree(mem_ctx,
 321                                            guid, access_mask,
 322                                            &root, &new_node)) {
 323                         DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
 324                         goto fail;
 325                 }
 326         }
 327
 328         status = sec_access_check_ds(sd, token,
 329                                      access_mask,
 330                                      &access_granted,
 331                                      root,
 332                                      rp_sid);
 333         if (!NT_STATUS_IS_OK(status)) {
 334                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 335         } else {
 336                 ret = LDB_SUCCESS;
 337         }
 338         return ret;
 339 fail:
 340         return ldb_operr(ldb_module_get_ctx(module));
 341 }
 342
 343 static int acl_childClassesEffective(struct ldb_module *module,
 344                                      const struct dsdb_schema *schema,
 345                                      struct ldb_message *sd_msg,
 346                                      struct ldb_message *msg,
 347                                      struct acl_context *ac)
 348 {
 349         struct ldb_message_element *oc_el;
 350         struct ldb_message_element *allowedClasses = NULL;
 351         const struct dsdb_class *sclass;
 352         struct security_descriptor *sd;
 353         struct ldb_control *as_system = ldb_request_get_control(ac->req,
 354                                                                 LDB_CONTROL_AS_SYSTEM_OID);
 355         struct dom_sid *sid = NULL;
 356         unsigned int i, j;
 357         int ret;
 358
 359         if (as_system != NULL) {
 360                 as_system->critical = 0;
 361         }
 362
 363         if (ac->am_system || as_system) {
 364                 return acl_childClasses(module, schema, sd_msg, msg, "allowedChildClassesEffective");
 365         }
 366
 367         /* If we don't have a schema yet, we can't do anything... */
 368         if (schema == NULL) {
 369                 ldb_asprintf_errstring(ldb_module_get_ctx(module), "cannot add allowedChildClassesEffective to %s because no schema is loaded", ldb_dn_get_linearized(msg->dn));
 370                 return LDB_ERR_OPERATIONS_ERROR;
 371         }
 372
 373         /* Must remove any existing attribute, or else confusion reins */
 374         ldb_msg_remove_attr(msg, "allowedChildClassesEffective");
 375
 376         oc_el = ldb_msg_find_element(sd_msg, "objectClass");
 377         ret = dsdb_get_sd_from_ldb_message(ldb_module_get_ctx(module), msg, sd_msg, &sd);
 378         if (ret != LDB_SUCCESS) {
 379                 return ret;
 380         }
 381
 382         sid = samdb_result_dom_sid(msg, sd_msg, "objectSid");
 383         for (i=0; oc_el && i < oc_el->num_values; i++) {
 384                 sclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &oc_el->values[i]);
 385                 if (!sclass) {
 386                         /* We don't know this class?  what is going on? */
 387                         continue;
 388                 }
 389
 390                 for (j=0; sclass->possibleInferiors && sclass->possibleInferiors[j]; j++) {
 391                         ret = acl_check_access_on_class(module,
 392                                                         schema,
 393                                                         msg,
 394                                                         sd,
 395                                                         acl_user_token(module),
 396                                                         sid,
 397                                                         SEC_ADS_CREATE_CHILD,
 398                                                         sclass->possibleInferiors[j]);
 399                         if (ret == LDB_SUCCESS) {
 400                                 ldb_msg_add_string(msg, "allowedChildClassesEffective",
 401                                                    sclass->possibleInferiors[j]);
 402                         }
 403                 }
 404         }
 405         allowedClasses = ldb_msg_find_element(msg, "allowedChildClassesEffective");
 406         if (!allowedClasses) {
 407                 return LDB_SUCCESS;
 408         }
 409
 410         if (allowedClasses->num_values > 1) {
 411                 TYPESAFE_QSORT(allowedClasses->values, allowedClasses->num_values, data_blob_cmp);
 412                 for (i=1 ; i < allowedClasses->num_values; i++) {
 413                         struct ldb_val *val1 = &allowedClasses->values[i-1];
 414                         struct ldb_val *val2 = &allowedClasses->values[i];
 415                         if (data_blob_cmp(val1, val2) == 0) {
 416                                 memmove(val1, val2, (allowedClasses->num_values - i) * sizeof( struct ldb_val));
 417                                 allowedClasses->num_values--;
 418                                 i--;
 419                         }
 420                 }
 421         }
 422         return LDB_SUCCESS;
 423 }
 424
 425 static int acl_sDRightsEffective(struct ldb_module *module,
 426                                  struct ldb_message *sd_msg,
 427                                  struct ldb_message *msg,
 428                                  struct acl_context *ac)
 429 {
 430         struct ldb_message_element *rightsEffective;
 431         int ret;
 432         struct security_descriptor *sd;
 433         struct ldb_control *as_system = ldb_request_get_control(ac->req,
 434                                                                 LDB_CONTROL_AS_SYSTEM_OID);
 435         struct dom_sid *sid = NULL;
 436         uint32_t flags = 0;
 437
 438         if (as_system != NULL) {
 439                 as_system->critical = 0;
 440         }
 441
 442         /* Must remove any existing attribute, or else confusion reins */
 443         ldb_msg_remove_attr(msg, "sDRightsEffective");
 444         ret = ldb_msg_add_empty(msg, "sDRightsEffective", 0, &rightsEffective);
 445         if (ret != LDB_SUCCESS) {
 446                 return ret;
 447         }
 448         if (ac->am_system || as_system) {
 449                 flags = SECINFO_OWNER | SECINFO_GROUP |  SECINFO_SACL |  SECINFO_DACL;
 450         }
 451         else {
 452                 /* Get the security descriptor from the message */
 453                 ret = dsdb_get_sd_from_ldb_message(ldb_module_get_ctx(module), msg, sd_msg, &sd);
 454                 if (ret != LDB_SUCCESS) {
 455                         return ret;
 456                 }
 457                 sid = samdb_result_dom_sid(msg, sd_msg, "objectSid");
 458                 ret = acl_check_access_on_attribute(module,
 459                                                     msg,
 460                                                     sd,
 461                                                     sid,
 462                                                     SEC_STD_WRITE_OWNER,
 463                                                     NULL);
 464                 if (ret == LDB_SUCCESS) {
 465                         flags |= SECINFO_OWNER | SECINFO_GROUP;
 466                 }
 467                 ret = acl_check_access_on_attribute(module,
 468                                                     msg,
 469                                                     sd,
 470                                                     sid,
 471                                                     SEC_STD_WRITE_DAC,
 472                                                     NULL);
 473                 if (ret == LDB_SUCCESS) {
 474                         flags |= SECINFO_DACL;
 475                 }
 476                 ret = acl_check_access_on_attribute(module,
 477                                                     msg,
 478                                                     sd,
 479                                                     sid,
 480                                                     SEC_FLAG_SYSTEM_SECURITY,
 481                                                     NULL);
 482                 if (ret == LDB_SUCCESS) {
 483                         flags |= SECINFO_SACL;
 484                 }
 485         }
 486         return samdb_msg_add_uint(ldb_module_get_ctx(module), msg, msg,
 487                                   "sDRightsEffective", flags);
 488 }
 489
 490 static int acl_validate_spn_value(TALLOC_CTX *mem_ctx,
 491                                   struct ldb_context *ldb,
 492                                   const char *spn_value,
 493                                   uint32_t userAccountControl,
 494                                   const char *samAccountName,
 495                                   const char *dnsHostName,
 496                                   const char *netbios_name,
 497                                   const char *ntds_guid)
 498 {
 499         int ret;
 500         krb5_context krb_ctx;
 501         krb5_error_code kerr;
 502         krb5_principal principal;
 503         char *instanceName;
