4 Copyright (C) Simo Sorce 2006-2008
5 Copyright (C) Nadezhda Ivanova 2009
6 Copyright (C) Anatoliy Atanasov 2009
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 * Component: ldb ACL module
27 * Description: Module that performs authorisation access checks based on the
28 * account's security context and the DACL of the object being polled.
29 * Only DACL checks implemented at this point
31 * Authors: Nadezhda Ivanova, Anatoliy Atanasov
35 #include "ldb_module.h"
36 #include "auth/auth.h"
37 #include "libcli/security/security.h"
38 #include "dsdb/samdb/samdb.h"
39 #include "librpc/gen_ndr/ndr_security.h"
40 #include "param/param.h"
41 #include "dsdb/samdb/ldb_modules/util.h"
42 #include "lib/util/tsort.h"
44 struct extended_access_check_attribute
{
46 const uint32_t requires_rights
;
51 const char **password_attrs
;
55 struct ldb_module
*module
;
56 struct ldb_request
*req
;
58 bool allowedAttributes
;
59 bool allowedAttributesEffective
;
60 bool allowedChildClasses
;
61 bool allowedChildClassesEffective
;
62 bool sDRightsEffective
;
63 const char * const *attrs
;
64 struct dsdb_schema
*schema
;
67 bool is_root_base_dn(struct ldb_context
*ldb
, struct ldb_dn
*dn_to_check
)
70 struct ldb_dn
*root_base_dn
= ldb_get_root_basedn(ldb
);
71 result
= ldb_dn_compare(root_base_dn
,dn_to_check
);
75 static struct security_token
*acl_user_token(struct ldb_module
*module
)
77 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
78 struct auth_session_info
*session_info
79 = (struct auth_session_info
*)ldb_get_opaque(ldb
, "sessionInfo");
83 return session_info
->security_token
;
86 /* performs an access check from inside the module stack
87 * given the dn of the object to be checked, the required access
88 * guid is either the guid of the extended right, or NULL
91 int dsdb_module_check_access_on_dn(struct ldb_module
*module
,
95 const struct GUID
*guid
)
98 struct ldb_result
*acl_res
;
99 static const char *acl_attrs
[] = {
100 "nTSecurityDescriptor",
104 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
105 struct auth_session_info
*session_info
106 = (struct auth_session_info
*)ldb_get_opaque(ldb
, "sessionInfo");
108 return LDB_ERR_OPERATIONS_ERROR
;
110 ret
= dsdb_module_search_dn(module
, mem_ctx
, &acl_res
, dn
,
111 acl_attrs
, DSDB_SEARCH_SHOW_DELETED
);
112 if (ret
!= LDB_SUCCESS
) {
113 DEBUG(10,("access_check: failed to find object %s\n", ldb_dn_get_linearized(dn
)));
116 return dsdb_check_access_on_dn_internal(acl_res
,
118 session_info
->security_token
,
125 static int acl_module_init(struct ldb_module
*module
)
127 struct ldb_context
*ldb
;
128 struct acl_private
*data
;
130 TALLOC_CTX
*mem_ctx
= talloc_new(module
);
131 static const char *attrs
[] = { "passwordAttribute", NULL
};
132 struct ldb_result
*res
;
133 struct ldb_message
*msg
;
134 struct ldb_message_element
*password_attributes
;
136 ldb
= ldb_module_get_ctx(module
);
138 ret
= ldb_mod_register_control(module
, LDB_CONTROL_SD_FLAGS_OID
);
139 if (ret
!= LDB_SUCCESS
) {
140 ldb_debug(ldb
, LDB_DEBUG_ERROR
,
141 "acl_module_init: Unable to register control with rootdse!\n");
142 return LDB_ERR_OPERATIONS_ERROR
;
145 data
= talloc(module
, struct acl_private
);
148 return LDB_ERR_OPERATIONS_ERROR
;
151 data
->password_attrs
= NULL
;
152 data
->acl_perform
= lp_parm_bool(ldb_get_opaque(ldb
, "loadparm"),
153 NULL
, "acl", "perform", false);
154 ldb_module_set_private(module
, data
);
158 return LDB_ERR_OPERATIONS_ERROR
;
161 ret
= dsdb_module_search_dn(module
, mem_ctx
, &res
,
162 ldb_dn_new(mem_ctx
, ldb
, "@KLUDGEACL"),
164 if (ret
!= LDB_SUCCESS
) {
167 if (res
->count
== 0) {
171 if (res
->count
> 1) {
172 talloc_free(mem_ctx
);
173 return LDB_ERR_CONSTRAINT_VIOLATION
;
178 password_attributes
= ldb_msg_find_element(msg
, "passwordAttribute");
179 if (!password_attributes
) {
182 data
->password_attrs
= talloc_array(data
, const char *, password_attributes
->num_values
+ 1);
183 if (!data
->password_attrs
) {
184 talloc_free(mem_ctx
);
186 return LDB_ERR_OPERATIONS_ERROR
;
188 for (i
=0; i
< password_attributes
->num_values
; i
++) {
189 data
->password_attrs
