libgpo/gpo_util.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2005-2008
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "system/filesys.h"
  22 #include "librpc/gen_ndr/ndr_misc.h"
  23 #include "../librpc/gen_ndr/ndr_security.h"
  24 #include "../libgpo/gpo.h"
  25 #include "../libcli/security/security.h"
  26 #include "registry.h"
  27 #include "libgpo/gpo_proto.h"
  28 #include "libgpo/gpext/gpext.h"
  29
  30 #if 0
  31 #define DEFAULT_DOMAIN_POLICY "Default Domain Policy"
  32 #define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy"
  33 #endif
  34
  35 /* should we store a parsed guid ? */
  36 struct gp_table {
  37         const char *name;
  38         const char *guid_string;
  39 };
  40
  41 #if 0 /* unused */
  42 static struct gp_table gpo_default_policy[] = {
  43         { DEFAULT_DOMAIN_POLICY,
  44                 "31B2F340-016D-11D2-945F-00C04FB984F9" },
  45         { DEFAULT_DOMAIN_CONTROLLERS_POLICY,
  46                 "6AC1786C-016F-11D2-945F-00C04fB984F9" },
  47         { NULL, NULL }
  48 };
  49 #endif
  50
  51 /* the following is seen in gPCMachineExtensionNames / gPCUserExtensionNames */
  52
  53 static struct gp_table gpo_cse_extensions[] = {
  54         /* used to be "Administrative Templates Extension" */
  55         /* "Registry Settings"
  56         (http://support.microsoft.com/kb/216357/EN-US/) */
  57         { "Registry Settings",
  58                 GP_EXT_GUID_REGISTRY },
  59         { "Microsoft Disc Quota",
  60                 "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" },
  61         { "EFS recovery",
  62                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
  63         { "Folder Redirection",
  64                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
  65         { "IP Security",
  66                 "E437BC1C-AA7D-11D2-A382-00C04F991E27" },
  67         { "Internet Explorer Branding",
  68                 "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" },
  69         { "QoS Packet Scheduler",
  70                 "426031c0-0b47-4852-b0ca-ac3d37bfcb39" },
  71         { "Scripts",
  72                 GP_EXT_GUID_SCRIPTS },
  73         { "Security",
  74                 GP_EXT_GUID_SECURITY },
  75         { "Software Installation",
  76                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
  77         { "Wireless Group Policy",
  78                 "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" },
  79         { "Application Management",
  80                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
  81         { "unknown",
  82                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
  83         { NULL, NULL }
  84 };
  85
  86 /* guess work */
  87 static struct gp_table gpo_cse_snapin_extensions[] = {
  88         { "Administrative Templates",
  89                 "0F6B957D-509E-11D1-A7CC-0000F87571E3" },
  90         { "Certificates",
  91                 "53D6AB1D-2488-11D1-A28C-00C04FB94F17" },
  92         { "EFS recovery policy processing",
  93                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
  94         { "Folder Redirection policy processing",
  95                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
  96         { "Folder Redirection",
  97                 "88E729D6-BDC1-11D1-BD2A-00C04FB9603F" },
  98         { "Registry policy processing",
  99                 "35378EAC-683F-11D2-A89A-00C04FBBCFA2" },
 100         { "Remote Installation Services",
 101                 "3060E8CE-7020-11D2-842D-00C04FA372D4" },
 102         { "Security Settings",
 103                 "803E14A0-B4FB-11D0-A0D0-00A0C90F574B" },
 104         { "Security policy processing",
 105                 "827D319E-6EAC-11D2-A4EA-00C04F79F83A" },
 106         { "unknown",
 107                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
 108         { "unknown2",
 109                 "53D6AB1B-2488-11D1-A28C-00C04FB94F17" },
 110         { NULL, NULL }
 111 };
 112
 113 /****************************************************************
 114 ****************************************************************/
 115
 116 static const char *name_to_guid_string(const char *name,
 117                                        struct gp_table *table)
 118 {
 119         int i;