 504         char *serviceType;
 505         char *serviceName;
 506         const char *forest_name = samdb_forest_name(ldb, mem_ctx);
 507         const char *base_domain = samdb_default_domain_name(ldb, mem_ctx);
 508         struct loadparm_context *lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
 509                                                           struct loadparm_context);
 510         bool is_dc = (userAccountControl & UF_SERVER_TRUST_ACCOUNT) ||
 511                 (userAccountControl & UF_PARTIAL_SECRETS_ACCOUNT);
 512
 513         if (strcasecmp_m(spn_value, samAccountName) == 0) {
 514                 /* MacOS X sets this value, and setting an SPN of your
 515                  * own samAccountName is both pointless and safe */
 516                 return LDB_SUCCESS;
 517         }
 518
 519         kerr = smb_krb5_init_context_basic(mem_ctx,
 520                                            lp_ctx,
 521                                            &krb_ctx);
 522         if (kerr != 0) {
 523                 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
 524                                  "Could not initialize kerberos context.");
 525         }
 526
 527         ret = krb5_parse_name(krb_ctx, spn_value, &principal);
 528         if (ret) {
 529                 krb5_free_context(krb_ctx);
 530                 return LDB_ERR_CONSTRAINT_VIOLATION;
 531         }
 532
 533         if (principal->name.name_string.len < 2) {
 534                 goto fail;
 535         }
 536
 537         instanceName = principal->name.name_string.val[1];
 538         serviceType = principal->name.name_string.val[0];
 539         if (principal->name.name_string.len == 3) {
 540                 serviceName = principal->name.name_string.val[2];
 541         } else {
 542                 serviceName = NULL;
 543         }
 544
 545         if (serviceName) {
 546                 if (!is_dc) {
 547                         goto fail;
 548                 }
 549                 if (strcasecmp(serviceType, "ldap") == 0) {
 550                         if (strcasecmp(serviceName, netbios_name) != 0 &&
 551                             strcasecmp(serviceName, forest_name) != 0) {
 552                                 goto fail;
 553                         }
 554
 555                 } else if (strcasecmp(serviceType, "gc") == 0) {
 556                         if (strcasecmp(serviceName, forest_name) != 0) {
 557                                 goto fail;
 558                         }
 559                 } else {
 560                         if (strcasecmp(serviceName, base_domain) != 0 &&
 561                             strcasecmp(serviceName, netbios_name) != 0) {
 562                                 goto fail;
 563                         }
 564                 }
 565         }
 566         /* instanceName can be samAccountName without $ or dnsHostName
 567          * or "ntds_guid._msdcs.forest_domain for DC objects */
 568         if (strlen(instanceName) == (strlen(samAccountName) - 1)
 569             && strncasecmp(instanceName, samAccountName, strlen(samAccountName) - 1) == 0) {
 570                 goto success;
 571         } else if (dnsHostName != NULL && strcasecmp(instanceName, dnsHostName) == 0) {
 572                 goto success;
 573         } else if (is_dc) {
 574                 const char *guid_str;
 575                 guid_str = talloc_asprintf(mem_ctx,"%s._msdcs.%s",
 576                                            ntds_guid,
 577                                            forest_name);
 578                 if (strcasecmp(instanceName, guid_str) == 0) {
 579                         goto success;
 580                 }
 581         }
 582
 583 fail:
 584         krb5_free_principal(krb_ctx, principal);
 585         krb5_free_context(krb_ctx);
 586         return LDB_ERR_CONSTRAINT_VIOLATION;
 587
 588 success:
 589         krb5_free_principal(krb_ctx, principal);
 590         krb5_free_context(krb_ctx);
 591         return LDB_SUCCESS;
 592 }
 593
 594 static int acl_check_spn(TALLOC_CTX *mem_ctx,
 595                          struct ldb_module *module,
 596                          struct ldb_request *req,
 597                          struct security_descriptor *sd,
 598                          struct dom_sid *sid,
 599                          const struct GUID *oc_guid,
 600                          const struct dsdb_attribute *attr)
 601 {
 602         int ret;
 603         unsigned int i;
 604         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 605         struct ldb_context *ldb = ldb_module_get_ctx(module);
 606         struct ldb_result *acl_res;
 607         struct ldb_result *netbios_res;
 608         struct ldb_message_element *el;
 609         struct ldb_dn *partitions_dn = samdb_partitions_dn(ldb, tmp_ctx);
 610         uint32_t userAccountControl;
 611         const char *samAccountName;
 612         const char *dnsHostName;
 613         const char *netbios_name;
 614         struct GUID ntds;
 615         char *ntds_guid = NULL;
 616
 617         static const char *acl_attrs[] = {
 618                 "samAccountName",
 619                 "dnsHostName",
 620                 "userAccountControl",
 621                 NULL
 622         };
 623         static const char *netbios_attrs[] = {
 624                 "nETBIOSName",
 625                 NULL
 626         };
 627
 628         /* if we have wp, we can do whatever we like */
 629         if (acl_check_access_on_attribute(module,
 630                                           tmp_ctx,
 631                                           sd,
 632                                           sid,
 633                                           SEC_ADS_WRITE_PROP,
 634                                           attr) == LDB_SUCCESS) {
 635                 talloc_free(tmp_ctx);
 636                 return LDB_SUCCESS;
 637         }
 638
 639         ret = acl_check_extended_right(tmp_ctx, sd, acl_user_token(module),
 640                                        GUID_DRS_VALIDATE_SPN,
 641                                        SEC_ADS_SELF_WRITE,
 642                                        sid);
 643
 644         if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
 645                 dsdb_acl_debug(sd, acl_user_token(module),
 646                                req->op.mod.message->dn,
 647                                true,
 648                                10);
 649                 talloc_free(tmp_ctx);
 650                 return ret;
 651         }
 652
 653         ret = dsdb_module_search_dn(module, tmp_ctx,
 654                                     &acl_res, req->op.mod.message->dn,
 655                                     acl_attrs,
 656                                     DSDB_FLAG_NEXT_MODULE |
 657                                     DSDB_FLAG_AS_SYSTEM |
 658                                     DSDB_SEARCH_SHOW_RECYCLED,
 659                                     req);
 660         if (ret != LDB_SUCCESS) {
 661                 talloc_free(tmp_ctx);
 662                 return ret;
 663         }
 664
 665         userAccountControl = ldb_msg_find_attr_as_uint(acl_res->msgs[0], "userAccountControl", 0);
 666         dnsHostName = ldb_msg_find_attr_as_string(acl_res->msgs[0], "dnsHostName", NULL);
 667         samAccountName = ldb_msg_find_attr_as_string(acl_res->msgs[0], "samAccountName", NULL);
 668
 669         ret = dsdb_module_search(module, tmp_ctx,
 670                                  &netbios_res, partitions_dn,
 671                                  LDB_SCOPE_ONELEVEL,
 672                                  netbios_attrs,
 673                                  DSDB_FLAG_NEXT_MODULE |
 674                                  DSDB_FLAG_AS_SYSTEM,
 675                                  req,
 676                                  "(ncName=%s)",
 677                                  ldb_dn_get_linearized(ldb_get_default_basedn(ldb)));
 678
 679         netbios_name = ldb_msg_find_attr_as_string(netbios_res->msgs[0], "nETBIOSName", NULL);
 680
 681         el = ldb_msg_find_element(req->op.mod.message, "servicePrincipalName");
 682         if (!el) {
 683                 talloc_free(tmp_ctx);
 684                 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
 685                                          "Error finding element for servicePrincipalName.");
 686         }
 687
 688         /* NTDSDSA objectGuid of object we are checking SPN for */
 689         if (userAccountControl & (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)) {
 690                 ret = dsdb_module_find_ntdsguid_for_computer(module, tmp_ctx,
 691                                                              req->op.mod.message->dn, &ntds, req);
 692                 if (ret != LDB_SUCCESS) {
 693                         ldb_asprintf_errstring(ldb, "Failed to find NTDSDSA objectGuid for %s: %s",
 694                                                ldb_dn_get_linearized(req->op.mod.message->dn),
 695                                                ldb_strerror(ret));
 696                         talloc_free(tmp_ctx);