[i
] = (const char *)password_attributes
->values
[i
].data
;
190 talloc_steal(data
->password_attrs
, password_attributes
->values
[i
].data
);
192 data
->password_attrs
[i
] = NULL
;
195 talloc_free(mem_ctx
);
196 return ldb_next_init(module
);
199 static const struct GUID
*get_oc_guid_from_message(struct ldb_module
*module
,
200 const struct dsdb_schema
*schema
,
201 struct ldb_message
*msg
)
203 struct ldb_message_element
*oc_el
;
205 oc_el
= ldb_msg_find_element(msg
, "objectClass");
210 return class_schemaid_guid_by_lDAPDisplayName(schema
,
211 (char *)oc_el
->values
[oc_el
->num_values
-1].data
);
214 static int acl_check_access_on_attribute(struct ldb_module
*module
,
216 struct security_descriptor
*sd
,
217 struct dom_sid
*rp_sid
,
219 const struct dsdb_attribute
*attr
)
223 uint32_t access_granted
;
224 struct object_tree
*root
= NULL
;
225 struct object_tree
*new_node
= NULL
;
226 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
227 struct security_token
*token
= acl_user_token(module
);
229 if (!GUID_all_zero(&attr
->attributeSecurityGUID
)) {
230 if (!insert_in_object_tree(tmp_ctx
,
231 &attr
->attributeSecurityGUID
, access
,
233 DEBUG(10, ("acl_search: cannot add to object tree securityGUID\n"));
237 if (!insert_in_object_tree(tmp_ctx
,
238 &attr
->schemaIDGUID
, access
, &new_node
, &new_node
)) {
239 DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
244 if (!insert_in_object_tree(tmp_ctx
,
245 &attr
->schemaIDGUID
, access
, &root
, &new_node
)) {
246 DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
251 status
= sec_access_check_ds(sd
, token
,
256 if (!NT_STATUS_IS_OK(status
)) {
257 ret
= LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
;
264 return LDB_ERR_OPERATIONS_ERROR
;
267 static int acl_check_access_on_class(struct ldb_module
*module
,
268 const struct dsdb_schema
*schema
,
270 struct security_descriptor
*sd
,
271 struct dom_sid
*rp_sid
,
273 const char *class_name
)
277 uint32_t access_granted
;
278 struct object_tree
*root
= NULL
;
279 struct object_tree
*new_node
= NULL
;
280 const struct GUID
*guid
;
281 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
282 struct security_token
*token
= acl_user_token(module
);
284 guid
= class_schemaid_guid_by_lDAPDisplayName(schema
, class_name
);
286 DEBUG(10, ("acl_search: cannot find class %s\n",
290 if (!insert_in_object_tree(tmp_ctx
,
293 DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
297 status
= sec_access_check_ds(sd
, token
,
302 if (!NT_STATUS_IS_OK(status
)) {
303 ret
= LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
;
310 return LDB_ERR_OPERATIONS_ERROR
;
313 static int acl_allowedAttributes(struct ldb_module
*module
,
314 const struct dsdb_schema
*schema
,
315 struct ldb_message
*sd_msg
,
316 struct ldb_message
*msg
,
317 struct acl_context
*ac
)
319 struct ldb_message_element
*oc_el
;
320 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
322 const char **attr_list
;
325 /* If we don't have a schema yet, we can't do anything... */
326 if (schema
== NULL
) {
327 ldb_asprintf_errstring(ldb
, "cannot add allowedAttributes to %s because no schema is loaded", ldb_dn_get_linearized(msg
->dn
));
328 return LDB_ERR_OPERATIONS_ERROR
;
331 /* Must remove any existing attribute */
332 if (ac
->allowedAttributes
) {
333 ldb_msg_remove_attr(msg
, "allowedAttributes");
336 mem_ctx
= talloc_new(msg
);
339 return LDB_ERR_OPERATIONS_ERROR
;
342 oc_el
= ldb_msg_find_element(sd_msg
, "objectClass");
343 attr_list
= dsdb_full_attribute_list(mem_ctx
, schema
, oc_el
, DSDB_SCHEMA_ALL
);
345 ldb_asprintf_errstring(ldb
, "acl: Failed to get list of attributes");
346 talloc_free(mem_ctx
);
347 return LDB_ERR_OPERATIONS_ERROR
;
349 if (ac
->allowedAttributes
) {
350 for (i
=0; attr_list
&& attr_list
[i
]; i
++) {
351 ldb_msg_add_string(msg
, "allowedAttributes", attr_list
[i
]);
354 if (ac
->allowedAttributesEffective
) {
355 struct security_descriptor
*sd
;
356 struct dom_sid
*sid
= NULL
;
357 struct ldb_control
*as_system
= ldb_request_get_control(ac
->req
,
358 LDB_CONTROL_AS_SYSTEM_OID
);
360 if (as_system
!= NULL
) {
361 as_system
