?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-docs: overrided -> overridden
[Samba.git] / source3 / lib / secdesc.c
blob001eccb5763b5a95b95c0726d7ae38ca80bbfe86
1 /*
2 * Unix SMB/Netbios implementation.
3 * SEC_DESC handling functions
4 * Copyright (C) Andrew Tridgell 1992-1998,
5 * Copyright (C) Jeremy R. Allison 1995-2003.
6 * Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
7 * Copyright (C) Paul Ashton 1997-1998.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "../librpc/gen_ndr/ndr_security.h"
25 #include "../libcli/security/security.h"
26
27 #define ALL_SECURITY_INFORMATION (SECINFO_OWNER|SECINFO_GROUP|\
28 SECINFO_DACL|SECINFO_SACL|\
29 SECINFO_UNPROTECTED_SACL|\
30 SECINFO_UNPROTECTED_DACL|\
31 SECINFO_PROTECTED_SACL|\
32 SECINFO_PROTECTED_DACL)
33
34 /* Map generic permissions to file object specific permissions */
35
36 const struct generic_mapping file_generic_mapping = {
37 FILE_GENERIC_READ,
38 FILE_GENERIC_WRITE,
39 FILE_GENERIC_EXECUTE,
40 FILE_GENERIC_ALL
41 };
42
43 /*******************************************************************
44 Given a security_descriptor return the sec_info.
45 ********************************************************************/
46
47 uint32_t get_sec_info(const struct security_descriptor *sd)
48 {
49 uint32_t sec_info = ALL_SECURITY_INFORMATION;
50
51 SMB_ASSERT(sd);
52
53 if (sd->owner_sid == NULL) {
54 sec_info &= ~SECINFO_OWNER;
55 }
56 if (sd->group_sid == NULL) {
57 sec_info &= ~SECINFO_GROUP;
58 }
59 if (sd->sacl == NULL) {
60 sec_info &= ~SECINFO_SACL;
61 }
62 if (sd->dacl == NULL) {
63 sec_info &= ~SECINFO_DACL;
64 }
65
66 return sec_info;
67 }
68
69
70 /*******************************************************************
71 Merge part of security descriptor old_sec in to the empty sections of
72 security descriptor new_sec.
73 ********************************************************************/
74
75 struct sec_desc_buf *sec_desc_merge_buf(TALLOC_CTX *ctx, struct sec_desc_buf *new_sdb, struct sec_desc_buf *old_sdb)
76 {
77 struct dom_sid *owner_sid, *group_sid;
78 struct sec_desc_buf *return_sdb;
79 struct security_acl *dacl, *sacl;
80 struct security_descriptor *psd = NULL;
81 uint16 secdesc_type;
82 size_t secdesc_size;
83
84 /* Copy over owner and group sids. There seems to be no flag for
85 this so just check the pointer values. */
86
87 owner_sid = new_sdb->sd->owner_sid ? new_sdb->sd->owner_sid :
88 old_sdb->sd->owner_sid;
89
90 group_sid = new_sdb->sd->group_sid ? new_sdb->sd->group_sid :
91 old_sdb->sd->group_sid;
92
93 secdesc_type = new_sdb->sd->type;
94
95 /* Ignore changes to the system ACL. This has the effect of making
96 changes through the security tab audit button not sticking.