 697                         return LDB_ERR_OPERATIONS_ERROR;
 698                 }
 699                 ntds_guid = GUID_string(tmp_ctx, &ntds);
 700         }
 701
 702         for (i=0; i < el->num_values; i++) {
 703                 ret = acl_validate_spn_value(tmp_ctx,
 704                                              ldb,
 705                                              (char *)el->values[i].data,
 706                                              userAccountControl,
 707                                              samAccountName,
 708                                              dnsHostName,
 709                                              netbios_name,
 710                                              ntds_guid);
 711                 if (ret != LDB_SUCCESS) {
 712                         talloc_free(tmp_ctx);
 713                         return ret;
 714                 }
 715         }
 716         talloc_free(tmp_ctx);
 717         return LDB_SUCCESS;
 718 }
 719
 720 static int acl_add(struct ldb_module *module, struct ldb_request *req)
 721 {
 722         int ret;
 723         struct ldb_dn *parent = ldb_dn_get_parent(req, req->op.add.message->dn);
 724         struct ldb_context *ldb;
 725         const struct dsdb_schema *schema;
 726         struct ldb_message_element *oc_el;
 727         const struct GUID *guid;
 728         struct ldb_dn *nc_root;
 729         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
 730
 731         if (as_system != NULL) {
 732                 as_system->critical = 0;
 733         }
 734
 735         if (dsdb_module_am_system(module) || as_system) {
 736                 return ldb_next_request(module, req);
 737         }
 738         if (ldb_dn_is_special(req->op.add.message->dn)) {
 739                 return ldb_next_request(module, req);
 740         }
 741
 742         ldb = ldb_module_get_ctx(module);
 743
 744         /* Creating an NC. There is probably something we should do here,
 745          * but we will establish that later */
 746
 747         ret = dsdb_find_nc_root(ldb, req, req->op.add.message->dn, &nc_root);
 748         if (ret != LDB_SUCCESS) {
 749                 return ret;
 750         }
 751         if (ldb_dn_compare(nc_root, req->op.add.message->dn) == 0) {
 752                 talloc_free(nc_root);
 753                 return ldb_next_request(module, req);
 754         }
 755         talloc_free(nc_root);
 756
 757         schema = dsdb_get_schema(ldb, req);
 758         if (!schema) {
 759                 return ldb_operr(ldb);
 760         }
 761
 762         oc_el = ldb_msg_find_element(req->op.add.message, "objectClass");
 763         if (!oc_el || oc_el->num_values == 0) {
 764                 ldb_asprintf_errstring(ldb_module_get_ctx(module),
 765                                        "acl: unable to find objectClass on %s\n",
 766                                        ldb_dn_get_linearized(req->op.add.message->dn));
 767                 return ldb_module_done(req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 768         }
 769
 770         guid = class_schemaid_guid_by_lDAPDisplayName(schema,
 771                                                       (char *)oc_el->values[oc_el->num_values-1].data);
 772         ret = dsdb_module_check_access_on_dn(module, req, parent, SEC_ADS_CREATE_CHILD, guid, req);
 773         if (ret != LDB_SUCCESS) {
 774                 return ret;
 775         }
 776         return ldb_next_request(module, req);
 777 }
 778
 779 /* ckecks if modifications are allowed on "Member" attribute */
 780 static int acl_check_self_membership(TALLOC_CTX *mem_ctx,
 781                                      struct ldb_module *module,
 782                                      struct ldb_request *req,
 783                                      struct security_descriptor *sd,
 784                                      struct dom_sid *sid,
 785                                      const struct GUID *oc_guid,
 786                                      const struct dsdb_attribute *attr)
 787 {
 788         int ret;
 789         unsigned int i;
 790         struct ldb_context *ldb = ldb_module_get_ctx(module);
 791         struct ldb_dn *user_dn;
 792         struct ldb_message_element *member_el;
 793         /* if we have wp, we can do whatever we like */
 794         if (acl_check_access_on_attribute(module,
 795                                           mem_ctx,
 796                                           sd,
 797                                           sid,
 798                                           SEC_ADS_WRITE_PROP,
 799                                           attr) == LDB_SUCCESS) {
 800                 return LDB_SUCCESS;
 801         }
 802         /* if we are adding/deleting ourselves, check for self membership */
 803         ret = dsdb_find_dn_by_sid(ldb, mem_ctx,
 804                                   &acl_user_token(module)->sids[PRIMARY_USER_SID_INDEX],
 805                                   &user_dn);
 806         if (ret != LDB_SUCCESS) {
 807                 return ret;
 808         }
 809         member_el = ldb_msg_find_element(req->op.mod.message, "member");
 810         if (!member_el) {
 811                 return ldb_operr(ldb);
 812         }
 813         /* user can only remove oneself */
 814         if (member_el->num_values == 0) {
 815                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 816         }
 817         for (i = 0; i < member_el->num_values; i++) {
 818                 if (strcasecmp((const char *)member_el->values[i].data,
 819                                ldb_dn_get_extended_linearized(mem_ctx, user_dn, 1)) != 0) {
 820                         return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 821                 }
 822         }
 823         ret = acl_check_extended_right(mem_ctx, sd, acl_user_token(module),
 824                                        GUID_DRS_SELF_MEMBERSHIP,
 825                                        SEC_ADS_SELF_WRITE,
 826                                        sid);
 827         if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
 828                 dsdb_acl_debug(sd, acl_user_token(module),
 829                                req->op.mod.message->dn,
 830                                true,
 831                                10);
 832         }
 833         return ret;
 834 }
 835
 836 static int acl_check_password_rights(TALLOC_CTX *mem_ctx,
 837                                      struct ldb_module *module,
 838                                      struct ldb_request *req,
 839                                      struct security_descriptor *sd,
 840                                      struct dom_sid *sid,
 841                                      const struct GUID *oc_guid,
 842                                      bool userPassword)
 843 {
 844         int ret = LDB_SUCCESS;
 845         unsigned int del_attr_cnt = 0, add_attr_cnt = 0, rep_attr_cnt = 0;
 846         struct ldb_message_element *el;
 847         struct ldb_message *msg;
 848         const char *passwordAttrs[] = { "userPassword", "clearTextPassword",
 849                                         "unicodePwd", "dBCSPwd", NULL }, **l;
 850         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 851
 852         msg = ldb_msg_copy_shallow(tmp_ctx, req->op.mod.message);
 853         if (msg == NULL) {
 854                 return ldb_module_oom(module);
 855         }
 856         for (l = passwordAttrs; *l != NULL; l++) {
 857                 if ((!userPassword) && (ldb_attr_cmp(*l, "userPassword") == 0)) {
 858                         continue;
 859                 }
 860
 861                 while ((el = ldb_msg_find_element(msg, *l)) != NULL) {
 862                         if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE) {
 863                                 ++del_attr_cnt;
 864                         }
 865                         if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_ADD) {
 866                                 ++add_attr_cnt;
 867                         }
 868                         if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) {
 869                                 ++rep_attr_cnt;
 870                         }
 871                         ldb_msg_remove_element(msg, el);
 872                 }
 873         }
 874
 875         /* single deletes will be handled by the "password_hash" LDB module
 876          * later in the stack, so we let it though here */
 877         if ((del_attr_cnt > 0) && (add_attr_cnt == 0) && (rep_attr_cnt == 0)) {
 878                 talloc_free(tmp_ctx);
 879                 return LDB_SUCCESS;
 880         }
 881
 882         if (ldb_request_get_control(req,
 883                                     DSDB_CONTROL_PASSWORD_CHANGE_OID) != NULL) {
 884                 /* The "DSDB_CONTROL_PASSWORD_CHANGE_OID" control means that we
 885                  * have a user password change and not a set as the message
 886                  * looks like. In it's value blob it contains the NT and/or LM
 887                  * hash of the old password specified by the user.