->critical
= 0;
364 ldb_msg_remove_attr(msg
, "allowedAttributesEffective");
365 if (ac
->am_system
|| as_system
) {
366 for (i
=0; attr_list
&& attr_list
[i
]; i
++) {
367 ldb_msg_add_string(msg
, "allowedAttributesEffective", attr_list
[i
]);
372 ret
= dsdb_get_sd_from_ldb_message(mem_ctx
, sd_msg
, &sd
);
374 if (ret
!= LDB_SUCCESS
) {
377 ret
= dsdb_get_dom_sid_from_ldb_message(mem_ctx
, sd_msg
, &sid
);
379 if (ret
!= LDB_SUCCESS
) {
382 for (i
=0; attr_list
&& attr_list
[i
]; i
++) {
383 const struct dsdb_attribute
*attr
= dsdb_attribute_by_lDAPDisplayName(schema
,
386 return LDB_ERR_OPERATIONS_ERROR
;
388 /* remove constructed attributes */
389 if (attr
->systemFlags
& DS_FLAG_ATTR_IS_CONSTRUCTED
391 || (attr
->linkID
!= 0 && attr
->linkID
% 2 != 0 )) {
394 ret
= acl_check_access_on_attribute(module
,
400 if (ret
== LDB_SUCCESS
) {
401 ldb_msg_add_string(msg
, "allowedAttributesEffective", attr_list
[i
]);
408 static int acl_childClasses(struct ldb_module
*module
,
409 const struct dsdb_schema
*schema
,
410 struct ldb_message
*sd_msg
,
411 struct ldb_message
*msg
,
412 const char *attrName
)
414 struct ldb_message_element
*oc_el
;
415 struct ldb_message_element
*allowedClasses
;
416 const struct dsdb_class
*sclass
;
419 /* If we don't have a schema yet, we can't do anything... */
420 if (schema
== NULL
) {
421 ldb_asprintf_errstring(ldb_module_get_ctx(module
), "cannot add childClassesEffective to %s because no schema is loaded", ldb_dn_get_linearized(msg
->dn
));
422 return LDB_ERR_OPERATIONS_ERROR
;
425 /* Must remove any existing attribute, or else confusion reins */
426 ldb_msg_remove_attr(msg
, attrName
);
427 ret
= ldb_msg_add_empty(msg
, attrName
, 0, &allowedClasses
);
428 if (ret
!= LDB_SUCCESS
) {
432 oc_el
= ldb_msg_find_element(sd_msg
, "objectClass");
434 for (i
=0; oc_el
&& i
< oc_el
->num_values
; i
++) {
435 sclass
= dsdb_class_by_lDAPDisplayName_ldb_val(schema
, &oc_el
->values
[i
]);
437 /* We don't know this class? what is going on? */
441 for (j
=0; sclass
->possibleInferiors
&& sclass
->possibleInferiors
[j
]; j
++) {
442 ldb_msg_add_string(msg
, attrName
, sclass
->possibleInferiors
[j
]);
445 if (allowedClasses
->num_values
> 1) {
446 TYPESAFE_QSORT(allowedClasses
->values
, allowedClasses
->num_values
, data_blob_cmp
);
447 for (i
=1 ; i
< allowedClasses
->num_values
; i
++) {
448 struct ldb_val
*val1
= &allowedClasses
->values
[i
-1];
449 struct ldb_val
*val2
= &allowedClasses
->values
[i
];
450 if (data_blob_cmp(val1
, val2
) == 0) {
451 memmove(val1
, val2
, (allowedClasses
->num_values
- i
) * sizeof(struct ldb_val
));
452 allowedClasses
->num_values
--;
461 static int acl_childClassesEffective(struct ldb_module
*module
,
462 const struct dsdb_schema
*schema
,
463 struct ldb_message
*sd_msg
,
464 struct ldb_message
*msg
,
465 struct acl_context
*ac
)
467 struct ldb_message_element
*oc_el
;
468 struct ldb_message_element
*allowedClasses
= NULL
;
469 const struct dsdb_class
*sclass
;
470 struct security_descriptor
*sd
;
471 struct ldb_control
*as_system
= ldb_request_get_control(ac
->req
,
472 LDB_CONTROL_AS_SYSTEM_OID
);
473 struct dom_sid
*sid
= NULL
;
476 if (as_system
!= NULL
) {
477 as_system
->critical
= 0;
480 if (ac
->am_system
|| as_system
) {
481 return acl_childClasses(module
, schema
, sd_msg
, msg
, "allowedChildClassesEffective");
484 /* If we don't have a schema yet, we can't do anything... */
485 if (schema
== NULL
) {
486 ldb_asprintf_errstring(ldb_module_get_ctx(module
), "cannot add allowedChildClassesEffective to %s because no schema is loaded", ldb_dn_get_linearized(msg
->dn
));
487 return LDB_ERR_OPERATIONS_ERROR
;
490 /* Must remove any existing attribute, or else confusion reins */
491 ldb_msg_remove_attr(msg
, "allowedChildClassesEffective");
493 oc_el
= ldb_msg_find_element(sd_msg
, "objectClass");
494 ret
= dsdb_get_sd_from_ldb_message(msg
, sd_msg
, &sd
);
495 if (ret
!= LDB_SUCCESS
) {
498 ret
= dsdb_get_dom_sid_from_ldb_message(msg
, sd_msg
, &sid
);
500 if (ret
!= LDB_SUCCESS
) {
503 for (i
=0; oc_el
&& i
< oc_el
->num_values
; i
++) {
504 sclass
= dsdb_class_by_lDAPDisplayName_ldb_val(schema