97 Perhaps in future Samba could implement these settings somehow. */
98
99 sacl = NULL;
100 secdesc_type &= ~SEC_DESC_SACL_PRESENT;
101
102 /* Copy across discretionary ACL */
103
104 if (secdesc_type & SEC_DESC_DACL_PRESENT) {
105 dacl = new_sdb->sd->dacl;
106 } else {
107 dacl = old_sdb->sd->dacl;
108 }
109
110 /* Create new security descriptor from bits */
111
112 psd = make_sec_desc(ctx, new_sdb->sd->revision, secdesc_type,
113 owner_sid, group_sid, sacl, dacl, &secdesc_size);
114
115 return_sdb = make_sec_desc_buf(ctx, secdesc_size, psd);
116
117 return(return_sdb);
118 }
119
120 struct security_descriptor *sec_desc_merge(TALLOC_CTX *ctx, struct security_descriptor *new_sdb, struct security_descriptor *old_sdb)
121 {
122 struct dom_sid *owner_sid, *group_sid;
123 struct security_acl *dacl, *sacl;
124 struct security_descriptor *psd = NULL;
125 uint16 secdesc_type;
126 size_t secdesc_size;
127
128 /* Copy over owner and group sids. There seems to be no flag for
129 this so just check the pointer values. */
130
131 owner_sid = new_sdb->owner_sid ? new_sdb->owner_sid :
132 old_sdb->owner_sid;
133
134 group_sid = new_sdb->group_sid ? new_sdb->group_sid :
135 old_sdb->group_sid;
136
137 secdesc_type = new_sdb->type;
138
139 /* Ignore changes to the system ACL. This has the effect of making
140 changes through the security tab audit button not sticking.
141 Perhaps in future Samba could implement these settings somehow. */
142
143 sacl = NULL;
144 secdesc_type &= ~SEC_DESC_SACL_PRESENT;
145
146 /* Copy across discretionary ACL */
147
148 if (secdesc_type & SEC_DESC_DACL_PRESENT) {
149 dacl = new_sdb->dacl;
150 } else {
151 dacl = old_sdb->dacl;
152 }
153
154 /* Create new security descriptor from bits */
155 psd = make_sec_desc(ctx, new_sdb->revision, secdesc_type,
156 owner_sid, group_sid, sacl, dacl, &secdesc_size);
157
158 return psd;
159 }
160
161 /*******************************************************************
162 Creates a struct security_descriptor structure
163 ********************************************************************/
164
165 #define SEC_DESC_HEADER_SIZE (2 * sizeof(uint16) + 4 * sizeof(uint32))
166
167 struct security_descriptor *make_sec_desc(TALLOC_CTX *ctx,
168 enum security_descriptor_revision revision,
169 uint16 type,
170 const struct dom_sid *owner_sid, const struct dom_sid *grp_sid,
171 struct security_acl *sacl, struct security_acl *dacl, size_t *sd_size)
172 {
173 struct security_descriptor *dst;
174 uint32 offset = 0;
175
176 *sd_size = 0;
177
178 if(( dst = TALLOC_ZERO_P(ctx, struct security_descriptor)) == NULL)
179 return NULL;
180
181 dst->revision = revision;
182 dst->type = type;
183
184 if (sacl)
185 dst->type |= SEC_DESC_SACL_PRESENT;
186 if (dacl)
187 dst->type |= SEC_DESC_DACL_PRESENT;
188
189 dst->owner_sid = NULL;
190 dst->group_sid = NULL;
191 dst->sacl = NULL;
192 dst->dacl = NULL;
193
194 if(owner_sid && ((dst->owner_sid = dom_sid_dup(dst,owner_sid)) == NULL))
195 goto error_exit;
196
197 if(grp_sid && ((dst->group_sid = dom_sid_dup(dst,grp_sid)) == NULL))
198 goto error_exit;
199
200 if(sacl && ((dst->sacl = dup_sec_acl(dst, sacl)) == NULL))
201 goto error_exit;
202
203 if(dacl && ((dst->dacl = dup_sec_acl(dst, dacl)) == NULL))
204 goto error_exit;
205
206 offset = SEC_DESC_HEADER_SIZE;
207
208 /*
209 * Work out the linearization sizes.
210 */
211
212 if (dst->sacl != NULL) {
213 offset += dst->sacl->size;
214 }
215 if (dst->dacl != NULL) {
216 offset += dst->dacl->size;
217 }
218
219 if (dst->owner_sid != NULL) {
220 offset += ndr_size_dom_sid(dst->owner_sid, 0);
221 }
222
223 if (dst->group_sid != NULL) {
224 offset += ndr_size_dom_sid(dst->group_sid, 0);
225 }
226
227 *sd_size = (size_t)offset;
228 return dst;
229
230 error_exit:
231
232 *sd_size = 0;
233 return NULL;