 888                  * This control is used by the SAMR and "kpasswd" password
 889                  * change mechanisms. */
 890                 ret = acl_check_extended_right(tmp_ctx, sd, acl_user_token(module),
 891                                                GUID_DRS_USER_CHANGE_PASSWORD,
 892                                                SEC_ADS_CONTROL_ACCESS,
 893                                                sid);
 894         }
 895         else if (rep_attr_cnt > 0 || (add_attr_cnt != del_attr_cnt)) {
 896                 ret = acl_check_extended_right(tmp_ctx, sd, acl_user_token(module),
 897                                                GUID_DRS_FORCE_CHANGE_PASSWORD,
 898                                                SEC_ADS_CONTROL_ACCESS,
 899                                                sid);
 900         }
 901         else if (add_attr_cnt == 1 && del_attr_cnt == 1) {
 902                 ret = acl_check_extended_right(tmp_ctx, sd, acl_user_token(module),
 903                                                GUID_DRS_USER_CHANGE_PASSWORD,
 904                                                SEC_ADS_CONTROL_ACCESS,
 905                                                sid);
 906                 /* Very strange, but we get constraint violation in this case */
 907                 if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
 908                         ret = LDB_ERR_CONSTRAINT_VIOLATION;
 909                 }
 910         }
 911         if (ret != LDB_SUCCESS) {
 912                 dsdb_acl_debug(sd, acl_user_token(module),
 913                                req->op.mod.message->dn,
 914                                true,
 915                                10);
 916         }
 917         talloc_free(tmp_ctx);
 918         return ret;
 919 }
 920
 921 static const struct GUID *get_oc_guid_from_message(const struct dsdb_schema *schema,
 922                                                    struct ldb_message *msg)
 923 {
 924         struct ldb_message_element *oc_el;
 925         const struct dsdb_class *object_class;
 926
 927         oc_el = ldb_msg_find_element(msg, "objectClass");
 928         if (!oc_el) {
 929                 return NULL;
 930         }
 931
 932         object_class = dsdb_get_last_structural_class(schema, oc_el);
 933         if (object_class == NULL) {
 934                 return NULL;
 935         }
 936
 937         return &object_class->schemaIDGUID;
 938 }
 939
 940
 941 static int acl_modify(struct ldb_module *module, struct ldb_request *req)
 942 {
 943         int ret;
 944         struct ldb_context *ldb = ldb_module_get_ctx(module);
 945         const struct dsdb_schema *schema;
 946         unsigned int i;
 947         const struct GUID *guid;
 948         uint32_t access_granted;
 949         struct object_tree *root = NULL;
 950         struct object_tree *new_node = NULL;
 951         NTSTATUS status;
 952         struct ldb_result *acl_res;
 953         struct security_descriptor *sd;
 954         struct dom_sid *sid = NULL;
 955         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
 956         bool userPassword = dsdb_user_password_support(module, req, req);
 957         TALLOC_CTX *tmp_ctx = talloc_new(req);
 958         static const char *acl_attrs[] = {
 959                 "nTSecurityDescriptor",
 960                 "objectClass",
 961                 "objectSid",
 962                 NULL
 963         };
 964
 965         if (as_system != NULL) {
 966                 as_system->critical = 0;
 967         }
 968
 969         /* Don't print this debug statement if elements[0].name is going to be NULL */
 970         if(req->op.mod.message->num_elements > 0)
 971         {
 972                 DEBUG(10, ("ldb:acl_modify: %s\n", req->op.mod.message->elements[0].name));
 973         }
 974         if (dsdb_module_am_system(module) || as_system) {
 975                 return ldb_next_request(module, req);
 976         }
 977         if (ldb_dn_is_special(req->op.mod.message->dn)) {
 978                 return ldb_next_request(module, req);
 979         }
 980         ret = dsdb_module_search_dn(module, tmp_ctx, &acl_res, req->op.mod.message->dn,
 981                                     acl_attrs,
 982                                     DSDB_FLAG_NEXT_MODULE |
 983                                     DSDB_FLAG_AS_SYSTEM |
 984                                     DSDB_SEARCH_SHOW_RECYCLED,
 985                                     req);
 986
 987         if (ret != LDB_SUCCESS) {
 988                 goto fail;
 989         }
 990
 991         schema = dsdb_get_schema(ldb, tmp_ctx);
 992         if (!schema) {
 993                 ret = LDB_ERR_OPERATIONS_ERROR;
 994                 goto fail;
 995         }
 996
 997         ret = dsdb_get_sd_from_ldb_message(ldb, tmp_ctx, acl_res->msgs[0], &sd);
 998         if (ret != LDB_SUCCESS) {
 999                 talloc_free(tmp_ctx);
1000                 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
1001                                  "acl_modify: Error retrieving security descriptor.");
1002         }
1003         /* Theoretically we pass the check if the object has no sd */
1004         if (!sd) {
1005                 goto success;
1006         }
1007
1008         guid = get_oc_guid_from_message(schema, acl_res->msgs[0]);
1009         if (!guid) {
1010                 talloc_free(tmp_ctx);
1011                 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
1012                                  "acl_modify: Error retrieving object class GUID.");
1013         }
1014         sid = samdb_result_dom_sid(req, acl_res->msgs[0], "objectSid");
1015         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
1016                                    &root, &new_node)) {
1017                 talloc_free(tmp_ctx);
1018                 return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
1019                                  "acl_modify: Error adding new node in object tree.");
1020         }
1021         for (i=0; i < req->op.mod.message->num_elements; i++){
1022                 const struct dsdb_attribute *attr;
1023                 attr = dsdb_attribute_by_lDAPDisplayName(schema,
1024                                                          req->op.mod.message->elements[i].name);
1025
1026                 if (ldb_attr_cmp("nTSecurityDescriptor", req->op.mod.message->elements[i].name) == 0) {
1027                         status = sec_access_check_ds(sd, acl_user_token(module),
1028                                              SEC_STD_WRITE_DAC,
1029                                              &access_granted,
1030                                              NULL,
1031                                              sid);
1032
1033                         if (!NT_STATUS_IS_OK(status)) {
1034                                 ldb_asprintf_errstring(ldb_module_get_ctx(module),