, &oc_el
->values
[i
]);
506 /* We don't know this class? what is going on? */
510 for (j
=0; sclass
->possibleInferiors
&& sclass
->possibleInferiors
[j
]; j
++) {
511 ret
= acl_check_access_on_class(module
,
516 SEC_ADS_CREATE_CHILD
,
517 sclass
->possibleInferiors
[j
]);
518 if (ret
== LDB_SUCCESS
) {
519 ldb_msg_add_string(msg
, "allowedChildClassesEffective",
520 sclass
->possibleInferiors
[j
]);
524 allowedClasses
= ldb_msg_find_element(msg
, "allowedChildClassesEffective");
525 if (!allowedClasses
) {
529 if (allowedClasses
->num_values
> 1) {
530 TYPESAFE_QSORT(allowedClasses
->values
, allowedClasses
->num_values
, data_blob_cmp
);
531 for (i
=1 ; i
< allowedClasses
->num_values
; i
++) {
532 struct ldb_val
*val1
= &allowedClasses
->values
[i
-1];
533 struct ldb_val
*val2
= &allowedClasses
->values
[i
];
534 if (data_blob_cmp(val1
, val2
) == 0) {
535 memmove(val1
, val2
, (allowedClasses
->num_values
- i
) * sizeof( struct ldb_val
));
536 allowedClasses
->num_values
--;
544 static int acl_sDRightsEffective(struct ldb_module
*module
,
545 struct ldb_message
*sd_msg
,
546 struct ldb_message
*msg
,
547 struct acl_context
*ac
)
549 struct ldb_message_element
*rightsEffective
;
551 struct security_descriptor
*sd
;
552 struct ldb_control
*as_system
= ldb_request_get_control(ac
->req
,
553 LDB_CONTROL_AS_SYSTEM_OID
);
554 struct dom_sid
*sid
= NULL
;
557 if (as_system
!= NULL
) {
558 as_system
->critical
= 0;
561 /* Must remove any existing attribute, or else confusion reins */
562 ldb_msg_remove_attr(msg
, "sDRightsEffective");
563 ret
= ldb_msg_add_empty(msg
, "sDRightsEffective", 0, &rightsEffective
);
564 if (ret
!= LDB_SUCCESS
) {
567 if (ac
->am_system
|| as_system
) {
568 flags
= SECINFO_OWNER
| SECINFO_GROUP
| SECINFO_SACL
| SECINFO_DACL
;
571 /* Get the security descriptor from the message */
572 ret
= dsdb_get_sd_from_ldb_message(msg
, sd_msg
, &sd
);
573 if (ret
!= LDB_SUCCESS
) {
576 ret
= dsdb_get_dom_sid_from_ldb_message(msg
, sd_msg
, &sid
);
578 if (ret
!= LDB_SUCCESS
) {
581 ret
= acl_check_access_on_attribute(module
,
587 if (ret
== LDB_SUCCESS
) {
588 flags
|= SECINFO_OWNER
| SECINFO_GROUP
;
590 ret
= acl_check_access_on_attribute(module
,
596 if (ret
== LDB_SUCCESS
) {
597 flags
|= SECINFO_DACL
;
599 ret
= acl_check_access_on_attribute(module
,
603 SEC_FLAG_SYSTEM_SECURITY
,
605 if (ret
== LDB_SUCCESS
) {
606 flags
|= SECINFO_SACL
;
609 ldb_msg_add_fmt(msg
, "sDRightsEffective", "%u", flags
);
613 static int acl_add(struct ldb_module
*module
, struct ldb_request
*req
)
616 struct ldb_dn
*parent
= ldb_dn_get_parent(req
, req
->op
.add
.message
->dn
);
617 struct ldb_context
*ldb
;
618 const struct dsdb_schema
*schema
;
619 struct ldb_message_element
*oc_el
;
620 const struct GUID
*guid
;
621 struct ldb_control
*as_system
= ldb_request_get_control(req
, LDB_CONTROL_AS_SYSTEM_OID
);
623 if (as_system
!= NULL
) {
624 as_system
->critical
= 0;
627 if (dsdb_module_am_system(module
) || as_system
) {
628 return ldb_next_request(module
, req
);
631 if (ldb_dn_is_special(req
->op
.add
.message
->dn
)) {
632 return ldb_next_request(module
, req
);
634 ldb
= ldb_module_get_ctx(module
);
635 /* Creating an NC. There is probably something we should do here,
636 * but we will establish that later */
637 if ((ldb_dn_compare(req
->op
.add
.message
->dn
, (ldb_get_schema_basedn(ldb
))) == 0) ||
638 (ldb_dn_compare(req
->op
.add
.message
->dn
, (ldb_get_config_basedn(ldb
))) == 0) ||
639 (ldb_dn_compare(req
->op
.add
.message
->dn
, (ldb_get_root_basedn(ldb
))) == 0)) {
640 return ldb_next_request(module
, req
);
643 schema
= dsdb_get_schema(ldb
, req
);
645 return LDB_ERR_OPERATIONS_ERROR
;
648 oc_el
= ldb_msg_find_element(req
->op
.add
.message
, "objectClass");
649 if (!oc_el
|| oc_el
->num_values
== 0) {
650 DEBUG(10,("acl:operation error %s\n", ldb_dn_get_linearized(req
->op
.add
.message
->dn
)));
651 return ldb_module_done(req
, NULL
, NULL
, LDB_ERR_OPERATIONS_ERROR
);
654 guid
= class_schemaid_guid_by_lDAPDisplayName(schema
,
655 (char *)oc_el
->values
[oc_el
->num_values
-1].data
);
656 ret