234 }
235
236 /*******************************************************************
237 Duplicate a struct security_descriptor structure.
238 ********************************************************************/
239
240 struct security_descriptor *dup_sec_desc(TALLOC_CTX *ctx, const struct security_descriptor *src)
241 {
242 size_t dummy;
243
244 if(src == NULL)
245 return NULL;
246
247 return make_sec_desc( ctx, src->revision, src->type,
248 src->owner_sid, src->group_sid, src->sacl,
249 src->dacl, &dummy);
250 }
251
252 /*******************************************************************
253 Convert a secdesc into a byte stream
254 ********************************************************************/
255 NTSTATUS marshall_sec_desc(TALLOC_CTX *mem_ctx,
256 struct security_descriptor *secdesc,
257 uint8 **data, size_t *len)
258 {
259 DATA_BLOB blob;
260 enum ndr_err_code ndr_err;
261
262 ndr_err = ndr_push_struct_blob(
263 &blob, mem_ctx, secdesc,
264 (ndr_push_flags_fn_t)ndr_push_security_descriptor);
265
266 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
267 DEBUG(0, ("ndr_push_security_descriptor failed: %s\n",
268 ndr_errstr(ndr_err)));
269 return ndr_map_error2ntstatus(ndr_err);
270 }
271
272 *data = blob.data;
273 *len = blob.length;
274 return NT_STATUS_OK;
275 }
276
277 /*******************************************************************
278 Convert a secdesc_buf into a byte stream
279 ********************************************************************/
280
281 NTSTATUS marshall_sec_desc_buf(TALLOC_CTX *mem_ctx,
282 struct sec_desc_buf *secdesc_buf,
283 uint8_t **data, size_t *len)
284 {
285 DATA_BLOB blob;
286 enum ndr_err_code ndr_err;
287
288 ndr_err = ndr_push_struct_blob(
289 &blob, mem_ctx, secdesc_buf,
290 (ndr_push_flags_fn_t)ndr_push_sec_desc_buf);
291
292 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
293 DEBUG(0, ("ndr_push_sec_desc_buf failed: %s\n",
294 ndr_errstr(ndr_err)));
295 return ndr_map_error2ntstatus(ndr_err);
296 }
297
298 *data = blob.data;
299 *len = blob.length;
300 return NT_STATUS_OK;
301 }
302
303 /*******************************************************************
304 Parse a byte stream into a secdesc
305 ********************************************************************/
306 NTSTATUS unmarshall_sec_desc(TALLOC_CTX *mem_ctx, uint8 *data, size_t len,
307 struct security_descriptor **psecdesc)
308 {
309 DATA_BLOB blob;
310 enum ndr_err_code ndr_err;
311 struct security_descriptor *result;
312
313 if ((data == NULL) || (len == 0)) {
314 return NT_STATUS_INVALID_PARAMETER;
315 }
316
317 result = TALLOC_ZERO_P(mem_ctx, struct security_descriptor);
318 if (result == NULL) {
319 return NT_STATUS_NO_MEMORY;
320 }
321
322 blob = data_blob_const(data, len);
323
324 ndr_err = ndr_pull_struct_blob(&blob, result, result,
325 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
326
327 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
328 DEBUG(0, ("ndr_pull_security_descriptor failed: %s\n",
329 ndr_errstr(ndr_err)));
330 TALLOC_FREE(result);
331 return ndr_map_error2ntstatus(ndr_err);
332 }
333
334 *psecdesc = result;
335 return NT_STATUS_OK;
336 }
337
338 /*******************************************************************
339 Parse a byte stream into a sec_desc_buf
340 ********************************************************************/
341
342 NTSTATUS unmarshall_sec_desc_buf(TALLOC_CTX *mem_ctx, uint8_t *data, size_t len,
343 struct sec_desc_buf **psecdesc_buf)
344 {
345 DATA_BLOB blob;
346 enum ndr_err_code ndr_err;
347 struct sec_desc_buf *result;
348
349 if ((data == NULL) || (len == 0)) {
350 return NT_STATUS_INVALID_PARAMETER;
351 }
352
353 result = TALLOC_ZERO_P(mem_ctx, struct sec_desc_buf);
354 if (result == NULL) {
355 return NT_STATUS_NO_MEMORY;
356 }
357
358 blob = data_blob_const(data, len);
359
360 ndr_err = ndr_pull_struct_blob(&blob, result, result,
361 (ndr_pull_flags_fn_t)ndr_pull_sec_desc_buf);
362
363 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
364 DEBUG(0, ("ndr_pull_sec_desc_buf failed: %s\n",
365 ndr_errstr(ndr_err)));
366 TALLOC_FREE(result);
367 return ndr_map_error2ntstatus(ndr_err);
368 }
369
370 *psecdesc_buf = result;
371 return NT_STATUS_OK;