1035                                                        "Object %s has no write dacl access\n",
1036                                                        ldb_dn_get_linearized(req->op.mod.message->dn));
1037                                 dsdb_acl_debug(sd,
1038                                                acl_user_token(module),
1039                                                req->op.mod.message->dn,
1040                                                true,
1041                                                10);
1042                                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
1043                                 goto fail;
1044                         }
1045                 }
1046                 else if (ldb_attr_cmp("member", req->op.mod.message->elements[i].name) == 0) {
1047                         ret = acl_check_self_membership(tmp_ctx,
1048                                                         module,
1049                                                         req,
1050                                                         sd,
1051                                                         sid,
1052                                                         guid,
1053                                                         attr);
1054                         if (ret != LDB_SUCCESS) {
1055                                 goto fail;
1056                         }
1057                 }
1058                 else if (ldb_attr_cmp("dBCSPwd", req->op.mod.message->elements[i].name) == 0) {
1059                         /* this one is not affected by any rights, we should let it through
1060                            so that passwords_hash returns the correct error */
1061                         continue;
1062                 }
1063                 else if (ldb_attr_cmp("unicodePwd", req->op.mod.message->elements[i].name) == 0 ||
1064                          (userPassword && ldb_attr_cmp("userPassword", req->op.mod.message->elements[i].name) == 0) ||
1065                          ldb_attr_cmp("clearTextPassword", req->op.mod.message->elements[i].name) == 0) {
1066                         ret = acl_check_password_rights(tmp_ctx,
1067                                                         module,
1068                                                         req,
1069                                                         sd,
1070                                                         sid,
1071                                                         guid,
1072                                                         userPassword);
1073                         if (ret != LDB_SUCCESS) {
1074                                 goto fail;
1075                         }
1076                 } else if (ldb_attr_cmp("servicePrincipalName", req->op.mod.message->elements[i].name) == 0) {
1077                         ret = acl_check_spn(tmp_ctx,
1078                                             module,
1079                                             req,
1080                                             sd,
1081                                             sid,
1082                                             guid,
1083                                             attr);
1084                         if (ret != LDB_SUCCESS) {
1085                                 goto fail;
1086                         }
1087                 } else {
1088
1089                 /* This basic attribute existence check with the right errorcode
1090                  * is needed since this module is the first one which requests
1091                  * schema attribute information.
1092                  * The complete attribute checking is done in the
1093                  * "objectclass_attrs" module behind this one.
1094                  */
1095                         if (!attr) {
1096                                 ldb_asprintf_errstring(ldb, "acl_modify: attribute '%s' on entry '%s' was not found in the schema!",
1097                                                        req->op.mod.message->elements[i].name,
1098                                                ldb_dn_get_linearized(req->op.mod.message->dn));
1099                                 ret =  LDB_ERR_NO_SUCH_ATTRIBUTE;
1100                                 goto fail;
1101                         }
1102                         if (!insert_in_object_tree(tmp_ctx,
1103                                                    &attr->attributeSecurityGUID, SEC_ADS_WRITE_PROP,
1104                                                    &new_node, &new_node)) {
1105                                 ldb_asprintf_errstring(ldb_module_get_ctx(module),
1106                                                        "acl_modify: cannot add to object tree securityGUID\n");
1107                                 ret = LDB_ERR_OPERATIONS_ERROR;
1108                                 goto fail;
1109                         }
1110
1111                         if (!insert_in_object_tree(tmp_ctx,
1112                                                    &attr->schemaIDGUID, SEC_ADS_WRITE_PROP, &new_node, &new_node)) {
1113                                 ldb_asprintf_errstring(ldb_module_get_ctx(module),
1114                                                        "acl_modify: cannot add to object tree attributeGUID\n");
1115                                 ret = LDB_ERR_OPERATIONS_ERROR;
1116                                 goto fail;
1117                         }
1118                 }
1119         }
1120
1121         if (root->num_of_children > 0) {
1122                 status = sec_access_check_ds(sd, acl_user_token(module),
1123                                              SEC_ADS_WRITE_PROP,
1124                                              &access_granted,
1125                                              root,
1126                                              sid);
1127
1128                 if (!NT_STATUS_IS_OK(status)) {
1129                         ldb_asprintf_errstring(ldb_module_get_ctx(module),
1130                                                "Object %s has no write property access\n",
1131                                                ldb_dn_get_linearized(req->op.mod.message->dn));
1132                         dsdb_acl_debug(sd,
1133                                        acl_user_token(module),
1134                                        req->op.mod.message->dn,
1135                                        true,
1136                                        10);
1137                         ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
1138                         goto fail;
1139                 }
1140         }
1141
1142 success:
1143         talloc_free(tmp_ctx);
1144         return ldb_next_request(module, req);
1145 fail:
1146         talloc_free(tmp_ctx);
1147         return ret;
1148 }
1149
1150 /* similar to the modify for the time being.
