source3/libads/disp_sec.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions. ADS stuff
   4    Copyright (C) Alexey Kotovich 2002
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21
  22 /* for ADS */
  23 #define SEC_RIGHTS_FULL_CTRL            0xf01ff
  24
  25 #ifdef HAVE_LDAP
  26
  27 static struct perm_mask_str {
  28         uint32  mask;
  29         const char   *str;
  30 } perms[] = {
  31         {SEC_RIGHTS_FULL_CTRL,          "[Full Control]"},
  32
  33         {SEC_ADS_LIST,                  "[List Contents]"},
  34         {SEC_ADS_LIST_OBJECT,           "[List Object]"},
  35
  36         {SEC_ADS_READ_PROP,             "[Read All Properties]"},
  37         {SEC_STD_READ_CONTROL,          "[Read Permissions]"},
  38
  39         {SEC_ADS_SELF_WRITE,            "[All validate writes]"},
  40         {SEC_ADS_WRITE_PROP,            "[Write All Properties]"},
  41
  42         {SEC_STD_WRITE_DAC,             "[Modify Permissions]"},
  43         {SEC_STD_WRITE_OWNER,           "[Modify Owner]"},
  44
  45         {SEC_ADS_CREATE_CHILD,          "[Create All Child Objects]"},
  46
  47         {SEC_STD_DELETE,                "[Delete]"},
  48         {SEC_ADS_DELETE_TREE,           "[Delete Subtree]"},
  49         {SEC_ADS_DELETE_CHILD,          "[Delete All Child Objects]"},
  50
  51         {SEC_ADS_CONTROL_ACCESS,        "[Change Password]"},
  52         {SEC_ADS_CONTROL_ACCESS,        "[Reset Password]"},
  53
  54         {0,                             0}
  55 };
  56
  57 /* convert a security permissions into a string */
  58 static void ads_disp_perms(uint32 type)
  59 {
  60         int i = 0;
  61         int j = 0;
  62
  63         printf("Permissions: ");
  64
  65         if (type == SEC_RIGHTS_FULL_CTRL) {
  66                 printf("%s\n", perms[j].str);
  67                 return;
  68         }
  69
  70         for (i = 0; i < 32; i++) {
  71                 if (type & (1 << i)) {
  72                         for (j = 1; perms[j].str; j ++) {
  73                                 if (perms[j].mask == (((unsigned) 1) << i)) {
  74                                         printf("\n\t%s (0x%08x)", perms[j].str, perms[j].mask);
  75                                 }
  76                         }
  77                         type &= ~(1 << i);
  78                 }
  79         }
  80
  81         /* remaining bits get added on as-is */
  82         if (type != 0) {
  83                 printf("[%08x]", type);
  84         }
  85         puts("");
  86 }
  87
  88 static const char *ads_interprete_guid_from_object(ADS_STRUCT *ads,
  89                                                    TALLOC_CTX *mem_ctx,
  90                                                    const struct GUID *guid)
  91 {
  92         const char *ret = NULL;
  93
  94         if (!ads || !mem_ctx) {
  95                 return NULL;
  96         }
  97
  98         ret = ads_get_attrname_by_guid(ads, ads->config.schema_path,
  99                                        mem_ctx, guid);
 100         if (ret) {
 101                 return talloc_asprintf(mem_ctx, "LDAP attribute: \"%s\"", ret);
 102         }
 103
 104         ret = ads_get_extended_right_name_by_guid(ads, ads->config.config_path,
 105                                                   mem_ctx, guid);
 106
 107         if (ret) {
 108                 return talloc_asprintf(mem_ctx, "Extended right: \"%s\"", ret);
 109         }
 110
 111         return ret;
 112 }
 113
 114 static void ads_disp_sec_ace_object(ADS_STRUCT *ads,
 115                                     TALLOC_CTX *mem_ctx,
 116                                     struct security_ace_object *object)
 117 {
 118         if (object->flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
 119                 printf("Object type: SEC_ACE_OBJECT_TYPE_PRESENT\n");
 120                 printf("Object GUID: %s (%s)\n", GUID_string(mem_ctx,
 121                         &object->type.type),
 122                         ads_interprete_guid_from_object(ads, mem_ctx,
 123                                 &object->type.type));
 124         }
 125         if (object->flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT) {
 126                 printf("Object type: SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT\n");
 127                 printf("Object GUID: %s (%s)\n", GUID_string(mem_ctx,
 128                         &object->inherited_type.inherited_type),
 129                         ads_interprete_guid_from_object(ads, mem_ctx,