= dsdb_module_check_access_on_dn(module
, req
, parent
, SEC_ADS_CREATE_CHILD
, guid
);
657 if (ret
!= LDB_SUCCESS
) {
660 return ldb_next_request(module
, req
);
663 static int acl_modify(struct ldb_module
*module
, struct ldb_request
*req
)
666 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
667 const struct dsdb_schema
*schema
;
669 bool modify_sd
= false;
670 const struct GUID
*guid
;
671 uint32_t access_granted
;
672 struct object_tree
*root
= NULL
;
673 struct object_tree
*new_node
= NULL
;
675 struct ldb_result
*acl_res
;
676 struct security_descriptor
*sd
;
677 struct dom_sid
*sid
= NULL
;
678 struct ldb_control
*as_system
= ldb_request_get_control(req
, LDB_CONTROL_AS_SYSTEM_OID
);
679 TALLOC_CTX
*tmp_ctx
= talloc_new(req
);
680 static const char *acl_attrs
[] = {
681 "nTSecurityDescriptor",
687 if (as_system
!= NULL
) {
688 as_system
->critical
= 0;
691 /* Don't print this debug statement if elements[0].name is going to be NULL */
692 if(req
->op
.mod
.message
->num_elements
> 0)
694 DEBUG(10, ("ldb:acl_modify: %s\n", req
->op
.mod
.message
->elements
[0].name
));
696 if (dsdb_module_am_system(module
) || as_system
) {
697 return ldb_next_request(module
, req
);
699 if (ldb_dn_is_special(req
->op
.mod
.message
->dn
)) {
700 return ldb_next_request(module
, req
);
702 ret
= dsdb_module_search_dn(module
, req
, &acl_res
, req
->op
.mod
.message
->dn
,
705 if (ret
!= LDB_SUCCESS
) {
709 schema
= dsdb_get_schema(ldb
, acl_res
);
711 talloc_free(acl_res
);
712 return LDB_ERR_OPERATIONS_ERROR
;
715 ret
= dsdb_get_sd_from_ldb_message(req
, acl_res
->msgs
[0], &sd
);
716 if (ret
!= LDB_SUCCESS
) {
717 DEBUG(10, ("acl_modify: cannot get descriptor\n"));
720 /* Theoretically we pass the check if the object has no sd */
725 guid
= get_oc_guid_from_message(module
, schema
, acl_res
->msgs
[0]);
727 DEBUG(10, ("acl_modify: cannot get guid\n"));
731 ret
= dsdb_get_dom_sid_from_ldb_message(req
, acl_res
->msgs
[0], &sid
);
732 if (ret
!= LDB_SUCCESS
) {
733 return LDB_ERR_OPERATIONS_ERROR
;
736 if (!insert_in_object_tree(tmp_ctx
, guid
, SEC_ADS_WRITE_PROP
,
738 DEBUG(10, ("acl_modify: cannot add to object tree\n"));
741 for (i
=0; i
< req
->op
.mod
.message
->num_elements
; i
++){
742 const struct dsdb_attribute
*attr
;
743 /* clearTextPassword is not in schema */
744 if (strcmp("clearTextPassword", req
->op
.mod
.message
->elements
[i
].name
) == 0) {
745 attr
= dsdb_attribute_by_lDAPDisplayName(schema
, "unicodePwd");
747 attr
= dsdb_attribute_by_lDAPDisplayName(schema
,
748 req
->op
.mod
.message
->elements
[i
].name
);
750 if (strcmp("nTSecurityDescriptor", req
->op
.mod
.message
->elements
[i
].name
) == 0) {
755 DEBUG(10, ("acl_modify: cannot find attribute %s\n",
756 req
->op
.mod
.message
->elements
[i
].name
));
759 if (!insert_in_object_tree(tmp_ctx
,
760 &attr
->attributeSecurityGUID
, SEC_ADS_WRITE_PROP
,
761 &new_node
, &new_node
)) {
762 DEBUG(10, ("acl_modify: cannot add to object tree securityGUID\n"));
766 if (!insert_in_object_tree(tmp_ctx
,
767 &attr
->schemaIDGUID
, SEC_ADS_WRITE_PROP
, &new_node
, &new_node
)) {
768 DEBUG(10, ("acl_modify: cannot add to object tree attributeGUID\n"));
774 if (root
->num_of_children
> 0) {
775 status
= sec_access_check_ds(sd
, acl_user_token(module
),
781 if (!NT_STATUS_IS_OK(status
)) {
782 DEBUG(10, ("Object %s nas no write property access\n",
783 ldb_dn_get_linearized(req
->op
.mod
.message
->dn
)));
785 acl_user_token(module
),
786 req
->op
.mod
.message
->dn
,
789 talloc_free(tmp_ctx
);
790 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
;
794 status
= sec_access_check_ds(sd
, acl_user_token(module
),
800 if (!NT_STATUS_IS_OK(status
)) {
801 DEBUG(10, ("Object %s nas no write dacl access\n",
802 ldb_dn_get_linearized(req
->op
.mod
.message
->dn
)));
804 acl_user_token(module
),
805 req
->op
.mod
.message
->dn
,
808 talloc_free(tmp_ctx
);
809 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
;
813 talloc_free(tmp_ctx
);
814 return ldb_next_request(module
, req
);
816 talloc_free(tmp_ctx
);
817 return LDB_ERR_OPERATIONS_ERROR
;
820 /* similar to the modify for the time being.