1151  * We need to consider the special delete tree case, though - TODO */
1152 static int acl_delete(struct ldb_module *module, struct ldb_request *req)
1153 {
1154         int ret;
1155         struct ldb_dn *parent = ldb_dn_get_parent(req, req->op.del.dn);
1156         struct ldb_context *ldb;
1157         struct ldb_dn *nc_root;
1158         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
1159
1160         if (as_system != NULL) {
1161                 as_system->critical = 0;
1162         }
1163
1164         DEBUG(10, ("ldb:acl_delete: %s\n", ldb_dn_get_linearized(req->op.del.dn)));
1165         if (dsdb_module_am_system(module) || as_system) {
1166                 return ldb_next_request(module, req);
1167         }
1168         if (ldb_dn_is_special(req->op.del.dn)) {
1169                 return ldb_next_request(module, req);
1170         }
1171
1172         ldb = ldb_module_get_ctx(module);
1173
1174         /* Make sure we aren't deleting a NC */
1175
1176         ret = dsdb_find_nc_root(ldb, req, req->op.del.dn, &nc_root);
1177         if (ret != LDB_SUCCESS) {
1178                 return ret;
1179         }
1180         if (ldb_dn_compare(nc_root, req->op.del.dn) == 0) {
1181                 talloc_free(nc_root);
1182                 DEBUG(10,("acl:deleting a NC\n"));
1183                 /* Windows returns "ERR_UNWILLING_TO_PERFORM */
1184                 return ldb_module_done(req, NULL, NULL,
1185                                        LDB_ERR_UNWILLING_TO_PERFORM);
1186         }
1187         talloc_free(nc_root);
1188
1189         /* First check if we have delete object right */
1190         ret = dsdb_module_check_access_on_dn(module, req, req->op.del.dn,
1191                                              SEC_STD_DELETE, NULL, req);
1192         if (ret == LDB_SUCCESS) {
1193                 return ldb_next_request(module, req);
1194         }
1195
1196         /* Nope, we don't have delete object. Lets check if we have delete
1197          * child on the parent */
1198         ret = dsdb_module_check_access_on_dn(module, req, parent,
1199                                              SEC_ADS_DELETE_CHILD, NULL, req);
1200         if (ret != LDB_SUCCESS) {
1201                 return ret;
1202         }
1203
1204         return ldb_next_request(module, req);
1205 }
1206
1207 static int acl_rename(struct ldb_module *module, struct ldb_request *req)
1208 {
1209         int ret;
1210         struct ldb_dn *oldparent = ldb_dn_get_parent(req, req->op.rename.olddn);
1211         struct ldb_dn *newparent = ldb_dn_get_parent(req, req->op.rename.newdn);
1212         const struct dsdb_schema *schema;
1213         struct ldb_context *ldb;
1214         struct security_descriptor *sd = NULL;
1215         struct dom_sid *sid = NULL;
1216         struct ldb_result *acl_res;
1217         const struct GUID *guid;
1218         struct ldb_dn *nc_root;
1219         struct object_tree *root = NULL;
1220         struct object_tree *new_node = NULL;
1221         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
1222         TALLOC_CTX *tmp_ctx = talloc_new(req);
1223         NTSTATUS status;
1224         uint32_t access_granted;
1225         const char *rdn_name;
1226         static const char *acl_attrs[] = {
1227                 "nTSecurityDescriptor",
1228                 "objectClass",
1229                 "objectSid",
1230                 NULL
1231         };
1232
1233         if (as_system != NULL) {
1234                 as_system->critical = 0;
1235         }
1236
1237         DEBUG(10, ("ldb:acl_rename: %s\n", ldb_dn_get_linearized(req->op.rename.olddn)));
1238         if (dsdb_module_am_system(module) || as_system) {
1239                 return ldb_next_request(module, req);
1240         }
1241         if (ldb_dn_is_special(req->op.rename.olddn)) {
1242                 return ldb_next_request(module, req);
1243         }
1244
1245         ldb = ldb_module_get_ctx(module);
1246
1247         /* Make sure we aren't renaming/moving a NC */
1248
1249         ret = dsdb_find_nc_root(ldb, req, req->op.rename.olddn, &nc_root);
1250         if (ret != LDB_SUCCESS) {
1251                 return ret;
1252         }
1253         if (ldb_dn_compare(nc_root, req->op.rename.olddn) == 0) {
1254                 talloc_free(nc_root);
1255                 DEBUG(10,("acl:renaming/moving a NC\n"));
1256                 /* Windows returns "ERR_UNWILLING_TO_PERFORM */
1257                 return ldb_module_done(req, NULL, NULL,
1258                                        LDB_ERR_UNWILLING_TO_PERFORM);
1259         }
1260         talloc_free(nc_root);
1261
1262         /* Look for the parent */
1263
1264         ret = dsdb_module_search_dn(module, tmp_ctx, &acl_res,
1265                                     req->op.rename.olddn, acl_attrs,
1266                                     DSDB_FLAG_NEXT_MODULE |
1267                                     DSDB_FLAG_AS_SYSTEM |
1268                                     DSDB_SEARCH_SHOW_RECYCLED, req);
1269         /* we sould be able to find the parent */
1270         if (ret != LDB_SUCCESS) {
1271                 DEBUG(10,("acl: failed to find object %s\n",
1272                           ldb_dn_get_linearized(req->op.rename.olddn)));
1273                 talloc_free(tmp_ctx);
1274                 return ret;
1275         }
1276
1277         schema = dsdb_get_schema(ldb, acl_res);
1278         if (!schema) {
1279                 talloc_free(tmp_ctx);
1280                 return ldb_operr(ldb);
1281         }
1282
1283         guid = get_oc_guid_from_message(schema, acl_res->msgs[0]);
1284         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
1285                                    &root, &new_node)) {
1286                 talloc_free(tmp_ctx);
1287                 return ldb_operr(ldb);
1288         };
1289
1290         guid = attribute_schemaid_guid_by_lDAPDisplayName(schema,
1291                                                           "name");
1292         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
1293                                    &new_node, &new_node)) {
1294                 talloc_free(tmp_ctx);
1295                 return ldb_operr(ldb);
1296         };
1297
1298         rdn_name = ldb_dn_get_rdn_name(req->op.rename.olddn);
1299         if (rdn_name == NULL) {
1300                 talloc_free(tmp_ctx);
1301                 return ldb_operr(ldb);
1302         }
1303         guid = attribute_schemaid_guid_by_lDAPDisplayName(schema,
1304                                                           rdn_name);
1305         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
1306                                    &new_node, &new_node)) {
1307                 talloc_free(tmp_ctx);
1308                 return ldb_operr(ldb);
1309         };
1310
1311         ret = dsdb_get_sd_from_ldb_message(ldb, req, acl_res->msgs[0], &sd);
1312
1313         if (ret != LDB_SUCCESS) {
1314                 talloc_free(tmp_ctx);
1315                 return ldb_operr(ldb);
1316         }
1317         /* Theoretically we pass the check if the object has no sd */
1318         if (!sd) {
1319                 talloc_free(tmp_ctx);
1320                 return LDB_SUCCESS;
1321         }
1322         sid = samdb_result_dom_sid(req, acl_res->msgs[0], "objectSid");
1323         status = sec_access_check_ds(sd, acl_user_token(module),
1324                                      SEC_ADS_WRITE_PROP,
1325                                      &access_granted,
1326                                      root,
1327                                      sid);
1328
1329         if (!NT_STATUS_IS_OK(status)) {
1330                 ldb_asprintf_errstring(ldb_module_get_ctx(module),
1331                                        "Object %s has no wp on name\n",
1332                                        ldb_dn_get_linearized(req->op.rename.olddn));
1333                 dsdb_acl_debug(sd,
1334                           acl_user_token(module),
1335                           req->op.rename.olddn,
1336                           true,
1337                           10);
1338                 talloc_free(tmp_ctx);
1339                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
1340         }
1341
1342         if (ldb_dn_compare(oldparent, newparent) == 0) {
1343                 /* regular rename, not move, nothing more to do */
1344                 talloc_free(tmp_ctx);
1345                 return ldb_next_request(module, req);
1346         }
1347
1348         /* new parent should have create child */
1349         root = NULL;
1350         new_node = NULL;
1351         guid = get_oc_guid_from_message(schema, acl_res->msgs[0]);
1352         if (!guid) {
1353                 ldb_asprintf_errstring(ldb_module_get_ctx(module),
1354                                        "acl:renamed object has no object class\n");
1355                 talloc_free(tmp_ctx);
1356                 return ldb_module_done(req, NULL, NULL,  LDB_ERR_OPERATIONS_ERROR);
1357         }
1358
1359         ret = dsdb_module_check_access_on_dn(module, req, newparent, SEC_ADS_CREATE_CHILD, guid, req);
1360         if (ret != LDB_SUCCESS) {
1361                 ldb_asprintf_errstring(ldb_module_get_ctx(module),
1362                                        "acl:access_denied renaming %s",
1363                                        ldb_dn_get_linearized(req->op.rename.olddn));
1364                 talloc_free(tmp_ctx);
1365                 return ret;
1366         }
1367         /* do we have delete object on the object? */
1368
1369         status = sec_access_check_ds(sd, acl_user_token(module),
1370                                      SEC_STD_DELETE,
1371                                      &access_granted,
1372                                      NULL,
1373                                      sid);
1374
1375         if (NT_STATUS_IS_OK(status)) {
1376                 talloc_free(tmp_ctx);
1377                 return ldb_next_request(module, req);
1378         }
1379         /* what about delete child on the current parent */
1380         ret = dsdb_module_check_access_on_dn(module, req, oldparent, SEC_ADS_DELETE_CHILD, NULL, req);
1381         if (ret != LDB_SUCCESS) {
1382                 ldb_asprintf_errstring(ldb_module_get_ctx(module),
1383                                        "acl:access_denied renaming %s", ldb_dn_get_linearized(req->op.rename.olddn));
1384                 talloc_free(tmp_ctx);
1385                 return ldb_module_done(req, NULL, NULL, ret);
1386         }
1387
1388         talloc_free(tmp_ctx);
1389
1390         return ldb_next_request(module, req);
1391 }
1392
1393 static int acl_search_update_confidential_attrs(struct acl_context *ac,
1394                                                 struct acl_private *data)
1395 {
1396         struct dsdb_attribute *a;
1397         uint32_t n = 0;
1398
1399         if (data->acl_search) {
1400                 /*
1401                  * If acl:search is activated, the acl_read module
1402                  * protects confidential attributes.