 120
 121         for (i = 0; table[i].name; i++) {
 122                 if (strequal(name, table[i].name)) {
 123                         return table[i].guid_string;
 124                 }
 125         }
 126
 127         return NULL;
 128 }
 129
 130 /****************************************************************
 131 ****************************************************************/
 132
 133 static const char *guid_string_to_name(const char *guid_string,
 134                                        struct gp_table *table)
 135 {
 136         int i;
 137
 138         for (i = 0; table[i].guid_string; i++) {
 139                 if (strequal(guid_string, table[i].guid_string)) {
 140                         return table[i].name;
 141                 }
 142         }
 143
 144         return NULL;
 145 }
 146
 147 /****************************************************************
 148 ****************************************************************/
 149
 150 static const char *snapin_guid_string_to_name(const char *guid_string,
 151                                               struct gp_table *table)
 152 {
 153         int i;
 154         for (i = 0; table[i].guid_string; i++) {
 155                 if (strequal(guid_string, table[i].guid_string)) {
 156                         return table[i].name;
 157                 }
 158         }
 159         return NULL;
 160 }
 161
 162 #if 0 /* unused */
 163 static const char *default_gpo_name_to_guid_string(const char *name)
 164 {
 165         return name_to_guid_string(name, gpo_default_policy);
 166 }
 167
 168 static const char *default_gpo_guid_string_to_name(const char *guid)
 169 {
 170         return guid_string_to_name(guid, gpo_default_policy);
 171 }
 172 #endif
 173
 174 /****************************************************************
 175 ****************************************************************/
 176
 177 const char *cse_gpo_guid_string_to_name(const char *guid)
 178 {
 179         return guid_string_to_name(guid, gpo_cse_extensions);
 180 }
 181
 182 /****************************************************************
 183 ****************************************************************/
 184
 185 const char *cse_gpo_name_to_guid_string(const char *name)
 186 {
 187         return name_to_guid_string(name, gpo_cse_extensions);
 188 }
 189
 190 /****************************************************************
 191 ****************************************************************/
 192
 193 const char *cse_snapin_gpo_guid_string_to_name(const char *guid)
 194 {
 195         return snapin_guid_string_to_name(guid, gpo_cse_snapin_extensions);
 196 }
 197
 198 /****************************************************************
 199 ****************************************************************/
 200
 201 void dump_gp_ext(struct GP_EXT *gp_ext, int debuglevel)
 202 {
 203         int lvl = debuglevel;
 204         int i;
 205
 206         if (gp_ext == NULL) {
 207                 return;
 208         }
 209
 210         DEBUG(lvl,("\t---------------------\n\n"));
 211         DEBUGADD(lvl,("\tname:\t\t\t%s\n", gp_ext->gp_extension));
 212
 213         for (i=0; i< gp_ext->num_exts; i++) {
 214
 215                 DEBUGADD(lvl,("\textension:\t\t\t%s\n",
 216                         gp_ext->extensions_guid[i]));
 217                 DEBUGADD(lvl,("\textension (name):\t\t\t%s\n",
 218                         gp_ext->extensions[i]));
 219
 220                 DEBUGADD(lvl,("\tsnapin:\t\t\t%s\n",
 221                         gp_ext->snapins_guid[i]));
 222                 DEBUGADD(lvl,("\tsnapin (name):\t\t\t%s\n",
 223                         gp_ext->snapins[i]));
 224         }
 225 }
 226
 227 #ifdef HAVE_LDAP
 228
 229 /****************************************************************
 230 ****************************************************************/
 231
 232 void dump_gpo(const struct GROUP_POLICY_OBJECT *gpo,
 233               int debuglevel)
 234 {
 235         int lvl = debuglevel;
 236         TALLOC_CTX *frame = talloc_stackframe();
 237
 238         if (gpo == NULL) {
 239                 goto out;
 240         }
 241
 242         DEBUG(lvl,("---------------------\n\n"));
 243
 244         DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name));