372 }
373
374 /*******************************************************************
375 Creates a struct security_descriptor structure with typical defaults.
376 ********************************************************************/
377
378 struct security_descriptor *make_standard_sec_desc(TALLOC_CTX *ctx, const struct dom_sid *owner_sid, const struct dom_sid *grp_sid,
379 struct security_acl *dacl, size_t *sd_size)
380 {
381 return make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
382 SEC_DESC_SELF_RELATIVE, owner_sid, grp_sid, NULL,
383 dacl, sd_size);
384 }
385
386 /*******************************************************************
387 Creates a struct sec_desc_buf structure.
388 ********************************************************************/
389
390 struct sec_desc_buf *make_sec_desc_buf(TALLOC_CTX *ctx, size_t len, struct security_descriptor *sec_desc)
391 {
392 struct sec_desc_buf *dst;
393
394 if((dst = TALLOC_ZERO_P(ctx, struct sec_desc_buf)) == NULL)
395 return NULL;
396
397 /* max buffer size (allocated size) */
398 dst->sd_size = (uint32)len;
399
400 if(sec_desc && ((dst->sd = dup_sec_desc(ctx, sec_desc)) == NULL)) {
401 return NULL;
402 }
403
404 return dst;
405 }
406
407 /*******************************************************************
408 Duplicates a struct sec_desc_buf structure.
409 ********************************************************************/
410
411 struct sec_desc_buf *dup_sec_desc_buf(TALLOC_CTX *ctx, struct sec_desc_buf *src)
412 {
413 if(src == NULL)
414 return NULL;
415
416 return make_sec_desc_buf( ctx, src->sd_size, src->sd);
417 }
418
419 /*******************************************************************
420 Add a new SID with its permissions to struct security_descriptor.
421 ********************************************************************/
422
423 NTSTATUS sec_desc_add_sid(TALLOC_CTX *ctx, struct security_descriptor **psd, const struct dom_sid *sid, uint32 mask, size_t *sd_size)
424 {
425 struct security_descriptor *sd = 0;
426 struct security_acl *dacl = 0;
427 struct security_ace *ace = 0;
428 NTSTATUS status;
429
430 if (!ctx || !psd || !sid || !sd_size)
431 return NT_STATUS_INVALID_PARAMETER;
432
433 *sd_size = 0;
434
435 status = sec_ace_add_sid(ctx, &ace, psd[0]->dacl->aces, &psd[0]->dacl->num_aces, sid, mask);
436
437 if (!NT_STATUS_IS_OK(status))
438 return status;
439
440 if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace)))
441 return NT_STATUS_UNSUCCESSFUL;
442
443 if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid,
444 psd[0]->group_sid, psd[0]->sacl, dacl, sd_size)))
445 return NT_STATUS_UNSUCCESSFUL;
446
447 *psd = sd;
448 sd = 0;
449 return NT_STATUS_OK;
450 }
451
452 /*******************************************************************
453 Modify a SID's permissions in a struct security_descriptor.
454 ********************************************************************/
455
456 NTSTATUS sec_desc_mod_sid(struct security_descriptor *sd, struct dom_sid *sid, uint32 mask)
457 {
458 NTSTATUS status;
459
460 if (!sd || !sid)
461 return NT_STATUS_INVALID_PARAMETER;
462
463 status = sec_ace_mod_sid(sd->dacl->aces, sd->dacl->num_aces, sid, mask);
464
465 if (!NT_STATUS_IS_OK(status))
466 return status;
467
468 return NT_STATUS_OK;
