2 Unix SMB/CIFS implementation.
3 Samba utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
6 Copyright (C) Jeremy Allison 1999
7 Copyright (C) Stefan (metze) Metzmacher 2002
8 Copyright (C) Simo Sorce 2002
9 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
10 Copyright (C) Andrew Bartlett 2010
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "../librpc/gen_ndr/ndr_security.h"
28 #include "../librpc/gen_ndr/netlogon.h"
29 #include "../libcli/security/security.h"
32 * Some useful sids, more well known sids can be found at
33 * http://support.microsoft.com/kb/243330/EN-US/
38 const struct dom_sid global_sid_World_Domain
= /* Everyone domain */
39 { 1, 0, {0,0,0,0,0,1}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
41 const struct dom_sid global_sid_World
= /* Everyone */
42 { 1, 1, {0,0,0,0,0,1}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
44 const struct dom_sid global_sid_Local_Authority
= /* Local Authority */
45 { 1, 0, {0,0,0,0,0,2}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
47 const struct dom_sid global_sid_Creator_Owner_Domain
= /* Creator Owner domain */
48 { 1, 0, {0,0,0,0,0,3}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
50 const struct dom_sid global_sid_NT_Authority
= /* NT Authority */
51 { 1, 0, {0,0,0,0,0,5}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
53 const struct dom_sid global_sid_System
= /* System */
54 { 1, 1, {0,0,0,0,0,5}, {18,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
56 const struct dom_sid global_sid_NULL
= /* NULL sid */
57 { 1, 1, {0,0,0,0,0,0}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
59 const struct dom_sid global_sid_Authenticated_Users
= /* All authenticated rids */
60 { 1, 1, {0,0,0,0,0,5}, {11,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
62 /* for documentation S-1-5-12 */
63 const struct dom_sid global_sid_Restriced
= /* Restriced Code */
64 { 1, 1, {0,0,0,0,0,5}, {12,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
68 const struct dom_sid global_sid_Asserted_Identity
= /* Asserted Identity */
69 { 1, 0, {0,0,0,0,0,18}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
71 const struct dom_sid global_sid_Asserted_Identity_Service
= /* Asserted Identity Service */
72 { 1, 1, {0,0,0,0,0,18}, {1,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
74 const struct dom_sid global_sid_Asserted_Identity_Authentication_Authority
= /* Asserted Identity Authentication Authority */
75 { 1, 1, {0,0,0,0,0,18}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
78 const struct dom_sid global_sid_Network
= /* Network rids */
79 { 1, 1, {0,0,0,0,0,5}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
82 const struct dom_sid global_sid_Creator_Owner
= /* Creator Owner */
83 { 1, 1, {0,0,0,0,0,3}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
85 const struct dom_sid global_sid_Creator_Group
= /* Creator Group */
86 { 1, 1, {0,0,0,0,0,3}, {1,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
88 const struct dom_sid global_sid_Owner_Rights
= /* Owner Rights */
89 { 1, 1, {0,0,0,0,0,3}, {4,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
91 const struct dom_sid global_sid_Anonymous
= /* Anonymous login */
92 { 1, 1, {0,0,0,0,0,5}, {7,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
94 const struct dom_sid global_sid_Enterprise_DCs
= /* Enterprise DCs */
95 { 1, 1, {0,0,0,0,0,5}, {9,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
97 const struct dom_sid global_sid_Builtin
= /* Local well-known domain */
98 { 1, 1, {0,0,0,0,0,5}, {32,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
100 const struct dom_sid global_sid_Builtin_Administrators
= /* Builtin administrators */
101 { 1, 2, {0,0,0,0,0,5}, {32,544,0,0,0,0,0,0,0,0,0,0,0,0,0}};
103 const struct dom_sid global_sid_Builtin_Users
= /* Builtin users */
104 { 1, 2, {0,0,0,0,0,5}, {32,545,0,0,0,0,0,0,0,0,0,0,0,0,0}};
106 const struct dom_sid global_sid_Builtin_Guests
