2 Unix SMB/CIFS implementation.
3 Privileges handling functions
4 Copyright (C) Jean François Micouleau 1998-2001
5 Copyright (C) Simo Sorce 2002-2003
6 Copyright (C) Gerald (Jerry) Carter 2005
7 Copyright (C) Michael Adam 2007
8 Copyright (C) Andrew Bartlett 2010
9 Copyright (C) Andrew Tridgell 2004
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 * Basic privileges functions (mask-operations and conversion
27 * functions between the different formats (se_priv, privset, luid)
28 * moved here * from lib/privileges.c to minimize linker deps.
30 * generally SID- and LUID-related code is left in lib/privileges.c
32 * some extra functions to hide privs array from lib/privileges.c
36 #include "libcli/security/privileges.h"
37 #include "libcli/security/privileges_private.h"
38 #include "librpc/gen_ndr/security.h"
40 /* The use of strcasecmp here is safe, all the comparison strings are ASCII */
43 #define NUM_SHORT_LIST_PRIVS 8
46 enum sec_privilege luid
;
47 uint64_t privilege_mask
;
49 const char *description
;
52 {SEC_PRIV_MACHINE_ACCOUNT
, SEC_PRIV_MACHINE_ACCOUNT_BIT
, "SeMachineAccountPrivilege", "Add machines to domain"},
53 {SEC_PRIV_TAKE_OWNERSHIP
, SEC_PRIV_TAKE_OWNERSHIP_BIT
, "SeTakeOwnershipPrivilege", "Take ownership of files or other objects"},
54 {SEC_PRIV_BACKUP
, SEC_PRIV_BACKUP_BIT
, "SeBackupPrivilege", "Back up files and directories"},
55 {SEC_PRIV_RESTORE
, SEC_PRIV_RESTORE_BIT
, "SeRestorePrivilege", "Restore files and directories"},
56 {SEC_PRIV_REMOTE_SHUTDOWN
, SEC_PRIV_REMOTE_SHUTDOWN_BIT
, "SeRemoteShutdownPrivilege", "Force shutdown from a remote system"},
58 {SEC_PRIV_PRINT_OPERATOR
, SEC_PRIV_PRINT_OPERATOR_BIT
, "SePrintOperatorPrivilege", "Manage printers"},
59 {SEC_PRIV_ADD_USERS
, SEC_PRIV_ADD_USERS_BIT
, "SeAddUsersPrivilege", "Add users and groups to the domain"},
60 {SEC_PRIV_DISK_OPERATOR
, SEC_PRIV_DISK_OPERATOR_BIT
, "SeDiskOperatorPrivilege", "Manage disk shares"},
62 /* The list from here on is not displayed in the code from
63 * source3, and is after index NUM_SHORT_LIST_PRIVS for that
67 SEC_PRIV_SECURITY_BIT
,
68 "SeSecurityPrivilege",
72 SEC_PRIV_SYSTEMTIME_BIT
,
73 "SeSystemtimePrivilege",
74 "Set the system clock"},
77 SEC_PRIV_SHUTDOWN_BIT
,
78 "SeShutdownPrivilege",
79 "Shutdown the system"},
86 {SEC_PRIV_SYSTEM_ENVIRONMENT
,
87 SEC_PRIV_SYSTEM_ENVIRONMENT_BIT
,
88 "SeSystemEnvironmentPrivilege",
89 "Modify system environment"},
91 {SEC_PRIV_SYSTEM_PROFILE
,
92 SEC_PRIV_SYSTEM_PROFILE_BIT
,
93 "SeSystemProfilePrivilege",
94 "Profile the system"},
96 {SEC_PRIV_PROFILE_SINGLE_PROCESS
,
97 SEC_PRIV_PROFILE_SINGLE_PROCESS_BIT
,
98 "SeProfileSingleProcessPrivilege",
99 "Profile one process"},
101 {SEC_PRIV_INCREASE_BASE_PRIORITY
,
102 SEC_PRIV_INCREASE_BASE_PRIORITY_BIT
,
103 "SeIncreaseBasePriorityPrivilege",
104 "Increase base priority"},
106 {SEC_PRIV_LOAD_DRIVER
,
107 SEC_PRIV_LOAD_DRIVER_BIT
,
108 "SeLoadDriverPrivilege",
111 {SEC_PRIV_CREATE_PAGEFILE
,
112 SEC_PRIV_CREATE_PAGEFILE_BIT
,
113 "SeCreatePagefilePrivilege",
114 "Create page files"},
116 {SEC_PRIV_INCREASE_QUOTA
,
117 SEC_PRIV_INCREASE_QUOTA_BIT
,
118 "SeIncreaseQuotaPrivilege",
121 {SEC_PRIV_CHANGE_NOTIFY
,
122 SEC_PRIV_CHANGE_NOTIFY_BIT
,
123 "SeChangeNotifyPrivilege",
124 "Register for change notify"},
131 {SEC_PRIV_MANAGE_VOLUME
,
132 SEC_PRIV_MANAGE_VOLUME_BIT
,
133 "SeManageVolumePrivilege",
134 "Manage system volumes"},
136 {SEC_PRIV_IMPERSONATE
,
137 SEC_PRIV_IMPERSONATE_BIT
,
138 "SeImpersonatePrivilege",
139 "Impersonate users"},
141 {SEC_PRIV_CREATE_GLOBAL
,
142 SEC_PRIV_CREATE_GLOBAL_BIT
,
143 "SeCreateGlobalPrivilege",
