libcli/security/secace.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  struct security_ace handling functions
   4  *  Copyright (C) Andrew Tridgell              1992-1998,
   5  *  Copyright (C) Jeremy R. Allison            1995-2003.
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   7  *  Copyright (C) Paul Ashton                  1997-1998.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 3 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include "includes.h"
  24 #include "librpc/gen_ndr/ndr_security.h"
  25 #include "libcli/security/security.h"
  26 #include "lib/util/tsort.h"
  27
  28 #define  SEC_ACE_HEADER_SIZE (2 * sizeof(uint8_t) + sizeof(uint16_t) + sizeof(uint32_t))
  29
  30 /**
  31  * Check if ACE has OBJECT type.
  32  */
  33 bool sec_ace_object(uint8_t type)
  34 {
  35         if (type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT ||
  36             type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT ||
  37             type == SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT ||
  38             type == SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT) {
  39                 return true;
  40         }
  41         return false;
  42 }
  43
  44 /**
  45  * copy a struct security_ace structure.
  46  */
  47 void sec_ace_copy(struct security_ace *ace_dest, const struct security_ace *ace_src)
  48 {
  49         ace_dest->type  = ace_src->type;
  50         ace_dest->flags = ace_src->flags;
  51         ace_dest->size  = ace_src->size;
  52         ace_dest->access_mask = ace_src->access_mask;
  53         ace_dest->object = ace_src->object;
  54         ace_dest->trustee = ace_src->trustee;
  55 }
  56
  57 /*******************************************************************
  58  Sets up a struct security_ace structure.
  59 ********************************************************************/
  60
  61 void init_sec_ace(struct security_ace *t, const struct dom_sid *sid, enum security_ace_type type,
  62                   uint32_t mask, uint8_t flag)
  63 {
  64         t->type = type;
  65         t->flags = flag;
  66         t->size = ndr_size_dom_sid(sid, 0) + 8;
  67         t->access_mask = mask;
  68
  69         t->trustee = *sid;
  70 }
  71
  72 /*******************************************************************
  73   modify SID's permissions at ACL
  74 ********************************************************************/
  75
  76 NTSTATUS sec_ace_mod_sid(struct security_ace *ace, size_t num, const struct dom_sid *sid, uint32_t mask)
  77 {
  78         unsigned int i = 0;
  79
  80         if (!ace || !sid)  return NT_STATUS_INVALID_PARAMETER;
  81
  82         for (i = 0; i < num; i ++) {
  83                 if (dom_sid_equal(&ace[i].trustee, sid)) {
  84                         ace[i].access_mask = mask;
  85                         return NT_STATUS_OK;
  86                 }
  87         }
  88         return NT_STATUS_NOT_FOUND;
  89 }
  90
  91 int nt_ace_inherit_comp(const struct security_ace *a1, const struct security_ace *a2)
  92 {
  93         int a1_inh = a1->flags & SEC_ACE_FLAG_INHERITED_ACE;
  94         int a2_inh = a2->flags & SEC_ACE_FLAG_INHERITED_ACE;
  95
  96         if (a1_inh == a2_inh)
  97                 return 0;
  98
  99         if (!a1_inh && a2_inh)
 100                 return -1;
 101         return 1;
 102 }
 103
 104 /*******************************************************************
 105   Comparison function to apply the order explained below in a group.
 106 *******************************************************************/
 107
 108 int nt_ace_canon_comp( const struct security_ace *a1,  const struct security_ace *a2)
 109 {
 110         if ((a1->type == SEC_ACE_TYPE_ACCESS_DENIED) &&
 111                                 (a2->type != SEC_ACE_TYPE_ACCESS_DENIED))
 112                 return -1;
 113
 114         if ((a2->type == SEC_ACE_TYPE_ACCESS_DENIED) &&
 115                                 (a1->type != SEC_ACE_TYPE_ACCESS_DENIED))
 116                 return 1;
 117
 118         /* Both access denied or access allowed. */
 119
 120         /* 1. ACEs that apply to the object itself */
 121
 122         if (!(a1->flags & SEC_ACE_FLAG_INHERIT_ONLY) &&
 123                         (a2->flags & SEC_ACE_FLAG_INHERIT_ONLY))
 124                 return -1;
 125         else if (!(a2->flags & SEC_ACE_FLAG_INHERIT_ONLY) &&
 126                         (a1->flags & SEC_ACE_FLAG_INHERIT_ONLY))
 127                 return 1;
 128
 129         /* 2. ACEs that apply to a subobject of the object, such as
 130          * a property set or property. */
 131
 132         if (a1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT) &&
 133                         !(a2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT)))
 134                 return -1;
 135         else if (a2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT) &&
 136                         !(a1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT)))
 137                 return 1;
 138
 139         return 0;
 140 }
 141
 142 /*******************************************************************
 143  Functions to convert a SEC_DESC ACE DACL list into canonical order.
 144  JRA.
 145
 146 --- from http://msdn.microsoft.com/library/default.asp?url=/library/en-us/security/security/order_of_aces_in_a_dacl.asp
 147
 148 The following describes the preferred order:
 149
 150  To ensure that noninherited ACEs have precedence over inherited ACEs,
 151  place all noninherited ACEs in a group before any inherited ACEs.
 152  This ordering ensures, for example, that a noninherited access-denied ACE
 153  is enforced regardless of any inherited ACE that allows access.
 154
 155  Within the groups of noninherited ACEs and inherited ACEs, order ACEs according to ACE type, as the following shows:
 156         1. Access-denied ACEs that apply to the object itself
 157         2. Access-denied ACEs that apply to a subobject of the object, such as a property set or property
 158         3. Access-allowed ACEs that apply to the object itself
 159         4. Access-allowed ACEs that apply to a subobject of the object"
 160
 161 ********************************************************************/
 162
 163 void dacl_sort_into_canonical_order(struct security_ace *srclist, unsigned int num_aces)
 164 {
 165         unsigned int i;
 166
 167         if (!srclist || num_aces == 0)
 168                 return;
 169
 170         /* Sort so that non-inherited ACE's come first. */
 171         TYPESAFE_QSORT(srclist, num_aces, nt_ace_inherit_comp);
 172
 173         /* Find the boundary between non-inherited ACEs. */
 174         for (i = 0; i < num_aces; i++ ) {
 175                 struct security_ace *curr_ace = &srclist[i];
 176
 177                 if (curr_ace->flags & SEC_ACE_FLAG_INHERITED_ACE)
 178                         break;
 179         }
 180
 181         /* i now points at entry number of the first inherited ACE. */
 182
 183         /* Sort the non-inherited ACEs. */
 184         TYPESAFE_QSORT(srclist, i, nt_ace_canon_comp);
 185
 186         /* Now sort the inherited ACEs. */
 187         TYPESAFE_QSORT(&srclist[i], num_aces - i, nt_ace_canon_comp);
 188 }
 189
 190