= /* Builtin guest users */
107 { 1, 2, {0,0,0,0,0,5}, {32,546,0,0,0,0,0,0,0,0,0,0,0,0,0}};
109 const struct dom_sid global_sid_Builtin_Power_Users
= /* Builtin power users */
110 { 1, 2, {0,0,0,0,0,5}, {32,547,0,0,0,0,0,0,0,0,0,0,0,0,0}};
112 const struct dom_sid global_sid_Builtin_Account_Operators
= /* Builtin account operators */
113 { 1, 2, {0,0,0,0,0,5}, {32,548,0,0,0,0,0,0,0,0,0,0,0,0,0}};
115 const struct dom_sid global_sid_Builtin_Server_Operators
= /* Builtin server operators */
116 { 1, 2, {0,0,0,0,0,5}, {32,549,0,0,0,0,0,0,0,0,0,0,0,0,0}};
118 const struct dom_sid global_sid_Builtin_Print_Operators
= /* Builtin print operators */
119 { 1, 2, {0,0,0,0,0,5}, {32,550,0,0,0,0,0,0,0,0,0,0,0,0,0}};
121 const struct dom_sid global_sid_Builtin_Backup_Operators
= /* Builtin backup operators */
122 { 1, 2, {0,0,0,0,0,5}, {32,551,0,0,0,0,0,0,0,0,0,0,0,0,0}};
124 const struct dom_sid global_sid_Builtin_Replicator
= /* Builtin replicator */
125 { 1, 2, {0,0,0,0,0,5}, {32,552,0,0,0,0,0,0,0,0,0,0,0,0,0}};
127 const struct dom_sid global_sid_Builtin_PreWin2kAccess
= /* Builtin pre win2k access */
128 { 1, 2, {0,0,0,0,0,5}, {32,554,0,0,0,0,0,0,0,0,0,0,0,0,0}};
131 const struct dom_sid global_sid_Unix_Users
= /* Unmapped Unix users */
132 { 1, 1, {0,0,0,0,0,22}, {1,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
134 const struct dom_sid global_sid_Unix_Groups
= /* Unmapped Unix groups */
135 { 1, 1, {0,0,0,0,0,22}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
138 * http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx
141 const struct dom_sid global_sid_Unix_NFS
= /* MS NFS and Apple style */
142 { 1, 1, {0,0,0,0,0,5}, {88,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
144 const struct dom_sid global_sid_Unix_NFS_Users
= /* Unix uid, MS NFS and Apple style */
145 { 1, 2, {0,0,0,0,0,5}, {88,1,0,0,0,0,0,0,0,0,0,0,0,0,0}};
147 const struct dom_sid global_sid_Unix_NFS_Groups
= /* Unix gid, MS NFS and Apple style */
148 { 1, 2, {0,0,0,0,0,5}, {88,2,0,0,0,0,0,0,0,0,0,0,0,0,0}};
150 const struct dom_sid global_sid_Unix_NFS_Mode
= /* Unix mode */
151 { 1, 2, {0,0,0,0,0,5}, {88,3,0,0,0,0,0,0,0,0,0,0,0,0,0}};
152 /* Unused, left here for documentary purposes */
154 const struct dom_sid global_sid_Unix_NFS_Other
= /* Unix other, MS NFS and Apple style */
155 { 1, 2, {0,0,0,0,0,5}, {88,4,0,0,0,0,0,0,0,0,0,0,0,0,0}};
158 /* Unused, left here for documentary purposes */
160 #define SECURITY_NULL_SID_AUTHORITY 0
161 #define SECURITY_WORLD_SID_AUTHORITY 1
162 #define SECURITY_LOCAL_SID_AUTHORITY 2
163 #define SECURITY_CREATOR_SID_AUTHORITY 3
164 #define SECURITY_NT_AUTHORITY 5
167 static struct dom_sid system_sid_array
[1] =
168 { { 1, 1, {0,0,0,0,0,5}, {18,0,0,0,0,0,0,0,0,0,0,0,0,0,0}} };
169 static const struct security_token system_token
= {
170 .num_sids
= ARRAY_SIZE(system_sid_array
),
171 .sids
= system_sid_array
,
172 .privilege_mask
= SE_ALL_PRIVS
175 /****************************************************************************
176 Lookup string names for SID types.
177 ****************************************************************************/
179 static const struct {
180 enum lsa_SidType sid_type
;
182 } sid_name_type
[] = {
183 {SID_NAME_USE_NONE
, "None"},
184 {SID_NAME_USER
, "User"},
185 {SID_NAME_DOM_GRP
, "Domain Group"},
186 {SID_NAME_DOMAIN
, "Domain"},
187 {SID_NAME_ALIAS
, "Local Group"},
188 {SID_NAME_WKN_GRP
, "Well-known Group"},
189 {SID_NAME_DELETED
, "Deleted Account"},
190 {SID_NAME_INVALID
, "Invalid Account"},
191 {SID_NAME_UNKNOWN
, "UNKNOWN"},
192 {SID_NAME_COMPUTER
, "Computer"},
193 {SID_NAME_LABEL
, "Mandatory Label"}
196 const char *sid_type_lookup(uint32_t sid_type
)
200 /* Look through list */
201 for (i
=0; i
< ARRAY_SIZE(sid_name_type
); i
++) {
202 if (sid_name_type
[i
].sid_type
== sid_type
) {
203 return sid_name_type
[i
].string
;
208 return "SID *TYPE* is INVALID";