821 * We need to concider the special delete tree case, though - TODO */
822 static int acl_delete(struct ldb_module
*module
, struct ldb_request
*req
)
825 struct ldb_dn
*parent
= ldb_dn_get_parent(req
, req
->op
.del
.dn
);
826 struct ldb_context
*ldb
;
827 struct ldb_control
*as_system
= ldb_request_get_control(req
, LDB_CONTROL_AS_SYSTEM_OID
);
829 if (as_system
!= NULL
) {
830 as_system
->critical
= 0;
833 DEBUG(10, ("ldb:acl_delete: %s\n", ldb_dn_get_linearized(req
->op
.del
.dn
)));
834 if (dsdb_module_am_system(module
) || as_system
) {
835 return ldb_next_request(module
, req
);
838 if (ldb_dn_is_special(req
->op
.del
.dn
)) {
839 return ldb_next_request(module
, req
);
841 ldb
= ldb_module_get_ctx(module
);
842 /* first check if we have delete object right */
843 ret
= dsdb_module_check_access_on_dn(module
, req
, req
->op
.del
.dn
, SEC_STD_DELETE
, NULL
);
844 if (ret
== LDB_SUCCESS
) {
845 return ldb_next_request(module
, req
);
848 /* Nope, we don't have delete object. Lets check if we have delete child on the parent */
849 /* No parent, so check fails */
850 if ((ldb_dn_compare(req
->op
.del
.dn
, (ldb_get_schema_basedn(ldb
))) == 0) ||
851 (ldb_dn_compare(req
->op
.del
.dn
, (ldb_get_config_basedn(ldb
))) == 0) ||
852 (ldb_dn_compare(req
->op
.del
.dn
, (ldb_get_root_basedn(ldb
))) == 0)) {
853 DEBUG(10,("acl:deleting an NC\n"));
854 return ldb_module_done(req
, NULL
, NULL
, LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
);
857 ret
= dsdb_module_check_access_on_dn(module
, req
, parent
, SEC_ADS_DELETE_CHILD
, NULL
);
858 if (ret
!= LDB_SUCCESS
) {
861 return ldb_next_request(module
, req
);
864 static int acl_rename(struct ldb_module
*module
, struct ldb_request
*req
)
867 struct ldb_dn
*oldparent
= ldb_dn_get_parent(req
, req
->op
.rename
.olddn
);
868 struct ldb_dn
*newparent
= ldb_dn_get_parent(req
, req
->op
.rename
.newdn
);
869 const struct dsdb_schema
*schema
;
870 struct ldb_context
*ldb
;
871 struct security_descriptor
*sd
= NULL
;
872 struct dom_sid
*sid
= NULL
;
873 struct ldb_result
*acl_res
;
874 const struct GUID
*guid
;
875 struct object_tree
*root
= NULL
;
876 struct object_tree
*new_node
= NULL
;
877 struct ldb_control
*as_system
= ldb_request_get_control(req
, LDB_CONTROL_AS_SYSTEM_OID
);
878 TALLOC_CTX
*tmp_ctx
= talloc_new(req
);
880 uint32_t access_granted
;
881 const char *rdn_name
;
882 static const char *acl_attrs
[] = {
883 "nTSecurityDescriptor",
889 if (as_system
!= NULL
) {
890 as_system
->critical
= 0;
893 DEBUG(10, ("ldb:acl_rename: %s\n", ldb_dn_get_linearized(req
->op
.rename
.olddn
)));
894 if (dsdb_module_am_system(module
) || as_system
) {
895 return ldb_next_request(module
, req
);
897 if (ldb_dn_is_special(req
->op
.rename
.olddn
)) {
898 return ldb_next_request(module
, req
);
900 ldb
= ldb_module_get_ctx(module
);
902 ret
= dsdb_module_search_dn(module
, req
, &acl_res
, req
->op
.rename
.olddn
,
903 acl_attrs
, DSDB_SEARCH_SHOW_DELETED
);
904 /* we sould be able to find the parent */
905 if (ret
!= LDB_SUCCESS
) {
906 DEBUG(10,("acl: failed to find object %s\n",
907 ldb_dn_get_linearized(req
->op
.rename
.olddn
)));
911 schema
= dsdb_get_schema(ldb
, acl_res
);
913 talloc_free(acl_res
);
914 return LDB_ERR_OPERATIONS_ERROR
;
917 guid
= get_oc_guid_from_message(module
, schema
, acl_res
->msgs
[0]);
918 if (!insert_in_object_tree(tmp_ctx
, guid
, SEC_ADS_WRITE_PROP
,
920 return LDB_ERR_OPERATIONS_ERROR
;
923 guid
= attribute_schemaid_guid_by_lDAPDisplayName(schema
,
925 if (!insert_in_object_tree(tmp_ctx
, guid
, SEC_ADS_WRITE_PROP
,
926 &new_node
, &new_node
)) {
927 return LDB_ERR_OPERATIONS_ERROR
;
930 rdn_name
= ldb_dn_get_rdn_name(req
->op
.rename
.olddn
);