146 {SEC_PRIV_ENABLE_DELEGATION
,
147 SEC_PRIV_ENABLE_DELEGATION_BIT
,
148 "SeEnableDelegationPrivilege",
149 "Enable Delegation"},
152 /* These are rights, not privileges, and should not be confused. The
153 * names are very similar, and they are quite similar in behaviour,
154 * but they are not to be enumerated as a system-wide list or have an
156 static const struct {
159 const char *description
;
161 {LSA_POLICY_MODE_INTERACTIVE
,
162 "SeInteractiveLogonRight",
163 "Interactive logon"},
165 {LSA_POLICY_MODE_NETWORK
,
166 "SeNetworkLogonRight",
169 {LSA_POLICY_MODE_REMOTE_INTERACTIVE
,
170 "SeRemoteInteractiveLogonRight",
171 "Remote Interactive logon"}
175 return a privilege mask given a privilege id
177 uint64_t sec_privilege_mask(enum sec_privilege privilege
)
180 for (i
=0;i
<ARRAY_SIZE(privs
);i
++) {
181 if (privs
[i
].luid
== privilege
) {
182 return privs
[i
].privilege_mask
;
189 /***************************************************************************
190 put all valid privileges into a mask
191 ****************************************************************************/
193 void se_priv_put_all_privileges(uint64_t *privilege_mask
)
196 uint32_t num_privs
= ARRAY_SIZE(privs
);
199 for ( i
=0; i
<num_privs
; i
++ ) {
200 *privilege_mask
|= privs
[i
].privilege_mask
;
204 /*********************************************************************
205 Lookup the uint64_t bitmask value for a privilege name
206 *********************************************************************/
208 bool se_priv_from_name( const char *name
, uint64_t *privilege_mask
)
211 uint32_t num_privs
= ARRAY_SIZE(privs
);
212 for ( i
=0; i
<num_privs
; i
++ ) {
213 if ( strequal( privs
[i
].name
, name
) ) {
214 *privilege_mask
= privs
[i
].privilege_mask
;
222 const char* get_privilege_dispname( const char *name
)
226 uint32_t num_privs
= ARRAY_SIZE(privs
);
232 for ( i
=0; i
<num_privs
; i
++ ) {
233 if ( strequal( privs
[i
].name
, name
) ) {
234 return privs
[i
].description
;
241 /*******************************************************************
242 return the number of elements in the 'short' privlege array (traditional source3 behaviour)
243 *******************************************************************/
245 int num_privileges_in_short_list( void )
247 return NUM_SHORT_LIST_PRIVS
;
250 /****************************************************************************
251 add a privilege to a privilege array
252 ****************************************************************************/
254 static bool privilege_set_add(PRIVILEGE_SET
*priv_set
, struct lsa_LUIDAttribute set
)
256 struct lsa_LUIDAttribute
*new_set
;
258 /* we can allocate memory to add the new privilege */
260 new_set
= talloc_realloc(priv_set
->mem_ctx
, priv_set
->set
, struct lsa_LUIDAttribute
, priv_set
->count
+ 1);
262 DEBUG(0,("privilege_set_add: failed to allocate memory!\n"));
266 new_set
[priv_set
->count
].luid
.high
= set
.luid
.high
;
267 new_set
[priv_set
->count
].luid
.low
= set
.luid
.low
;
268 new_set
[priv_set
->count
].attribute
= set
.attribute
;
271 priv_set
->set
= new_set
;
276 /*******************************************************************
277 *******************************************************************/
279 bool se_priv_to_privilege_set( PRIVILEGE_SET
*set
, uint64_t privilege_mask
)
282 uint32_t num_privs
= ARRAY_SIZE(privs
);
283 struct lsa_LUIDAttribute luid
;
288 for ( i
=0; i
<num_privs
; i
++ ) {
289 if ((privilege_mask
& privs
[i
].privilege_mask
) == 0)
293 luid
.luid
.low
= privs
[i
].luid
;
295 if ( !privilege_set_add( set
, luid
) )