 245         DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name));
 246         DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version));
 247         DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n",
 248                 GPO_VERSION_USER(gpo->version),
 249                 GPO_VERSION_USER(gpo->version)));
 250         DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n",
 251                 GPO_VERSION_MACHINE(gpo->version),
 252                  GPO_VERSION_MACHINE(gpo->version)));
 253         DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path));
 254         DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path));
 255
 256         DEBUGADD(lvl,("options:\t\t%d ", gpo->options));
 257         switch (gpo->options) {
 258                 case GPFLAGS_ALL_ENABLED:
 259                         DEBUGADD(lvl,("GPFLAGS_ALL_ENABLED\n"));
 260                         break;
 261                 case GPFLAGS_USER_SETTINGS_DISABLED:
 262                         DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED\n"));
 263                         break;
 264                 case GPFLAGS_MACHINE_SETTINGS_DISABLED:
 265                         DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED\n"));
 266                         break;
 267                 case GPFLAGS_ALL_DISABLED:
 268                         DEBUGADD(lvl,("GPFLAGS_ALL_DISABLED\n"));
 269                         break;
 270                 default:
 271                         DEBUGADD(lvl,("unknown option: %d\n", gpo->options));
 272                         break;
 273         }
 274
 275         DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link));
 276         DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type));
 277         switch (gpo->link_type) {
 278                 case GP_LINK_UNKOWN:
 279                         DEBUGADD(lvl,("GP_LINK_UNKOWN\n"));
 280                         break;
 281                 case GP_LINK_OU:
 282                         DEBUGADD(lvl,("GP_LINK_OU\n"));
 283                         break;
 284                 case GP_LINK_DOMAIN:
 285                         DEBUGADD(lvl,("GP_LINK_DOMAIN\n"));
 286                         break;
 287                 case GP_LINK_SITE:
 288                         DEBUGADD(lvl,("GP_LINK_SITE\n"));
 289                         break;
 290                 case GP_LINK_MACHINE:
 291                         DEBUGADD(lvl,("GP_LINK_MACHINE\n"));
 292                         break;
 293                 default:
 294                         break;
 295         }
 296
 297         DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions));
 298
 299         if (gpo->machine_extensions) {
 300
 301                 struct GP_EXT *gp_ext = NULL;
 302
 303                 if (!ads_parse_gp_ext(frame, gpo->machine_extensions,
 304                                       &gp_ext)) {
 305                         goto out;
 306                 }
 307                 dump_gp_ext(gp_ext, lvl);
 308         }
 309
 310         DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions));
 311
 312         if (gpo->user_extensions) {
 313
 314                 struct GP_EXT *gp_ext = NULL;
 315
 316                 if (!ads_parse_gp_ext(frame, gpo->user_extensions,
 317                                       &gp_ext)) {
 318                         goto out;
 319                 }
 320                 dump_gp_ext(gp_ext, lvl);
 321         }
 322         if (gpo->security_descriptor) {
 323                 DEBUGADD(lvl,("security descriptor:\n"));
 324
 325                 NDR_PRINT_DEBUG(security_descriptor, gpo->security_descriptor);
 326         }
 327  out:
 328         talloc_free(frame);
 329 }
 330
 331 /****************************************************************
 332 ****************************************************************/
 333
 334 void dump_gpo_list(const struct GROUP_POLICY_OBJECT *gpo_list,
 335                    int debuglevel)
 336 {
 337         const struct GROUP_POLICY_OBJECT *gpo = NULL;
 338
 339         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 340                 dump_gpo(gpo, debuglevel);
 341         }
 342 }
 343
 344 /****************************************************************
 345 ****************************************************************/
 346
