?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:lib/gencache: place gencache.tdb into /var/cache/samba
[Samba.git] / libcli / security / secdesc.c
blob8570334f36c2a5f06508cc0a797231b06085d3a3
1 /*
2 * Unix SMB/Netbios implementation.
3 * SEC_DESC handling functions
4 * Copyright (C) Andrew Tridgell 1992-1998,
5 * Copyright (C) Jeremy R. Allison 1995-2003.
6 * Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
7 * Copyright (C) Paul Ashton 1997-1998.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "librpc/gen_ndr/ndr_security.h"
25 #include "libcli/security/security.h"
26
27 #define ALL_SECURITY_INFORMATION (SECINFO_OWNER|SECINFO_GROUP|\
28 SECINFO_DACL|SECINFO_SACL|\
29 SECINFO_UNPROTECTED_SACL|\
30 SECINFO_UNPROTECTED_DACL|\
31 SECINFO_PROTECTED_SACL|\
32 SECINFO_PROTECTED_DACL)
33
34 /* Map generic permissions to file object specific permissions */
35
36 const struct generic_mapping file_generic_mapping = {
37 FILE_GENERIC_READ,
38 FILE_GENERIC_WRITE,
39 FILE_GENERIC_EXECUTE,
40 FILE_GENERIC_ALL
41 };
42
43 /*******************************************************************
44 Given a security_descriptor return the sec_info.
45 ********************************************************************/
46
47 uint32_t get_sec_info(const struct security_descriptor *sd)
48 {
49 uint32_t sec_info = ALL_SECURITY_INFORMATION;
50
51 SMB_ASSERT(sd);
52
53 if (sd->owner_sid == NULL) {
54 sec_info &= ~SECINFO_OWNER;
55 }
56 if (sd->group_sid == NULL) {
57 sec_info &= ~SECINFO_GROUP;
58 }
59 if (sd->sacl == NULL) {
60 sec_info &= ~SECINFO_SACL;
61 }
62 if (sd->dacl == NULL) {
63 sec_info &= ~SECINFO_DACL;
64 }
65
66 return sec_info;
67 }
68
69
70 /*******************************************************************
71 Merge part of security descriptor old_sec in to the empty sections of
72 security descriptor new_sec.
73 ********************************************************************/
74
75 struct sec_desc_buf *sec_desc_merge_buf(TALLOC_CTX *ctx, struct sec_desc_buf *new_sdb, struct sec_desc_buf *old_sdb)
76 {
77 struct dom_sid *owner_sid, *group_sid;
78 struct sec_desc_buf *return_sdb;
79 struct security_acl *dacl, *sacl;
80 struct security_descriptor *psd = NULL;
81 uint16_t secdesc_type;
82 size_t secdesc_size;
83
84 /* Copy over owner and group sids. There seems to be no flag for
85 this so just check the pointer values. */
86
87 owner_sid = new_sdb->sd->owner_sid ? new_sdb->sd->owner_sid :
88 old_sdb->sd->owner_sid;
89
90 group_sid = new_sdb->sd->group_sid ? new_sdb->sd->group_sid :
91 old_sdb->sd->group_sid;
92
93 secdesc_type = new_sdb->sd->type;
94
95 /* Ignore changes to the system ACL. This has the effect of making
96 changes through the security tab audit button not sticking.
97 Perhaps in future Samba could implement these settings somehow. */
98
99 sacl = NULL;
100 secdesc_type &= ~SEC_DESC_SACL_PRESENT;
101
102 /* Copy across discretionary ACL */
103
104 if (secdesc_type & SEC_DESC_DACL_PRESENT) {
105 dacl = new_sdb->sd->dacl;
106 } else {
107 dacl = old_sdb->sd->dacl;
108 }
109
110 /* Create new security descriptor from bits */
111
112 psd = make_sec_desc(ctx, new_sdb->sd->revision, secdesc_type,
113 owner_sid, group_sid, sacl, dacl, &secdesc_size);
114
115 return_sdb = make_sec_desc_buf(ctx, secdesc_size, psd);
116
117 return(return_sdb);
118 }
119
120 struct security_descriptor *sec_desc_merge(TALLOC_CTX *ctx, struct security_descriptor *new_sdb, struct security_descriptor *old_sdb)
121 {
122 struct dom_sid *owner_sid, *group_sid;
123 struct security_acl *dacl, *sacl;
124 struct security_descriptor *psd = NULL;
125 uint16_t secdesc_type;
126 size_t secdesc_size;
127
128 /* Copy over owner and group sids. There seems to be no flag for
129 this so just check the pointer values. */
130
131 owner_sid = new_sdb->owner_sid ? new_sdb->owner_sid :
132 old_sdb->owner_sid;
133
134 group_sid = new_sdb->group_sid ? new_sdb->group_sid :
135 old_sdb->group_sid;
136
137 secdesc_type = new_sdb->type;
138
139 /* Ignore changes to the system ACL. This has the effect of making
140 changes through the security tab audit button not sticking.