1403                  */
1404                 return LDB_SUCCESS;
1405         }
1406
1407         if ((ac->schema == data->cached_schema_ptr) &&
1408             (ac->schema->loaded_usn == data->cached_schema_loaded_usn) &&
1409             (ac->schema->metadata_usn == data->cached_schema_metadata_usn))
1410         {
1411                 return LDB_SUCCESS;
1412         }
1413
1414         data->cached_schema_ptr = NULL;
1415         data->cached_schema_loaded_usn = 0;
1416         data->cached_schema_metadata_usn = 0;
1417         TALLOC_FREE(data->confidential_attrs);
1418
1419         if (ac->schema == NULL) {
1420                 return LDB_SUCCESS;
1421         }
1422
1423         for (a = ac->schema->attributes; a; a = a->next) {
1424                 const char **attrs = data->confidential_attrs;
1425
1426                 if (!(a->searchFlags & SEARCH_FLAG_CONFIDENTIAL)) {
1427                         continue;
1428                 }
1429
1430                 attrs = talloc_realloc(data, attrs, const char *, n + 2);
1431                 if (attrs == NULL) {
1432                         TALLOC_FREE(data->confidential_attrs);
1433                         return ldb_module_oom(ac->module);
1434                 }
1435
1436                 attrs[n] = a->lDAPDisplayName;
1437                 attrs[n+1] = NULL;
1438                 n++;
1439
1440                 data->confidential_attrs = attrs;
1441         }
1442
1443         data->cached_schema_ptr = ac->schema;
1444         data->cached_schema_loaded_usn = ac->schema->loaded_usn;
1445         data->cached_schema_metadata_usn = ac->schema->metadata_usn;
1446
1447         return LDB_SUCCESS;
1448 }
1449
1450 static int acl_search_callback(struct ldb_request *req, struct ldb_reply *ares)
1451 {
1452         struct acl_context *ac;
1453         struct acl_private *data;
1454         struct ldb_result *acl_res;
1455         static const char *acl_attrs[] = {
1456                 "objectClass",
1457                 "nTSecurityDescriptor",
1458                 "objectSid",
1459                 NULL
1460         };
1461         int ret;
1462         unsigned int i;
1463
1464         ac = talloc_get_type(req->context, struct acl_context);
1465         data = talloc_get_type(ldb_module_get_private(ac->module), struct acl_private);
1466         if (!ares) {
1467                 return ldb_module_done(ac->req, NULL, NULL,
1468                                        LDB_ERR_OPERATIONS_ERROR);
1469         }
1470         if (ares->error != LDB_SUCCESS) {
1471                 return ldb_module_done(ac->req, ares->controls,
1472                                        ares->response, ares->error);
1473         }
1474
1475         switch (ares->type) {
1476         case LDB_REPLY_ENTRY:
1477                 if (ac->constructed_attrs) {
1478                         ret = dsdb_module_search_dn(ac->module, ac, &acl_res, ares->message->dn,
1479                                                     acl_attrs,
1480                                                     DSDB_FLAG_NEXT_MODULE |
1481                                                     DSDB_FLAG_AS_SYSTEM |
1482                                                     DSDB_SEARCH_SHOW_RECYCLED,
1483                                                     req);
1484                         if (ret != LDB_SUCCESS) {
1485                                 return ldb_module_done(ac->req, NULL, NULL, ret);
1486                         }
1487                 }
1488
1489                 if (ac->allowedAttributes || ac->allowedAttributesEffective) {
1490                         ret = acl_allowedAttributes(ac->module, ac->schema,
1491                                                     acl_res->msgs[0],
1492                                                     ares->message, ac);
1493                         if (ret != LDB_SUCCESS) {
1494                                 return ldb_module_done(ac->req, NULL, NULL, ret);
1495                         }
1496                 }
1497
1498                 if (ac->allowedChildClasses) {
1499                         ret = acl_childClasses(ac->module, ac->schema,
1500                                                acl_res->msgs[0],
1501                                                ares->message,
1502                                                "allowedChildClasses");
1503                         if (ret != LDB_SUCCESS) {
1504                                 return ldb_module_done(ac->req, NULL, NULL, ret);
1505                         }
1506                 }
1507
1508                 if (ac->allowedChildClassesEffective) {
1509                         ret = acl_childClassesEffective(ac->module, ac->schema,
1510                                                         acl_res->msgs[0],
1511                                                         ares->message, ac);
1512                         if (ret != LDB_SUCCESS) {
1513                                 return ldb_module_done(ac->req, NULL, NULL, ret);
1514                         }
1515                 }
1516
1517                 if (ac->sDRightsEffective) {
1518                         ret = acl_sDRightsEffective(ac->module,
1519                                                     acl_res->msgs[0],
1520                                                     ares->message, ac);
1521                         if (ret != LDB_SUCCESS) {
1522                                 return ldb_module_done(ac->req, NULL, NULL, ret);
1523                         }
1524                 }
1525
1526                 if (data == NULL) {
1527                         return ldb_module_send_entry(ac->req, ares->message,
1528                                                      ares->controls);
1529                 }
1530
1531                 if (ac->am_system) {
1532                         return ldb_module_send_entry(ac->req, ares->message,
1533                                                      ares->controls);
1534                 }
1535
1536                 if (data->password_attrs != NULL) {
1537                         for (i = 0; data->password_attrs[i]; i++) {
1538                                 if ((!ac->userPassword) &&
1539                                     (ldb_attr_cmp(data->password_attrs[i],
1540                                                   "userPassword") == 0))
1541                                 {
1542                                                 continue;
1543                                 }
1544
1545                                 ldb_msg_remove_attr(ares->message, data->password_attrs[i]);
1546                         }
1547                 }
1548
1549                 if (ac->am_administrator) {
1550                         return ldb_module_send_entry(ac->req, ares->message,
1551                                                      ares->controls);
1552                 }
1553
1554                 ret = acl_search_update_confidential_attrs(ac, data);
1555                 if (ret != LDB_SUCCESS) {
1556                         return ret;
1557                 }
1558