302 /*******************************************************************
303 *******************************************************************/
305 bool privilege_set_to_se_priv( uint64_t *privilege_mask
, struct lsa_PrivilegeSet
*privset
)
309 ZERO_STRUCTP( privilege_mask
);
311 for ( i
=0; i
<privset
->count
; i
++ ) {
314 /* sanity check for invalid privilege. we really
315 only care about the low 32 bits */
317 if ( privset
->set
[i
].luid
.high
!= 0 )
320 r
= sec_privilege_mask(privset
->set
[i
].luid
.low
);
322 *privilege_mask
|= r
;
330 map a privilege id to the wire string constant
332 const char *sec_privilege_name(enum sec_privilege privilege
)
335 for (i
=0;i
<ARRAY_SIZE(privs
);i
++) {
336 if (privs
[i
].luid
== privilege
) {
337 return privs
[i
].name
;
344 map a privilege id to a privilege display name. Return NULL if not found
346 TODO: this should use language mappings
348 const char *sec_privilege_display_name(enum sec_privilege privilege
, uint16_t *language
)
351 for (i
=0;i
<ARRAY_SIZE(privs
);i
++) {
352 if (privs
[i
].luid
== privilege
) {
353 return privs
[i
].description
;
360 map a privilege name to a privilege id. Return SEC_PRIV_INVALID if not found
362 enum sec_privilege
sec_privilege_id(const char *name
)
365 for (i
=0;i
<ARRAY_SIZE(privs
);i
++) {
366 if (strcasecmp(privs
[i
].name
, name
) == 0) {
367 return privs
[i
].luid
;
370 return SEC_PRIV_INVALID
;
374 map a 'right' name to it's bitmap value. Return 0 if not found
376 uint32_t sec_right_bit(const char *name
)
379 for (i
=0;i
<ARRAY_SIZE(rights
);i
++) {
380 if (strcasecmp(rights
[i
].name
, name
) == 0) {
381 return rights
[i
].right_mask
;
388 assist in walking the table of privileges - return the LUID (low 32 bits) by index
390 enum sec_privilege
sec_privilege_from_index(int idx
)
392 if (idx
>= 0 && idx
<ARRAY_SIZE(privs
)) {
393 return privs
[idx
].luid
;
395 return SEC_PRIV_INVALID
;
399 assist in walking the table of privileges - return the string constant by index
401 const char *sec_privilege_name_from_index(int idx
)
403 if (idx
>= 0 && idx
<ARRAY_SIZE(privs
)) {
404 return privs
[idx
].name
;
412 return true if a security_token has a particular privilege bit set
414 bool security_token_has_privilege(const struct security_token
*token
, enum sec_privilege privilege
)
418 mask
= sec_privilege_mask(privilege
);
423 if (token
->privilege_mask
& mask
) {
430 set a bit in the privilege mask
432 void security_token_set_privilege(struct security_token
*token
, enum sec_privilege privilege
)
434 /* Relies on the fact that an invalid privilage will return 0, so won't change this */
435 token
->privilege_mask
|= sec_privilege_mask(privilege
);
439 set a bit in the rights mask
441 void security_token_set_right_bit(struct security_token
*token
, uint32_t right_bit
)
443 token
->rights_mask
|= right_bit
;
446 void security_token_debug_privileges(int dbg_class
, int dbg_lev
, const struct security_token
*token
)
448 DEBUGADDC(dbg_class
, dbg_lev
, (" Privileges (0x%16llX):\n",
449 (unsigned long long) token
->privilege_mask
));
451 if (token
->privilege_mask
) {
454 for (idx
= 0; idx
<ARRAY_SIZE(privs
); idx
++) {
455 if (token
->privilege_mask
& privs
[idx
].privilege_mask
) {
456 DEBUGADDC(dbg_class
, dbg_lev
,
457 (" Privilege[%3lu]: %s\n", (unsigned long)i
++,
462 DEBUGADDC(dbg_class
, dbg_lev
, (" Rights (0x%16lX):\n",
463 (unsigned long) token
->rights_mask
));
465 if (token
->rights_mask
) {
468 for (idx
= 0; idx
<ARRAY_SIZE(rights
); idx
++) {
469 if (token
->rights_mask
& rights
[idx
].right_mask
) {
470 DEBUGADDC(dbg_class
, dbg_lev
,
471 (" Right[%3lu]: %s\n", (unsigned long)i
++,