 130                                 &object->inherited_type.inherited_type));
 131         }
 132 }
 133
 134 /* display ACE */
 135 static void ads_disp_ace(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct security_ace *sec_ace)
 136 {
 137         const char *access_type = "UNKNOWN";
 138
 139         if (!sec_ace_object(sec_ace->type)) {
 140                 printf("------- ACE (type: 0x%02x, flags: 0x%02x, size: 0x%02x, mask: 0x%x)\n",
 141                   sec_ace->type,
 142                   sec_ace->flags,
 143                   sec_ace->size,
 144                   sec_ace->access_mask);
 145         } else {
 146                 printf("------- ACE (type: 0x%02x, flags: 0x%02x, size: 0x%02x, mask: 0x%x, object flags: 0x%x)\n",
 147                   sec_ace->type,
 148                   sec_ace->flags,
 149                   sec_ace->size,
 150                   sec_ace->access_mask,
 151                   sec_ace->object.object.flags);
 152         }
 153
 154         if (sec_ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
 155                 access_type = "ALLOWED";
 156         } else if (sec_ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
 157                 access_type = "DENIED";
 158         } else if (sec_ace->type == SEC_ACE_TYPE_SYSTEM_AUDIT) {
 159                 access_type = "SYSTEM AUDIT";
 160         } else if (sec_ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
 161                 access_type = "ALLOWED OBJECT";
 162         } else if (sec_ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT) {
 163                 access_type = "DENIED OBJECT";
 164         } else if (sec_ace->type == SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT) {
 165                 access_type = "AUDIT OBJECT";
 166         }
 167
 168         printf("access SID:  %s\naccess type: %s\n",
 169                sid_string_talloc(mem_ctx, &sec_ace->trustee), access_type);
 170
 171         if (sec_ace_object(sec_ace->type)) {
 172                 ads_disp_sec_ace_object(ads, mem_ctx, &sec_ace->object.object);
 173         }
 174
 175         ads_disp_perms(sec_ace->access_mask);
 176 }
 177
 178 /* display ACL */
 179 static void ads_disp_acl(struct security_acl *sec_acl, const char *type)
 180 {
 181         if (!sec_acl)
 182                 printf("------- (%s) ACL not present\n", type);
 183         else {
 184                 printf("------- (%s) ACL (revision: %d, size: %d, number of ACEs: %d)\n",
 185                        type,
 186                        sec_acl->revision,
 187                        sec_acl->size,
 188                        sec_acl->num_aces);
 189         }
 190 }
 191
 192 /* display SD */
 193 void ads_disp_sd(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, struct security_descriptor *sd)
 194 {
 195         int i;
 196         char *tmp_path = NULL;
 197
 198         if (!sd) {
 199                 return;
 200         }
 201
 202         if (ads && !ads->config.schema_path) {
 203                 if (ADS_ERR_OK(ads_schema_path(ads, mem_ctx, &tmp_path))) {
 204                         ads->config.schema_path = SMB_STRDUP(tmp_path);
 205                 }
 206         }
 207
 208         if (ads && !ads->config.config_path) {
 209                 if (ADS_ERR_OK(ads_config_path(ads, mem_ctx, &tmp_path))) {
 210                         ads->config.config_path = SMB_STRDUP(tmp_path);
 211                 }
 212         }
 213
 214         printf("-------------- Security Descriptor (revision: %d, type: 0x%02x)\n",
 215                sd->revision,
 216                sd->type);
 217
 218         printf("owner SID: %s\n", sd->owner_sid ?
 219                 sid_string_talloc(mem_ctx, sd->owner_sid) : "(null)");
 220         printf("group SID: %s\n", sd->group_sid ?
 221                 sid_string_talloc(mem_ctx, sd->group_sid) : "(null)");
 222
 223         ads_disp_acl(sd->sacl, "system");
 224         if (sd->sacl) {
 225                 for (i = 0; i < sd->sacl->num_aces; i ++) {
 226                         ads_disp_ace(ads, mem_ctx, &sd->sacl->aces[i]);
 227                 }
 228         }
 229
 230         ads_disp_acl(sd->dacl, "user");
 231         if (sd->dacl) {
 232                 for (i = 0; i < sd->dacl->num_aces; i ++) {
 233                         ads_disp_ace(ads, mem_ctx, &sd->dacl->aces[i]);
 234                 }
 235         }
 236
 237         printf("-------------- End Of Security Descriptor\n");
 238 }
 239
 240 #endif