1559                 if (data->confidential_attrs != NULL) {
1560                         for (i = 0; data->confidential_attrs[i]; i++) {
1561                                 ldb_msg_remove_attr(ares->message,
1562                                                     data->confidential_attrs[i]);
1563                         }
1564                 }
1565
1566                 return ldb_module_send_entry(ac->req, ares->message, ares->controls);
1567
1568         case LDB_REPLY_REFERRAL:
1569                 return ldb_module_send_referral(ac->req, ares->referral);
1570
1571         case LDB_REPLY_DONE:
1572                 return ldb_module_done(ac->req, ares->controls,
1573                                        ares->response, LDB_SUCCESS);
1574
1575         }
1576         return LDB_SUCCESS;
1577 }
1578
1579 static int acl_search(struct ldb_module *module, struct ldb_request *req)
1580 {
1581         struct ldb_context *ldb;
1582         struct acl_context *ac;
1583         struct ldb_parse_tree *down_tree;
1584         struct ldb_request *down_req;
1585         struct acl_private *data;
1586         int ret;
1587         unsigned int i;
1588
1589         ldb = ldb_module_get_ctx(module);
1590
1591         ac = talloc_zero(req, struct acl_context);
1592         if (ac == NULL) {
1593                 return ldb_oom(ldb);
1594         }
1595         data = talloc_get_type(ldb_module_get_private(module), struct acl_private);
1596
1597         ac->module = module;
1598         ac->req = req;
1599         ac->am_system = dsdb_module_am_system(module);
1600         ac->am_administrator = dsdb_module_am_administrator(module);
1601         ac->constructed_attrs = false;
1602         ac->modify_search = true;
1603         ac->allowedAttributes = ldb_attr_in_list(req->op.search.attrs, "allowedAttributes");
1604         ac->allowedAttributesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedAttributesEffective");
1605         ac->allowedChildClasses = ldb_attr_in_list(req->op.search.attrs, "allowedChildClasses");
1606         ac->allowedChildClassesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedChildClassesEffective");
1607         ac->sDRightsEffective = ldb_attr_in_list(req->op.search.attrs, "sDRightsEffective");
1608         ac->userPassword = dsdb_user_password_support(module, ac, req);
1609         ac->schema = dsdb_get_schema(ldb, ac);
1610
1611         ac->constructed_attrs |= ac->allowedAttributes;
1612         ac->constructed_attrs |= ac->allowedChildClasses;
1613         ac->constructed_attrs |= ac->allowedChildClassesEffective;
1614         ac->constructed_attrs |= ac->allowedAttributesEffective;
1615         ac->constructed_attrs |= ac->sDRightsEffective;
1616
1617         if (data == NULL) {
1618                 ac->modify_search = false;
1619         }
1620         if (ac->am_system) {
1621                 ac->modify_search = false;
1622         }
1623
1624         if (!ac->constructed_attrs && !ac->modify_search) {
1625                 return ldb_next_request(module, req);
1626         }
1627
1628         ret = acl_search_update_confidential_attrs(ac, data);
1629         if (ret != LDB_SUCCESS) {
1630                 return ret;
1631         }
1632
1633         down_tree = ldb_parse_tree_copy_shallow(ac, req->op.search.tree);
1634         if (down_tree == NULL) {
1635                 return ldb_oom(ldb);
1636         }
1637
1638         if (!ac->am_system && data->password_attrs) {
1639                 for (i = 0; data->password_attrs[i]; i++) {
1640                         if ((!ac->userPassword) &&
1641                             (ldb_attr_cmp(data->password_attrs[i],
1642                                           "userPassword") == 0))
1643                         {
1644                                 continue;
1645                         }
1646
1647                         ldb_parse_tree_attr_replace(down_tree,
1648                                                     data->password_attrs[i],
1649                                                     "kludgeACLredactedattribute");
1650                 }
1651         }
1652
1653         if (!ac->am_system && !ac->am_administrator && data->confidential_attrs) {
1654                 for (i = 0; data->confidential_attrs[i]; i++) {
1655                         ldb_parse_tree_attr_replace(down_tree,
1656                                                     data->confidential_attrs[i],
1657                                                     "kludgeACLredactedattribute");
1658                 }
1659         }
1660
1661         ret = ldb_build_search_req_ex(&down_req,
1662                                       ldb, ac,
1663                                       req->op.search.base,
1664                                       req->op.search.scope,
1665                                       down_tree,
1666                                       req->op.search.attrs,
1667                                       req->controls,
1668                                       ac, acl_search_callback,
1669                                       req);
1670         LDB_REQ_SET_LOCATION(down_req);
1671         if (ret != LDB_SUCCESS) {
1672                 return ret;
1673         }
1674         /* perform the search */
1675         return ldb_next_request(module, down_req);
1676 }
1677
1678 static int acl_extended(struct ldb_module *module, struct ldb_request *req)
1679 {
1680         struct ldb_context *ldb = ldb_module_get_ctx(module);
1681         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
1682
1683         /* allow everybody to read the sequence number */
1684         if (strcmp(req->op.extended.oid,
1685                    LDB_EXTENDED_SEQUENCE_NUMBER) == 0) {
1686                 return ldb_next_request(module, req);
1687         }
1688
1689         if (dsdb_module_am_system(module) ||
1690             dsdb_module_am_administrator(module) || as_system) {
1691                 return ldb_next_request(module, req);
1692         } else {
1693                 ldb_asprintf_errstring(ldb,
1694                                        "acl_extended: "
1695                                        "attempted database modify not permitted. "
1696                                        "User %s is not SYSTEM or an administrator",
1697                                        acl_user_name(req, module));
1698                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
1699         }
1700 }
1701
1702 static const struct ldb_module_ops ldb_acl_module_ops = {
1703         .name              = "acl",
1704         .search            = acl_search,
1705         .add               = acl_add,
1706         .modify            = acl_modify,
1707         .del               = acl_delete,
1708         .rename            = acl_rename,
1709         .extended          = acl_extended,
1710         .init_context      = acl_module_init
1711 };
1712
1713 int ldb_acl_module_init(const char *version)
1714 {
1715         LDB_MODULE_CHECK_VERSION(version);
1716         return ldb_register_module(&ldb_acl_module_ops);
1717 }