141 Perhaps in future Samba could implement these settings somehow. */
142
143 sacl = NULL;
144 secdesc_type &= ~SEC_DESC_SACL_PRESENT;
145
146 /* Copy across discretionary ACL */
147
148 if (secdesc_type & SEC_DESC_DACL_PRESENT) {
149 dacl = new_sdb->dacl;
150 } else {
151 dacl = old_sdb->dacl;
152 }
153
154 /* Create new security descriptor from bits */
155 psd = make_sec_desc(ctx, new_sdb->revision, secdesc_type,
156 owner_sid, group_sid, sacl, dacl, &secdesc_size);
157
158 return psd;
159 }
160
161 /*******************************************************************
162 Creates a struct security_descriptor structure
163 ********************************************************************/
164
165 #define SEC_DESC_HEADER_SIZE (2 * sizeof(uint16_t) + 4 * sizeof(uint32_t))
166
167 struct security_descriptor *make_sec_desc(TALLOC_CTX *ctx,
168 enum security_descriptor_revision revision,
169 uint16_t type,
170 const struct dom_sid *owner_sid, const struct dom_sid *grp_sid,
171 struct security_acl *sacl, struct security_acl *dacl, size_t *sd_size)
172 {
173 struct security_descriptor *dst;
174 uint32_t offset = 0;
175
176 if (sd_size != NULL) {
177 *sd_size = 0;
178 }
179
180 if(( dst = talloc_zero(ctx, struct security_descriptor)) == NULL)
181 return NULL;
182
183 dst->revision = revision;
184 dst->type = type;
185
186 if (sacl)
187 dst->type |= SEC_DESC_SACL_PRESENT;
188 if (dacl)
189 dst->type |= SEC_DESC_DACL_PRESENT;
190
191 dst->owner_sid = NULL;
192 dst->group_sid = NULL;
193 dst->sacl = NULL;
194 dst->dacl = NULL;
195
196 if(owner_sid && ((dst->owner_sid = dom_sid_dup(dst,owner_sid)) == NULL))
197 goto error_exit;
198
199 if(grp_sid && ((dst->group_sid = dom_sid_dup(dst,grp_sid)) == NULL))
200 goto error_exit;
201
202 if(sacl && ((dst->sacl = dup_sec_acl(dst, sacl)) == NULL))
203 goto error_exit;
204
205 if(dacl && ((dst->dacl = dup_sec_acl(dst, dacl)) == NULL))
206 goto error_exit;
207
208 if (sd_size == NULL) {
209 return dst;
210 }
211
212 offset = SEC_DESC_HEADER_SIZE;
213
214 /*
215 * Work out the linearization sizes.
216 */
217
218 if (dst->sacl != NULL) {
219 offset += dst->sacl->size;
220 }
221 if (dst->dacl != NULL) {
222 offset += dst->dacl->size;
223 }
224
225 if (dst->owner_sid != NULL) {
226 offset += ndr_size_dom_sid(dst->owner_sid, 0);
227 }
228
229 if (dst->group_sid != NULL) {
230 offset += ndr_size_dom_sid(dst->group_sid, 0);
231 }
232
233 *sd_size = (size_t)offset;
234 return dst;
235
236 error_exit:
237
238 if (sd_size != NULL) {
239 *sd_size = 0;
240 }
241 return NULL;