931 if (rdn_name
== NULL
) {
932 return LDB_ERR_OPERATIONS_ERROR
;
934 guid
= attribute_schemaid_guid_by_lDAPDisplayName(schema
,
936 if (!insert_in_object_tree(tmp_ctx
, guid
, SEC_ADS_WRITE_PROP
,
937 &new_node
, &new_node
)) {
938 return LDB_ERR_OPERATIONS_ERROR
;
941 ret
= dsdb_get_sd_from_ldb_message(req
, acl_res
->msgs
[0], &sd
);
943 if (ret
!= LDB_SUCCESS
) {
944 return LDB_ERR_OPERATIONS_ERROR
;
946 /* Theoretically we pass the check if the object has no sd */
950 ret
= dsdb_get_dom_sid_from_ldb_message(req
, acl_res
->msgs
[0], &sid
);
951 if (ret
!= LDB_SUCCESS
) {
952 return LDB_ERR_OPERATIONS_ERROR
;
955 status
= sec_access_check_ds(sd
, acl_user_token(module
),
961 if (!NT_STATUS_IS_OK(status
)) {
962 DEBUG(10, ("Object %s nas no wp on name\n",
963 ldb_dn_get_linearized(req
->op
.rename
.olddn
)));
965 acl_user_token(module
),
966 req
->op
.rename
.olddn
,
969 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
;
972 if (ldb_dn_compare(oldparent
, newparent
) == 0) {
973 /* regular rename, not move, nothing more to do */
974 return ldb_next_request(module
, req
);
977 /* What exactly to do in this case? It would fail anyway.. */
978 if ((ldb_dn_compare(req
->op
.rename
.newdn
, (ldb_get_schema_basedn(ldb
))) == 0) ||
979 (ldb_dn_compare(req
->op
.rename
.newdn
, (ldb_get_config_basedn(ldb
))) == 0) ||
980 (ldb_dn_compare(req
->op
.rename
.newdn
, (ldb_get_root_basedn(ldb
))) == 0)) {
981 DEBUG(10,("acl:moving as an NC\n"));
982 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
;
984 /* new parent should have create child */
985 talloc_free(tmp_ctx
);
986 tmp_ctx
= talloc_new(req
);
989 guid
= get_oc_guid_from_message(module
, schema
, acl_res
->msgs
[0]);
991 DEBUG(10,("acl:renamed object has no object class\n"));
992 return ldb_module_done(req
, NULL
, NULL
, LDB_ERR_OPERATIONS_ERROR
);
995 ret
= dsdb_module_check_access_on_dn(module
, req
, newparent
, SEC_ADS_CREATE_CHILD
, guid
);
996 if (ret
!= LDB_SUCCESS
) {
997 DEBUG(10,("acl:access_denied renaming %s", ldb_dn_get_linearized(req
->op
.rename
.olddn
)));
1000 /* do we have delete object on the object? */
1002 status
= sec_access_check_ds(sd
, acl_user_token(module
),
1008 if (NT_STATUS_IS_OK(status
)) {
1009 return ldb_next_request(module
, req
);
1011 /* what about delete child on the current parent */
1012 ret
= dsdb_module_check_access_on_dn(module
, req
, oldparent
, SEC_ADS_DELETE_CHILD
, NULL
);
1013 if (ret
!= LDB_SUCCESS
) {
1014 DEBUG(10,("acl:access_denied renaming %s", ldb_dn_get_linearized(req
->op
.rename
.olddn
)));
1015 return ldb_module_done(req
, NULL
, NULL
, ret
);
1017 return ldb_next_request(module
, req
);
1020 static int acl_search_callback(struct ldb_request
*req
, struct ldb_reply
*ares
)
1022 struct ldb_context
*ldb
;
1023 struct acl_context
*ac
;
1024 struct acl_private
*data
;
1025 struct ldb_result
*acl_res
;
1026 static const char *acl_attrs
[] = {
1028 "nTSecurityDescriptor",
1034 ac
= talloc_get_type(req
->context
, struct acl_context
);
1035 data
= talloc_get_type(ldb_module_get_private(ac
->module
), struct acl_private
);
1036 ldb
= ldb_module_get_ctx(ac
->module
);
1039 return ldb_module_done(ac
->req
, NULL
, NULL
,
1040 LDB_ERR_OPERATIONS_ERROR
);
1042 if (ares
->error
!= LDB_SUCCESS
) {
1043 return ldb_module_done(ac
->req
, ares
->controls
,
1044 ares
->response
, ares
->error
);
1047 switch (ares
->type
) {
1048 case LDB_REPLY_ENTRY
:
1049 if (ac
->allowedAttributes
1050 || ac
->allowedChildClasses
1051 || ac
->allowedChildClassesEffective
1052 || ac
->allowedAttributesEffective
1053 || ac
->sDRightsEffective
) {
1054 ret
= dsdb_module_search_dn(ac
->module
, ac
, &acl_res
, ares
->message
->dn
,
1056 if (ret