 347 void dump_gplink(const struct GP_LINK *gp_link)
 348 {
 349         int i;
 350         int lvl = 10;
 351
 352         if (gp_link == NULL) {
 353                 return;
 354         }
 355
 356         DEBUG(lvl,("---------------------\n\n"));
 357
 358         DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link));
 359         DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts));
 360         switch (gp_link->gp_opts) {
 361                 case GPOPTIONS_INHERIT:
 362                         DEBUGADD(lvl,("GPOPTIONS_INHERIT\n"));
 363                         break;
 364                 case GPOPTIONS_BLOCK_INHERITANCE:
 365                         DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n"));
 366                         break;
 367                 default:
 368                         break;
 369         }
 370
 371         DEBUGADD(lvl,("num links: %d\n", gp_link->num_links));
 372
 373         for (i = 0; i < gp_link->num_links; i++) {
 374
 375                 DEBUGADD(lvl,("---------------------\n\n"));
 376
 377                 DEBUGADD(lvl,("link: #%d\n", i + 1));
 378                 DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i]));
 379
 380                 DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i]));
 381                 if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) {
 382                         DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED "));
 383                 }
 384                 if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) {
 385                         DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED"));
 386                 }
 387                 DEBUGADD(lvl,("\n"));
 388         }
 389 }
 390
 391 #endif /* HAVE_LDAP */
 392
 393 /****************************************************************
 394 ****************************************************************/
 395
 396 bool gpo_get_gp_ext_from_gpo(TALLOC_CTX *mem_ctx,
 397                              uint32_t flags,
 398                              const struct GROUP_POLICY_OBJECT *gpo,
 399                              struct GP_EXT **gp_ext)
 400 {
 401         ZERO_STRUCTP(*gp_ext);
 402
 403         if (flags & GPO_INFO_FLAG_MACHINE) {
 404
 405                 if (gpo->machine_extensions) {
 406
 407                         if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
 408                                               gp_ext)) {
 409                                 return false;
 410                         }
 411                 }
 412         } else {
 413
 414                 if (gpo->user_extensions) {
 415
 416                         if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
 417                                               gp_ext)) {
 418                                 return false;
 419                         }
 420                 }
 421         }
 422
 423         return true;
 424 }
 425
 426 /****************************************************************
 427 ****************************************************************/
 428
 429 NTSTATUS gpo_process_gpo_list(TALLOC_CTX *mem_ctx,
 430                               const struct security_token *token,
 431                               const struct GROUP_POLICY_OBJECT *deleted_gpo_list,
 432                               const struct GROUP_POLICY_OBJECT *changed_gpo_list,
 433                               const char *extensions_guid_filter,
 434                               uint32_t flags)
 435 {
 436         NTSTATUS status = NT_STATUS_OK;
 437         struct registry_key *root_key = NULL;
 438         struct gp_registry_context *reg_ctx = NULL;
 439         WERROR werr;
 440
 441         /* get the key here */
 442         if (flags & GPO_LIST_FLAG_MACHINE) {
 443                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKLM, REG_KEY_WRITE,
 444                                        get_system_token(),
 445                                        &reg_ctx);
 446         } else {
 447                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKCU, REG_KEY_WRITE,
 448                                        token,
 449                                        &reg_ctx);
 450         }
 451         if (!W_ERROR_IS_OK(werr)) {
 452                 talloc_free(reg_ctx);
