2 * Unix SMB/CIFS implementation.
3 * Group Policy Object Support
4 * Copyright (C) Guenther Deschner 2007
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 /* When modifiying security filtering with gpmc.msc (on w2k3) the
24 * following ACE is created in the DACL:
26 ------- ACE (type: 0x05, flags: 0x02, size: 0x38, mask: 0x100, object flags: 0x1)
28 access type: ALLOWED OBJECT
30 [Apply Group Policy] (0x00000100)
32 ------- ACE (type: 0x00, flags: 0x02, size: 0x24, mask: 0x20014)
36 [List Contents] (0x00000004)
37 [Read All Properties] (0x00000010)
38 [Read Permissions] (0x00020000)
40 * by default all "Authenticated Users" (S-1-5-11) have an ALLOW
41 * OBJECT ace with SEC_RIGHTS_APPLY_GROUP_POLICY mask */
44 /****************************************************************
45 ****************************************************************/
47 static BOOL
gpo_sd_check_agp_access_bits(uint32 access_mask
)
49 return (access_mask
& SEC_RIGHTS_APPLY_GROUP_POLICY
);
53 /****************************************************************
54 ****************************************************************/
56 static BOOL
gpo_sd_check_read_access_bits(uint32 access_mask
)
58 uint32 read_bits
= SEC_RIGHTS_LIST_CONTENTS
|
59 SEC_RIGHTS_READ_ALL_PROP
|
60 SEC_RIGHTS_READ_PERMS
;
62 return (read_bits
== (access_mask
& read_bits
));
66 /****************************************************************
67 ****************************************************************/
69 static BOOL
gpo_sd_check_trustee_in_sid_token(const DOM_SID
*trustee
,
70 const struct GPO_SID_TOKEN
*token
)
74 if (sid_equal(trustee
, &token
->object_sid
)) {
78 if (sid_equal(trustee
, &token
->primary_group_sid
)) {
82 for (i
= 0; i
< token
->num_token_sids
; i
++) {
83 if (sid_equal(trustee
, &token
->token_sids
[i
])) {
91 /****************************************************************
92 ****************************************************************/
94 static NTSTATUS
gpo_sd_check_ace_denied_object(const SEC_ACE
*ace
,
95 const struct GPO_SID_TOKEN
*token
)
97 if (gpo_sd_check_agp_access_bits(ace
->access_mask
) &&
98 gpo_sd_check_trustee_in_sid_token(&ace
->trustee
, token
)) {
99 DEBUG(10,("gpo_sd_check_ace_denied_object: Access denied as of ace for %s\n",
100 sid_string_static(&ace
->trustee
)));
101 return NT_STATUS_ACCESS_DENIED
;
104 return STATUS_MORE_ENTRIES
;
107 /****************************************************************
108 ****************************************************************/
110 static NTSTATUS
gpo_sd_check_ace_allowed_object(const SEC_ACE
*ace
,
111 const struct GPO_SID_TOKEN
*token
)
113 if (gpo_sd_check_agp_access_bits(ace
->access_mask
) &&
114 gpo_sd_check_trustee_in_sid_token(&ace
->trustee
, token
)) {
115 DEBUG(10,("gpo_sd_check_ace_allowed_object: Access granted as of ace for %s\n",
116 sid_string_static(&ace
->trustee
)));
120 return STATUS_MORE_ENTRIES
;
123 /****************************************************************
124 ****************************************************************/
126 static NTSTATUS
gpo_sd_check_ace(const SEC_ACE
*ace
,
127 const struct GPO_SID_TOKEN
*token
)
130 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT
:
131 return gpo_sd_check_ace_denied_object(ace
, token
);
132 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
:
133 return gpo_sd_check_ace_allowed_object(ace
, token
);
135 return STATUS_MORE_ENTRIES
;
139 /****************************************************************
140 ****************************************************************/
142 NTSTATUS
gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT
*gpo
,
143 const struct GPO_SID_TOKEN
*token
)
145 SEC_DESC
*sd
= gpo
->security_descriptor
;
146 SEC_ACL
*dacl
= NULL
;
147 NTSTATUS status
= NT_STATUS_ACCESS_DENIED
;
151 return NT_STATUS_INVALID_USER_BUFFER
;
155 return NT_STATUS_INVALID_SECURITY_DESCR
;
160 return NT_STATUS_INVALID_SECURITY_DESCR
;
163 /* check all aces and only return NT_STATUS_OK (== Access granted) or
164 * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
167 for (i
= 0; i
< dacl
->num_aces
; i
++) {
169 status
= gpo_sd_check_ace(&dacl
->aces
[i
], token
);
171 if (NT_STATUS_EQUAL(status
, NT_STATUS_ACCESS_DENIED
)) {
173 } else if (NT_STATUS_IS_OK(status
)) {
180 return NT_STATUS_ACCESS_DENIED
;