469 }
470
471 /*******************************************************************
472 Delete a SID from a struct security_descriptor.
473 ********************************************************************/
474
475 NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, struct security_descriptor **psd, struct dom_sid *sid, size_t *sd_size)
476 {
477 struct security_descriptor *sd = 0;
478 struct security_acl *dacl = 0;
479 struct security_ace *ace = 0;
480 NTSTATUS status;
481
482 if (!ctx || !psd[0] || !sid || !sd_size)
483 return NT_STATUS_INVALID_PARAMETER;
484
485 *sd_size = 0;
486
487 status = sec_ace_del_sid(ctx, &ace, psd[0]->dacl->aces, &psd[0]->dacl->num_aces, sid);
488
489 if (!NT_STATUS_IS_OK(status))
490 return status;
491
492 if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace)))
493 return NT_STATUS_UNSUCCESSFUL;
494
495 if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid,
496 psd[0]->group_sid, psd[0]->sacl, dacl, sd_size)))
497 return NT_STATUS_UNSUCCESSFUL;
498
499 *psd = sd;
500 sd = 0;
501 return NT_STATUS_OK;
502 }
503
504 /*
505 * Determine if an struct security_ace is inheritable
506 */
507
508 static bool is_inheritable_ace(const struct security_ace *ace,
509 bool container)
510 {
511 if (!container) {
512 return ((ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) != 0);
513 }
514
515 if (ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
516 return true;
517 }
518
519 if ((ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) &&
520 !(ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
521 return true;
522 }
523
524 return false;
525 }
526
527 /*
528 * Does a security descriptor have any inheritable components for
529 * the newly created type ?
530 */
531
532 bool sd_has_inheritable_components(const struct security_descriptor *parent_ctr, bool container)
533 {
534 unsigned int i;
535 const struct security_acl *the_acl = parent_ctr->dacl;
536
537 for (i = 0; i < the_acl->num_aces; i++) {
538 const struct security_ace *ace = &the_acl->aces[i];
539
540 if (is_inheritable_ace(ace, container)) {
541 return true;
542 }
543 }
544 return false;
545 }
546
547 /* Create a child security descriptor using another security descriptor as
548 the parent container. This child object can either be a container or
549 non-container object. */
550
551 NTSTATUS se_create_child_secdesc(TALLOC_CTX *ctx,
552 struct security_descriptor **ppsd,
553 size_t *psize,
554 const struct security_descriptor *parent_ctr,
555 const struct dom_sid *owner_sid,
556 const struct dom_sid *group_sid,
557 bool container)
558 {
559 struct security_acl *new_dacl = NULL, *the_acl = NULL;
560 struct security_ace *new_ace_list = NULL;
561 unsigned int new_ace_list_ndx = 0, i;
562
563 *ppsd = NULL;
564 *psize = 0;
565
566 /* Currently we only process the dacl when creating the child. The
567 sacl should also be processed but this is left out as sacls are
568 not implemented in Samba at the moment.*/
569
570 the_acl = parent_ctr->dacl;
571
572 if (the_acl->num_aces) {
573 if (2*the_acl->num_aces < the_acl->num_aces) {
574 return NT_STATUS_NO_MEMORY;
575 }
576
577 if (!(new_ace_list = TALLOC_ARRAY(ctx, struct security_ace,
578 2*the_acl->num_aces))) {
579 return NT_STATUS_NO_MEMORY;
580 }
581 } else {
582 new_ace_list = NULL;
583 }
584
585 for (i = 0; i < the_acl->num_aces; i++) {
586 const struct security_ace *ace = &the_acl->aces[i];