242 }
243
244 /*******************************************************************
245 Duplicate a struct security_descriptor structure.
246 ********************************************************************/
247
248 struct security_descriptor *dup_sec_desc(TALLOC_CTX *ctx, const struct security_descriptor *src)
249 {
250 size_t dummy;
251
252 if(src == NULL)
253 return NULL;
254
255 return make_sec_desc( ctx, src->revision, src->type,
256 src->owner_sid, src->group_sid, src->sacl,
257 src->dacl, &dummy);
258 }
259
260 /*******************************************************************
261 Convert a secdesc into a byte stream
262 ********************************************************************/
263 NTSTATUS marshall_sec_desc(TALLOC_CTX *mem_ctx,
264 const struct security_descriptor *secdesc,
265 uint8_t **data, size_t *len)
266 {
267 DATA_BLOB blob;
268 enum ndr_err_code ndr_err;
269
270 ndr_err = ndr_push_struct_blob(
271 &blob, mem_ctx, secdesc,
272 (ndr_push_flags_fn_t)ndr_push_security_descriptor);
273
274 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
275 DEBUG(0, ("ndr_push_security_descriptor failed: %s\n",
276 ndr_errstr(ndr_err)));
277 return ndr_map_error2ntstatus(ndr_err);
278 }
279
280 *data = blob.data;
281 *len = blob.length;
282 return NT_STATUS_OK;
283 }
284
285 /*******************************************************************
286 Convert a secdesc_buf into a byte stream
287 ********************************************************************/
288
289 NTSTATUS marshall_sec_desc_buf(TALLOC_CTX *mem_ctx,
290 const struct sec_desc_buf *secdesc_buf,
291 uint8_t **data, size_t *len)
292 {
293 DATA_BLOB blob;
294 enum ndr_err_code ndr_err;
295
296 ndr_err = ndr_push_struct_blob(
297 &blob, mem_ctx, secdesc_buf,
298 (ndr_push_flags_fn_t)ndr_push_sec_desc_buf);
299
300 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
301 DEBUG(0, ("ndr_push_sec_desc_buf failed: %s\n",
302 ndr_errstr(ndr_err)));
303 return ndr_map_error2ntstatus(ndr_err);
304 }
305
306 *data = blob.data;
307 *len = blob.length;
308 return NT_STATUS_OK;
309 }
310
311 /*******************************************************************
312 Parse a byte stream into a secdesc
313 ********************************************************************/
314 NTSTATUS unmarshall_sec_desc(TALLOC_CTX *mem_ctx, uint8_t *data, size_t len,
315 struct security_descriptor **psecdesc)
316 {
317 DATA_BLOB blob;
318 enum ndr_err_code ndr_err;
319 struct security_descriptor *result;
320
321 if ((data == NULL) || (len == 0)) {
322 return NT_STATUS_INVALID_PARAMETER;
323 }
324
325 result = talloc_zero(mem_ctx, struct security_descriptor);
326 if (result == NULL) {
327 return NT_STATUS_NO_MEMORY;
328 }
329
330 blob = data_blob_const(data, len);
331
332 ndr_err = ndr_pull_struct_blob(&blob, result, result,
333 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
334
335 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
336 DEBUG(0, ("ndr_pull_security_descriptor failed: %s\n",
337 ndr_errstr(ndr_err)));
338 TALLOC_FREE(result);
339 return ndr_map_error2ntstatus(ndr_err);
340 }
341
342 *psecdesc = result;
343 return NT_STATUS_OK;
344 }
345
346 /*******************************************************************
347 Parse a byte stream into a sec_desc_buf
348 ********************************************************************/
349
350 NTSTATUS unmarshall_sec_desc_buf(TALLOC_CTX *mem_ctx, uint8_t *data, size_t len,
351 struct sec_desc_buf **psecdesc_buf)
352 {
353 DATA_BLOB blob;
354 enum ndr_err_code ndr_err;
355 struct sec_desc_buf *result;
356
357 if ((data == NULL) || (len == 0)) {
358 return NT_STATUS_INVALID_PARAMETER;
359 }
360
361 result = talloc_zero(mem_ctx, struct sec_desc_buf);
362 if (result == NULL) {
363 return NT_STATUS_NO_MEMORY;
364 }
365
366 blob = data_blob_const(data, len);
367
368 ndr_err = ndr_pull_struct_blob(&blob, result, result,
369 (ndr_pull_flags_fn_t)ndr_pull_sec_desc_buf);
370
371 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
372 DEBUG(0, ("ndr_pull_sec_desc_buf failed: %s\n",
373 ndr_errstr(ndr_err)));
374 TALLOC_FREE(result);
375 return ndr_map_error2ntstatus(ndr_err);
376 }
377
378 *psecdesc_buf = result;
379 return NT_STATUS_OK;