211 /**************************************************************************
212 Create the SYSTEM token.
213 ***************************************************************************/
215 const struct security_token
*get_system_token(void)
217 return &system_token
;
220 bool sid_compose(struct dom_sid
*dst
, const struct dom_sid
*domain_sid
, uint32_t rid
)
222 sid_copy(dst
, domain_sid
);
223 return sid_append_rid(dst
, rid
);
226 /*****************************************************************
227 Removes the last rid from the end of a sid
228 *****************************************************************/
230 bool sid_split_rid(struct dom_sid
*sid
, uint32_t *rid
)
232 if (sid
->num_auths
> 0) {
235 *rid
= sid
->sub_auths
[sid
->num_auths
];
242 /*****************************************************************
243 Return the last rid from the end of a sid
244 *****************************************************************/
246 bool sid_peek_rid(const struct dom_sid
*sid
, uint32_t *rid
)
251 if (sid
->num_auths
> 0) {
252 *rid
= sid
->sub_auths
[sid
->num_auths
- 1];
258 /*****************************************************************
259 Return the last rid from the end of a sid
260 and check the sid against the exp_dom_sid
261 *****************************************************************/
263 bool sid_peek_check_rid(const struct dom_sid
*exp_dom_sid
, const struct dom_sid
*sid
, uint32_t *rid
)
265 if (!exp_dom_sid
|| !sid
|| !rid
)
268 if (sid
->num_auths
!= (exp_dom_sid
->num_auths
+1)) {
272 if (sid_compare_domain(exp_dom_sid
, sid
)!=0){
277 return sid_peek_rid(sid
, rid
);
280 /*****************************************************************
282 *****************************************************************/
284 void sid_copy(struct dom_sid
*dst
, const struct dom_sid
*src
)
288 *dst
= (struct dom_sid
) {
289 .sid_rev_num
= src
->sid_rev_num
,
290 .num_auths
= src
->num_auths
,
293 memcpy(&dst
->id_auth
[0], &src
->id_auth
[0], sizeof(src
->id_auth
));
295 for (i
= 0; i
< src
->num_auths
; i
++)
296 dst
->sub_auths
[i
] = src
->sub_auths
[i
];
299 /*****************************************************************
300 Parse a on-the-wire SID to a struct dom_sid.
301 *****************************************************************/
303 bool sid_parse(const uint8_t *inbuf
, size_t len
, struct dom_sid
*sid
)
305 DATA_BLOB in
= data_blob_const(inbuf
, len
);
306 enum ndr_err_code ndr_err
;
308 ndr_err
= ndr_pull_struct_blob_all(
309 &in
, NULL
, sid
, (ndr_pull_flags_fn_t
)ndr_pull_dom_sid
);
310 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
316 /*****************************************************************
317 See if 2 SIDs are in the same domain
318 this just compares the leading sub-auths
319 *****************************************************************/
321 int sid_compare_domain(const struct dom_sid
*sid1
, const struct dom_sid
*sid2
)
325 n
= MIN(sid1
->num_auths
, sid2
->num_auths
);
327 for (i
= n
-1; i
>= 0; --i
)
328 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
329 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
331 return dom_sid_compare_auth(sid1
, sid2
);
334 /********************************************************************
335 Add SID to an array SIDs
336 ********************************************************************/
338 NTSTATUS
add_sid_to_array(TALLOC_CTX
*mem_ctx
, const struct dom_sid
*sid
,
339 struct dom_sid
**sids
, uint32_t *num
)
343 if ((*num
) == UINT32_MAX
) {
344 return NT_STATUS_INTEGER_OVERFLOW
;
347 tmp
= talloc_realloc(mem_ctx
, *sids
, struct dom_sid
, (*num
)+1);
350 return NT_STATUS_NO_MEMORY
;
354 sid_copy(&((*sids
)[*num
]), sid
);
361 /********************************************************************
362 Add SID to an array SIDs ensuring that it is not already there
363 ********************************************************************/
365 NTSTATUS
add_sid_to_array_unique(TALLOC_CTX
*mem_ctx
, const struct dom_sid
*sid
,
366 struct dom_sid
**sids
, uint32_t *num_sids
)
370 for (i
=0; i
<(*num_sids
); i
++) {
371 if (dom_sid_equal(sid
, &(*sids
)[i
])) {
376 return add_sid_to_array(mem_ctx
, sid
, sids
, num_sids
);
379 /********************************************************************
380 Remove SID from an array
381 ********************************************************************/
383 void del_sid_from_array(const struct dom_sid
*sid
, struct dom_sid
**sids
,
386 struct dom_sid
*sid_list
= *sids
;
389 for ( i
=0; i
<*num
; i
++ ) {
391 /* if we find the SID, then decrement the count
392 and break out of the loop */
394 if (dom_sid_equal(sid
, &sid_list
[i
])) {
400 /* This loop will copy the remainder of the array
401 if i < num of sids in the array */
403 for ( ; i
<*num
; i
++ ) {
404 sid_copy( &sid_list
[i
], &sid_list
[i
+1] );
410 bool add_rid_to_array_unique(TALLOC_CTX
*mem_ctx
,
411 uint32_t rid
, uint32_t **pp_rids
, size_t *p_num
)
415 for (i
=0; i
<*p_num
; i
++) {
416 if ((*pp_rids
)[i
] == rid
)
420 *pp_rids
= talloc_realloc(mem_ctx
, *pp_rids
, uint32_t, *p_num
+1);
422 if (*pp_rids
== NULL
) {
427 (*pp_rids
)[*p_num
] = rid
;
432 bool is_null_sid(const struct dom_sid
*sid
)
434 const struct dom_sid null_sid
= {0};
435 return dom_sid_equal(sid
, &null_sid
);