 453                 return werror_to_ntstatus(werr);
 454         }
 455
 456         root_key = reg_ctx->curr_key;
 457
 458         status = gpext_process_extension(mem_ctx,
 459                                          flags, token, root_key,
 460                                          deleted_gpo_list,
 461                                          changed_gpo_list,
 462                                          extensions_guid_filter);
 463         talloc_free(reg_ctx);
 464         talloc_free(root_key);
 465         gpext_free_gp_extensions();
 466
 467         return status;
 468 }
 469
 470 /****************************************************************
 471 ****************************************************************/
 472
 473 NTSTATUS gpo_get_unix_path(TALLOC_CTX *mem_ctx,
 474                            const char *cache_dir,
 475                            const struct GROUP_POLICY_OBJECT *gpo,
 476                            char **unix_path)
 477 {
 478         char *server, *share, *nt_path;
 479         return gpo_explode_filesyspath(mem_ctx, cache_dir, gpo->file_sys_path,
 480                                        &server, &share, &nt_path, unix_path);
 481 }
 482
 483 /****************************************************************
 484 ****************************************************************/
 485
 486 char *gpo_flag_str(TALLOC_CTX *ctx, uint32_t flags)
 487 {
 488         char *str = NULL;
 489
 490         if (flags == 0) {
 491                 return NULL;
 492         }
 493
 494         str = talloc_strdup(ctx, "");
 495         if (!str) {
 496                 return NULL;
 497         }
 498
 499         if (flags & GPO_INFO_FLAG_SLOWLINK)
 500                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_SLOWLINK ");
 501         if (flags & GPO_INFO_FLAG_VERBOSE)
 502                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_VERBOSE ");
 503         if (flags & GPO_INFO_FLAG_SAFEMODE_BOOT)
 504                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_SAFEMODE_BOOT ");
 505         if (flags & GPO_INFO_FLAG_NOCHANGES)
 506                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_NOCHANGES ");
 507         if (flags & GPO_INFO_FLAG_MACHINE)
 508                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_MACHINE ");
 509         if (flags & GPO_INFO_FLAG_LOGRSOP_TRANSITION)
 510                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_LOGRSOP_TRANSITION ");
 511         if (flags & GPO_INFO_FLAG_LINKTRANSITION)
 512                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_LINKTRANSITION ");
 513         if (flags & GPO_INFO_FLAG_FORCED_REFRESH)
 514                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_FORCED_REFRESH ");
 515         if (flags & GPO_INFO_FLAG_BACKGROUND)
 516                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_BACKGROUND ");
 517
 518         return str;
 519 }
 520
 521 /****************************************************************
 522 ****************************************************************/
 523
 524 NTSTATUS gp_find_file(TALLOC_CTX *mem_ctx,
 525                       uint32_t flags,
 526                       const char *filename,
 527                       const char *suffix,
 528                       const char **filename_out)
 529 {
 530         const char *tmp = NULL;
 531         struct stat sbuf;
 532         const char *path = NULL;
 533
 534         if (flags & GPO_LIST_FLAG_MACHINE) {
 535                 path = "Machine";
 536         } else {
 537                 path = "User";
 538         }
 539
 540         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
 541                               path, suffix);
 542         NT_STATUS_HAVE_NO_MEMORY(tmp);
 543
 544         if (stat(tmp, &sbuf) == 0) {
 545                 *filename_out = tmp;
 546                 return NT_STATUS_OK;
 547         }
 548
 549         path = talloc_strdup_upper(mem_ctx, path);
 550         NT_STATUS_HAVE_NO_MEMORY(path);
 551
 552         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
 553                               path, suffix);
 554         NT_STATUS_HAVE_NO_MEMORY(tmp);
 555
 556         if (stat(tmp, &sbuf) == 0) {
 557                 *filename_out = tmp;