380 }
381
382 /*******************************************************************
383 Creates a struct security_descriptor structure with typical defaults.
384 ********************************************************************/
385
386 struct security_descriptor *make_standard_sec_desc(TALLOC_CTX *ctx, const struct dom_sid *owner_sid, const struct dom_sid *grp_sid,
387 struct security_acl *dacl, size_t *sd_size)
388 {
389 return make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
390 SEC_DESC_SELF_RELATIVE, owner_sid, grp_sid, NULL,
391 dacl, sd_size);
392 }
393
394 /*******************************************************************
395 Creates a struct sec_desc_buf structure.
396 ********************************************************************/
397
398 struct sec_desc_buf *make_sec_desc_buf(TALLOC_CTX *ctx, size_t len, struct security_descriptor *sec_desc)
399 {
400 struct sec_desc_buf *dst;
401
402 if((dst = talloc_zero(ctx, struct sec_desc_buf)) == NULL)
403 return NULL;
404
405 /* max buffer size (allocated size) */
406 dst->sd_size = (uint32_t)len;
407
408 if(sec_desc && ((dst->sd = dup_sec_desc(ctx, sec_desc)) == NULL)) {
409 return NULL;
410 }
411
412 return dst;
413 }
414
415 /*******************************************************************
416 Duplicates a struct sec_desc_buf structure.
417 ********************************************************************/
418
419 struct sec_desc_buf *dup_sec_desc_buf(TALLOC_CTX *ctx, struct sec_desc_buf *src)
420 {
421 if(src == NULL)
422 return NULL;
423
424 return make_sec_desc_buf( ctx, src->sd_size, src->sd);
425 }
426
427 /*******************************************************************
428 Add a new SID with its permissions to struct security_descriptor.
429 ********************************************************************/
430
431 NTSTATUS sec_desc_add_sid(TALLOC_CTX *ctx, struct security_descriptor **psd, const struct dom_sid *sid, uint32_t mask, size_t *sd_size)
432 {
433 struct security_descriptor *sd = 0;
434 struct security_acl *dacl = 0;
435 struct security_ace *ace = 0;
436 NTSTATUS status;
437
438 if (!ctx || !psd || !sid || !sd_size)
439 return NT_STATUS_INVALID_PARAMETER;
440
441 *sd_size = 0;
442
443 status = sec_ace_add_sid(ctx, &ace, psd[0]->dacl->aces, &psd[0]->dacl->num_aces, sid, mask);
444
445 if (!NT_STATUS_IS_OK(status))
446 return status;
447
448 if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace)))
449 return NT_STATUS_UNSUCCESSFUL;
450
451 if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid,
452 psd[0]->group_sid, psd[0]->sacl, dacl, sd_size)))
453 return NT_STATUS_UNSUCCESSFUL;
454
455 *psd = sd;
456 sd = 0;
457 return NT_STATUS_OK;
458 }
459
460 /*******************************************************************
461 Modify a SID's permissions in a struct security_descriptor.
462 ********************************************************************/
463
464 NTSTATUS sec_desc_mod_sid(struct security_descriptor *sd, struct dom_sid *sid, uint32_t mask)
465 {
466 NTSTATUS status;
467
468 if (!sd || !sid)
469 return NT_STATUS_INVALID_PARAMETER;
470
471 status = sec_ace_mod_sid(sd->dacl->aces, sd->dacl->num_aces, sid, mask);
472
473 if (!NT_STATUS_IS_OK(status))
474 return status;
475
476 return NT_STATUS_OK;
477 }
478
479 /*******************************************************************
480 Delete a SID from a struct security_descriptor.
481 ********************************************************************/
482
483 NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, struct security_descriptor **psd, struct dom_sid *sid, size_t *sd_size)
484 {
485 struct security_descriptor *sd = 0;
486 struct security_acl *dacl = 0;
487 struct security_ace *ace = 0;
488 NTSTATUS status;
489
490 if (!ctx || !psd[0] || !sid || !sd_size)
491 return NT_STATUS_INVALID_PARAMETER;
492
493 *sd_size = 0;
494
495 status = sec_ace_del_sid(ctx, &ace, psd[0]->dacl->aces, &psd[0]->dacl->num_aces, sid);
496
497 if (!NT_STATUS_IS_OK(status))
498 return status;
499
500 if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace)))
501 return NT_STATUS_UNSUCCESSFUL;
502
503 if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid,
504 psd[0]->group_sid, psd[0]->sacl, dacl, sd_size)))
505 return NT_STATUS_UNSUCCESSFUL;
506
507 *psd = sd;
508 sd = 0;
509 return NT_STATUS_OK;
510 }
511
512 /*
513 * Determine if an struct security_ace is inheritable
514 */
515
516 static bool is_inheritable_ace(const struct security_ace *ace,
517 bool container)
518 {
519 if (!container) {
520 return ((ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) != 0);
521 }
522
523 if (ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
524 return true;
525 }
526
527 if ((ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) &&
528 !(ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
529 return true;
530 }
531
532 return false;
533 }
534
535 /*
536 * Does a security descriptor have any inheritable components for
537 * the newly created type ?