!= LDB_SUCCESS
) {
1057 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
1059 if (ac
->allowedAttributes
|| ac
->allowedAttributesEffective
) {
1060 ret
= acl_allowedAttributes(ac
->module
, ac
->schema
, acl_res
->msgs
[0], ares
->message
, ac
);
1061 if (ret
!= LDB_SUCCESS
) {
1062 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
1065 if (ac
->allowedChildClasses
) {
1066 ret
= acl_childClasses(ac
->module
, ac
->schema
, acl_res
->msgs
[0],
1067 ares
->message
, "allowedChildClasses");
1068 if (ret
!= LDB_SUCCESS
) {
1069 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
1072 if (ac
->allowedChildClassesEffective
) {
1073 ret
= acl_childClassesEffective(ac
->module
, ac
->schema
,
1074 acl_res
->msgs
[0], ares
->message
, ac
);
1075 if (ret
!= LDB_SUCCESS
) {
1076 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
1079 if (ac
->sDRightsEffective
) {
1080 ret
= acl_sDRightsEffective(ac
->module
,
1081 acl_res
->msgs
[0], ares
->message
, ac
);
1082 if (ret
!= LDB_SUCCESS
) {
1083 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
1087 if (data
&& data
->password_attrs
) {
1088 if (!ac
->am_system
) {
1089 for (i
= 0; data
->password_attrs
[i
]; i
++) {
1090 ldb_msg_remove_attr(ares
->message
, data
->password_attrs
[i
]);
1094 return ldb_module_send_entry(ac
->req
, ares
->message
, ares
->controls
);
1096 case LDB_REPLY_REFERRAL
:
1097 return ldb_module_send_referral(ac
->req
, ares
->referral
);
1099 case LDB_REPLY_DONE
:
1100 return ldb_module_done(ac
->req
, ares
->controls
,
1101 ares
->response
, LDB_SUCCESS
);
1107 static int acl_search(struct ldb_module
*module
, struct ldb_request
*req
)
1109 struct ldb_context
*ldb
;
1110 struct acl_context
*ac
;
1111 struct ldb_request
*down_req
;
1112 struct acl_private
*data
;
1115 ldb
= ldb_module_get_ctx(module
);
1117 ac
= talloc_zero(req
, struct acl_context
);
1120 return LDB_ERR_OPERATIONS_ERROR
;
1122 data
= talloc_get_type(ldb_module_get_private(module
), struct acl_private
);
1124 ac
->module
= module
;
1126 ac
->am_system
= dsdb_module_am_system(module
);
1127 ac
->allowedAttributes
= ldb_attr_in_list(req
->op
.search
.attrs
, "allowedAttributes");
1128 ac
->allowedAttributesEffective
= ldb_attr_in_list(req
->op
.search
.attrs
, "allowedAttributesEffective");
1129 ac
->allowedChildClasses
= ldb_attr_in_list(req
->op
.search
.attrs
, "allowedChildClasses");
1130 ac
->allowedChildClassesEffective
= ldb_attr_in_list(req
->op
.search
.attrs
, "allowedChildClassesEffective");
1131 ac
->sDRightsEffective
= ldb_attr_in_list(req
->op
.search
.attrs
, "sDRightsEffective");
1132 ac
->schema
= dsdb_get_schema(ldb
, ac
);
1134 /* replace any attributes in the parse tree that are private,
1135 so we don't allow a search for 'userPassword=penguin',
1136 just as we would not allow that attribute to be returned */
1137 if (ac
->am_system
) {
1138 /* FIXME: We should copy the tree and keep the original unmodified. */
1139 /* remove password attributes */
1140 if (data
&& data
->password_attrs
) {
1141 for (i
= 0; data
->password_attrs
[i
]; i
++) {
1142 ldb_parse_tree_attr_replace(req
->op
.search
.tree
,
1143 data
->password_attrs
[i
],
1144 "kludgeACLredactedattribute");
1148 ret
= ldb_build_search_req_ex(&down_req
,
1150 req
->op
.search
.base
,
1151 req
->op
.search
.scope
,
1152 req
->op
.search
.tree
,
1153 req
->op
.search
.attrs
,
1155 ac
, acl_search_callback
,
1157 if (ret
!= LDB_SUCCESS
) {
1160 /* perform the search */
1161 return ldb_next_request(module
, down_req
);
1164 _PUBLIC_
const struct ldb_module_ops ldb_acl_module_ops
= {
1166 .search
= acl_search
,
1168 .modify
= acl_modify
,
1170 .rename
= acl_rename
,
1171 .init_context
= acl_module_init