587 struct security_ace *new_ace = &new_ace_list[new_ace_list_ndx];
588 const struct dom_sid *ptrustee = &ace->trustee;
589 const struct dom_sid *creator = NULL;
590 uint8 new_flags = ace->flags;
591
592 if (!is_inheritable_ace(ace, container)) {
593 continue;
594 }
595
596 /* see the RAW-ACLS inheritance test for details on these rules */
597 if (!container) {
598 new_flags = 0;
599 } else {
600 new_flags &= ~SEC_ACE_FLAG_INHERIT_ONLY;
601
602 if (!(new_flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
603 new_flags |= SEC_ACE_FLAG_INHERIT_ONLY;
604 }
605 if (new_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
606 new_flags = 0;
607 }
608 }
609
610 /* The CREATOR sids are special when inherited */
611 if (dom_sid_equal(ptrustee, &global_sid_Creator_Owner)) {
612 creator = &global_sid_Creator_Owner;
613 ptrustee = owner_sid;
614 } else if (dom_sid_equal(ptrustee, &global_sid_Creator_Group)) {
615 creator = &global_sid_Creator_Group;
616 ptrustee = group_sid;
617 }
618
619 if (creator && container &&
620 (new_flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
621
622 /* First add the regular ACE entry. */
623 init_sec_ace(new_ace, ptrustee, ace->type,
624 ace->access_mask, 0);
625
626 DEBUG(5,("se_create_child_secdesc(): %s:%d/0x%02x/0x%08x"
627 " inherited as %s:%d/0x%02x/0x%08x\n",
628 sid_string_dbg(&ace->trustee),
629 ace->type, ace->flags, ace->access_mask,
630 sid_string_dbg(&new_ace->trustee),
631 new_ace->type, new_ace->flags,
632 new_ace->access_mask));
633
634 new_ace_list_ndx++;
635
636 /* Now add the extra creator ACE. */
637 new_ace = &new_ace_list[new_ace_list_ndx];
638
639 ptrustee = creator;
640 new_flags |= SEC_ACE_FLAG_INHERIT_ONLY;
641 } else if (container &&
642 !(ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
643 ptrustee = &ace->trustee;
644 }
645
646 init_sec_ace(new_ace, ptrustee, ace->type,
647 ace->access_mask, new_flags);
648
649 DEBUG(5, ("se_create_child_secdesc(): %s:%d/0x%02x/0x%08x "
650 " inherited as %s:%d/0x%02x/0x%08x\n",
651 sid_string_dbg(&ace->trustee),
652 ace->type, ace->flags, ace->access_mask,
653 sid_string_dbg(&ace->trustee),
654 new_ace->type, new_ace->flags,
655 new_ace->access_mask));
656
657 new_ace_list_ndx++;
658 }
659
660 /* Create child security descriptor to return */
661 if (new_ace_list_ndx) {
662 new_dacl = make_sec_acl(ctx,
663 NT4_ACL_REVISION,
664 new_ace_list_ndx,
665 new_ace_list);
666
667 if (!new_dacl) {
668 return NT_STATUS_NO_MEMORY;
669 }
670 }
671
672 *ppsd = make_sec_desc(ctx,
673 SECURITY_DESCRIPTOR_REVISION_1,
674 SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT,
675 owner_sid,
676 group_sid,
677 NULL,
678 new_dacl,
679 psize);
680 if (!*ppsd) {
681 return NT_STATUS_NO_MEMORY;
682 }
683 return NT_STATUS_OK;
684 }
685
686 NTSTATUS se_create_child_secdesc_buf(TALLOC_CTX *ctx,
687 struct sec_desc_buf **ppsdb,
688 const struct security_descriptor *parent_ctr,
689 bool container)
690 {
691 NTSTATUS status;
692 size_t size = 0;
693 struct security_descriptor *sd = NULL;
694
695 *ppsdb = NULL;
696 status = se_create_child_secdesc(ctx,
697 &sd,
698 &size,
699 parent_ctr,
700 parent_ctr->owner_sid,
701 parent_ctr->group_sid,
702 container);
703 if (!NT_STATUS_IS_OK(status)) {
704 return status;
705 }
706
707 *ppsdb = make_sec_desc_buf(ctx, size, sd);
708 if (!*ppsdb) {
709 return NT_STATUS_NO_MEMORY;
710 }
711 return NT_STATUS_OK;
712 }
Samba GIT mirror