538 */
539
540 bool sd_has_inheritable_components(const struct security_descriptor *parent_ctr, bool container)
541 {
542 unsigned int i;
543 const struct security_acl *the_acl = parent_ctr->dacl;
544
545 if (the_acl == NULL) {
546 return false;
547 }
548
549 for (i = 0; i < the_acl->num_aces; i++) {
550 const struct security_ace *ace = &the_acl->aces[i];
551
552 if (is_inheritable_ace(ace, container)) {
553 return true;
554 }
555 }
556 return false;
557 }
558
559 /* Create a child security descriptor using another security descriptor as
560 the parent container. This child object can either be a container or
561 non-container object. */
562
563 NTSTATUS se_create_child_secdesc(TALLOC_CTX *ctx,
564 struct security_descriptor **ppsd,
565 size_t *psize,
566 const struct security_descriptor *parent_ctr,
567 const struct dom_sid *owner_sid,
568 const struct dom_sid *group_sid,
569 bool container)
570 {
571 struct security_acl *new_dacl = NULL, *the_acl = NULL;
572 struct security_ace *new_ace_list = NULL;
573 unsigned int new_ace_list_ndx = 0, i;
574 bool set_inherited_flags = (parent_ctr->type & SEC_DESC_DACL_AUTO_INHERITED);
575
576 TALLOC_CTX *frame;
577
578 *ppsd = NULL;
579 *psize = 0;
580
581 /* Currently we only process the dacl when creating the child. The
582 sacl should also be processed but this is left out as sacls are
583 not implemented in Samba at the moment.*/
584
585 the_acl = parent_ctr->dacl;
586
587 if (the_acl->num_aces) {
588 if (2*the_acl->num_aces < the_acl->num_aces) {
589 return NT_STATUS_NO_MEMORY;
590 }
591
592 if (!(new_ace_list = talloc_array(ctx, struct security_ace,
593 2*the_acl->num_aces))) {
594 return NT_STATUS_NO_MEMORY;
595 }
596 } else {
597 new_ace_list = NULL;
598 }
599
600 frame = talloc_stackframe();
601
602 for (i = 0; i < the_acl->num_aces; i++) {
603 const struct security_ace *ace = &the_acl->aces[i];
604 struct security_ace *new_ace = &new_ace_list[new_ace_list_ndx];
605 const struct dom_sid *ptrustee = &ace->trustee;
606 const struct dom_sid *creator = NULL;
607 uint8_t new_flags = ace->flags;
608
609 if (!is_inheritable_ace(ace, container)) {
610 continue;
611 }
612
613 /* see the RAW-ACLS inheritance test for details on these rules */
614 if (!container) {
615 new_flags = 0;
616 } else {
617 /*
618 * We need to remove SEC_ACE_FLAG_INHERITED_ACE here
619 * if present because it should only be set if the
620 * parent has the AUTO_INHERITED bit set in the
621 * type/control field. If we don't it will slip through
622 * and create DACLs with incorrectly ordered ACEs
623 * when there are CREATOR_OWNER or CREATOR_GROUP
624 * ACEs.