 558                 return NT_STATUS_OK;
 559         }
 560
 561         return NT_STATUS_NO_SUCH_FILE;
 562 }
 563
 564 /****************************************************************
 565 ****************************************************************/
 566
 567 ADS_STATUS gp_get_machine_token(ADS_STRUCT *ads,
 568                                 TALLOC_CTX *mem_ctx,
 569                                 const char *dn,
 570                                 struct security_token **token)
 571 {
 572 #ifdef HAVE_ADS
 573         struct security_token *ad_token = NULL;
 574         ADS_STATUS status;
 575         NTSTATUS ntstatus;
 576
 577         status = ads_get_sid_token(ads, mem_ctx, dn, &ad_token);
 578         if (!ADS_ERR_OK(status)) {
 579                 return status;
 580         }
 581         ntstatus = merge_nt_token(mem_ctx, ad_token, get_system_token(),
 582                                   token);
 583         if (!NT_STATUS_IS_OK(ntstatus)) {
 584                 return ADS_ERROR_NT(ntstatus);
 585         }
 586         return ADS_SUCCESS;
 587 #else
 588         return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
 589 #endif
 590 }
 591
 592 /****************************************************************
 593 ****************************************************************/
 594
 595 NTSTATUS gpo_copy(TALLOC_CTX *mem_ctx,
 596                   const struct GROUP_POLICY_OBJECT *gpo_src,
 597                   struct GROUP_POLICY_OBJECT **gpo_dst)
 598 {
 599         struct GROUP_POLICY_OBJECT *gpo;
 600
 601         gpo = talloc_zero(mem_ctx, struct GROUP_POLICY_OBJECT);
 602         NT_STATUS_HAVE_NO_MEMORY(gpo);
 603
 604         gpo->options            = gpo_src->options;
 605         gpo->version            = gpo_src->version;
 606
 607         gpo->ds_path            = talloc_strdup(gpo, gpo_src->ds_path);
 608         if (gpo->ds_path == NULL) {
 609                 TALLOC_FREE(gpo);
 610                 return NT_STATUS_NO_MEMORY;
 611         }
 612
 613         gpo->file_sys_path      = talloc_strdup(gpo, gpo_src->file_sys_path);
 614         if (gpo->file_sys_path == NULL) {
 615                 TALLOC_FREE(gpo);
 616                 return NT_STATUS_NO_MEMORY;
 617         }
 618
 619         gpo->display_name       = talloc_strdup(gpo, gpo_src->display_name);
 620         if (gpo->display_name == NULL) {
 621                 TALLOC_FREE(gpo);
 622                 return NT_STATUS_NO_MEMORY;
 623         }
 624
 625         gpo->name               = talloc_strdup(gpo, gpo_src->name);
 626         if (gpo->name == NULL) {
 627                 TALLOC_FREE(gpo);
 628                 return NT_STATUS_NO_MEMORY;
 629         }
 630
 631         gpo->link               = talloc_strdup(gpo, gpo_src->link);
 632         if (gpo->link == NULL) {
 633                 TALLOC_FREE(gpo);
 634                 return NT_STATUS_NO_MEMORY;
 635         }
 636
 637         gpo->link_type          = gpo_src->link_type;
 638
 639         if (gpo_src->user_extensions) {
 640                 gpo->user_extensions = talloc_strdup(gpo, gpo_src->user_extensions);
 641                 if (gpo->user_extensions == NULL) {
 642                         TALLOC_FREE(gpo);
 643                         return NT_STATUS_NO_MEMORY;
 644                 }
 645         }
 646
 647         if (gpo_src->machine_extensions) {
 648                 gpo->machine_extensions = talloc_strdup(gpo, gpo_src->machine_extensions);
 649                 if (gpo->machine_extensions == NULL) {
 650                         TALLOC_FREE(gpo);
 651                         return NT_STATUS_NO_MEMORY;
 652                 }
 653         }
 654
 655         if (gpo_src->security_descriptor == NULL) {
 656                 /* existing SD assumed */
 657                 TALLOC_FREE(gpo);
 658                 return NT_STATUS_INVALID_PARAMETER;
 659         }
 660         gpo->security_descriptor = security_descriptor_copy(gpo,
 661                                                 gpo_src->security_descriptor);
 662         if (gpo->security_descriptor == NULL) {
 663                 TALLOC_FREE(gpo);
 664                 return NT_STATUS_NO_MEMORY;
 665         }
 666
 667         gpo->next = gpo->prev = NULL;
 668
 669         *gpo_dst = gpo;
 670
 671         return NT_STATUS_OK;
 672 }