625 */
626 new_flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY
627 | SEC_ACE_FLAG_INHERITED_ACE);
628
629 if (!(new_flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
630 new_flags |= SEC_ACE_FLAG_INHERIT_ONLY;
631 }
632 if (new_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
633 new_flags = 0;
634 }
635 }
636
637 /* The CREATOR sids are special when inherited */
638 if (dom_sid_equal(ptrustee, &global_sid_Creator_Owner)) {
639 creator = &global_sid_Creator_Owner;
640 ptrustee = owner_sid;
641 } else if (dom_sid_equal(ptrustee, &global_sid_Creator_Group)) {
642 creator = &global_sid_Creator_Group;
643 ptrustee = group_sid;
644 }
645
646 if (creator && container &&
647 (new_flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
648
649 /* First add the regular ACE entry. */
650 init_sec_ace(new_ace, ptrustee, ace->type,
651 ace->access_mask,
652 set_inherited_flags ? SEC_ACE_FLAG_INHERITED_ACE : 0);
653
654 DEBUG(5,("se_create_child_secdesc(): %s:%d/0x%02x/0x%08x"
655 " inherited as %s:%d/0x%02x/0x%08x\n",
656 dom_sid_string(frame, &ace->trustee),
657 ace->type, ace->flags, ace->access_mask,
658 dom_sid_string(frame, &new_ace->trustee),
659 new_ace->type, new_ace->flags,
660 new_ace->access_mask));
661
662 new_ace_list_ndx++;
663
664 /* Now add the extra creator ACE. */
665 new_ace = &new_ace_list[new_ace_list_ndx];
666
667 ptrustee = creator;
668 new_flags |= SEC_ACE_FLAG_INHERIT_ONLY;
669
670 } else if (container &&
671 !(ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
672 ptrustee = &ace->trustee;
673 }
674
675 init_sec_ace(new_ace, ptrustee, ace->type,
676 ace->access_mask, new_flags |
677 (set_inherited_flags ? SEC_ACE_FLAG_INHERITED_ACE : 0));
678
679 DEBUG(5, ("se_create_child_secdesc(): %s:%d/0x%02x/0x%08x "
680 " inherited as %s:%d/0x%02x/0x%08x\n",
681 dom_sid_string(frame, &ace->trustee),
682 ace->type, ace->flags, ace->access_mask,
683 dom_sid_string(frame, &ace->trustee),
684 new_ace->type, new_ace->flags,
685 new_ace->access_mask));
686
687 new_ace_list_ndx++;
688 }
689
690 talloc_free(frame);
691
692 /*
693 * remove duplicates
694 */
695 for (i=1; i < new_ace_list_ndx;) {
696 struct security_ace *ai = &new_ace_list[i];
697 unsigned int remaining, j;
698 bool remove = false;
699
700 for (j=0; j < i; j++) {
701 struct security_ace *aj = &new_ace_list[j];
702
703 if (!sec_ace_equal(ai, aj)) {
704 continue;
705 }
706
707 remove = true;
708 break;
709 }
710
711 if (!remove) {
712 i++;
713 continue;
714 }
715
716 new_ace_list_ndx--;
717 remaining = new_ace_list_ndx - i;
718 if (remaining == 0) {
719 ZERO_STRUCT(new_ace_list[i]);
720 continue;
721 }
722 memmove(&new_ace_list[i], &new_ace_list[i+1],
723 sizeof(new_ace_list[i]) * remaining);
724 }
725
726 /* Create child security descriptor to return */
727 if (new_ace_list_ndx) {
728 new_dacl = make_sec_acl(ctx,
729 NT4_ACL_REVISION,
730 new_ace_list_ndx,
731 new_ace_list);
732
733 if (!new_dacl) {
734 return NT_STATUS_NO_MEMORY;
735 }
736 }
737
738 *ppsd = make_sec_desc(ctx,
739 SECURITY_DESCRIPTOR_REVISION_1,
740 SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT|
741 (set_inherited_flags ? SEC_DESC_DACL_AUTO_INHERITED : 0),
742 owner_sid,
743 group_sid,
744 NULL,
745 new_dacl,
746 psize);
747 if (!*ppsd) {
748 return NT_STATUS_NO_MEMORY;
749 }
750 return NT_STATUS_OK;
751 }
752
753 NTSTATUS se_create_child_secdesc_buf(TALLOC_CTX *ctx,
754 struct sec_desc_buf **ppsdb,
755 const struct security_descriptor *parent_ctr,
756 bool container)
757 {
758 NTSTATUS status;
759 size_t size = 0;
760 struct security_descriptor *sd = NULL;
761
762 *ppsdb = NULL;
763 status = se_create_child_secdesc(ctx,
764 &sd,
765 &size,
766 parent_ctr,
767 parent_ctr->owner_sid,
768 parent_ctr->group_sid,
769 container);
770 if (!NT_STATUS_IS_OK(status)) {
771 return status;
772 }
773
774 *ppsdb = make_sec_desc_buf(ctx, size, sd);
775 if (!*ppsdb) {
776 return NT_STATUS_NO_MEMORY;
777 }
778 return NT_STATUS_OK;
779 }
Samba GIT mirror