libgpo/gpo_util.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2005-2008
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "system/filesys.h"
  22 #include "librpc/gen_ndr/ndr_misc.h"
  23 #include "../librpc/gen_ndr/ndr_security.h"
  24 #include "../libgpo/gpo.h"
  25 #include "../libcli/security/security.h"
  26 #include "registry.h"
  27 #include "libgpo/gpo_proto.h"
  28 #include "libgpo/gpext/gpext.h"
  29
  30 #if 0
  31 #define DEFAULT_DOMAIN_POLICY "Default Domain Policy"
  32 #define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy"
  33 #endif
  34
  35 /* should we store a parsed guid ? */
  36 struct gp_table {
  37         const char *name;
  38         const char *guid_string;
  39 };
  40
  41 #if 0 /* unused */
  42 static struct gp_table gpo_default_policy[] = {
  43         { DEFAULT_DOMAIN_POLICY,
  44                 "31B2F340-016D-11D2-945F-00C04FB984F9" },
  45         { DEFAULT_DOMAIN_CONTROLLERS_POLICY,
  46                 "6AC1786C-016F-11D2-945F-00C04fB984F9" },
  47         { NULL, NULL }
  48 };
  49 #endif
  50
  51 /* the following is seen in gPCMachineExtensionNames / gPCUserExtensionNames */
  52
  53 static struct gp_table gpo_cse_extensions[] = {
  54         /* used to be "Administrative Templates Extension" */
  55         /* "Registry Settings"
  56         (http://support.microsoft.com/kb/216357/EN-US/) */
  57         { "Registry Settings",
  58                 GP_EXT_GUID_REGISTRY },
  59         { "Microsoft Disc Quota",
  60                 "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" },
  61         { "EFS recovery",
  62                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
  63         { "Folder Redirection",
  64                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
  65         { "IP Security",
  66                 "E437BC1C-AA7D-11D2-A382-00C04F991E27" },
  67         { "Internet Explorer Branding",
  68                 "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" },
  69         { "QoS Packet Scheduler",
  70                 "426031c0-0b47-4852-b0ca-ac3d37bfcb39" },
  71         { "Scripts",
  72                 GP_EXT_GUID_SCRIPTS },
  73         { "Security",
  74                 GP_EXT_GUID_SECURITY },
  75         { "Software Installation",
  76                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
  77         { "Wireless Group Policy",
  78                 "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" },
  79         { "Application Management",
  80                 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
  81         { "unknown",
  82                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
  83         { NULL, NULL }
  84 };
  85
  86 /* guess work */
  87 static struct gp_table gpo_cse_snapin_extensions[] = {
  88         { "Administrative Templates",
  89                 "0F6B957D-509E-11D1-A7CC-0000F87571E3" },
  90         { "Certificates",
  91                 "53D6AB1D-2488-11D1-A28C-00C04FB94F17" },
  92         { "EFS recovery policy processing",
  93                 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
  94         { "Folder Redirection policy processing",
  95                 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
  96         { "Folder Redirection",
  97                 "88E729D6-BDC1-11D1-BD2A-00C04FB9603F" },
  98         { "Registry policy processing",
  99                 "35378EAC-683F-11D2-A89A-00C04FBBCFA2" },
 100         { "Remote Installation Services",
 101                 "3060E8CE-7020-11D2-842D-00C04FA372D4" },
 102         { "Security Settings",
 103                 "803E14A0-B4FB-11D0-A0D0-00A0C90F574B" },
 104         { "Security policy processing",
 105                 "827D319E-6EAC-11D2-A4EA-00C04F79F83A" },
 106         { "unknown",
 107                 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
 108         { "unknown2",
 109                 "53D6AB1B-2488-11D1-A28C-00C04FB94F17" },
 110         { NULL, NULL }
 111 };
 112
 113 /****************************************************************
 114 ****************************************************************/
 115
 116 static const char *name_to_guid_string(const char *name,
 117                                        struct gp_table *table)
 118 {
 119         int i;
 120
 121         for (i = 0; table[i].name; i++) {
 122                 if (strequal(name, table[i].name)) {
 123                         return table[i].guid_string;
 124                 }
 125         }
 126
 127         return NULL;
 128 }
 129
 130 /****************************************************************
 131 ****************************************************************/
 132
 133 static const char *guid_string_to_name(const char *guid_string,
 134                                        struct gp_table *table)
 135 {
 136         int i;
 137
 138         for (i = 0; table[i].guid_string; i++) {
 139                 if (strequal(guid_string, table[i].guid_string)) {
 140                         return table[i].name;
 141                 }
 142         }
 143
 144         return NULL;
 145 }
 146
 147 /****************************************************************
 148 ****************************************************************/
 149
 150 static const char *snapin_guid_string_to_name(const char *guid_string,
 151                                               struct gp_table *table)
 152 {
 153         int i;
 154         for (i = 0; table[i].guid_string; i++) {
 155                 if (strequal(guid_string, table[i].guid_string)) {
 156                         return table[i].name;
 157                 }
 158         }
 159         return NULL;
 160 }
 161
 162 #if 0 /* unused */
 163 static const char *default_gpo_name_to_guid_string(const char *name)
 164 {
 165         return name_to_guid_string(name, gpo_default_policy);
 166 }
 167
 168 static const char *default_gpo_guid_string_to_name(const char *guid)
 169 {
 170         return guid_string_to_name(guid, gpo_default_policy);
 171 }
 172 #endif
 173
 174 /****************************************************************
 175 ****************************************************************/
 176
 177 const char *cse_gpo_guid_string_to_name(const char *guid)
 178 {
 179         return guid_string_to_name(guid, gpo_cse_extensions);
 180 }
 181
 182 /****************************************************************
 183 ****************************************************************/
 184
 185 const char *cse_gpo_name_to_guid_string(const char *name)
 186 {
 187         return name_to_guid_string(name, gpo_cse_extensions);
 188 }
 189
 190 /****************************************************************
 191 ****************************************************************/
 192
 193 const char *cse_snapin_gpo_guid_string_to_name(const char *guid)
 194 {
 195         return snapin_guid_string_to_name(guid, gpo_cse_snapin_extensions);
 196 }
 197
 198 /****************************************************************
 199 ****************************************************************/
 200
 201 void dump_gp_ext(struct GP_EXT *gp_ext, int debuglevel)
 202 {
 203         int lvl = debuglevel;
 204         int i;
 205
 206         if (gp_ext == NULL) {
 207                 return;
 208         }
 209
 210         DEBUG(lvl,("\t---------------------\n\n"));
 211         DEBUGADD(lvl,("\tname:\t\t\t%s\n", gp_ext->gp_extension));
 212
 213         for (i=0; i< gp_ext->num_exts; i++) {
 214
 215                 DEBUGADD(lvl,("\textension:\t\t\t%s\n",
 216                         gp_ext->extensions_guid[i]));
 217                 DEBUGADD(lvl,("\textension (name):\t\t\t%s\n",
 218                         gp_ext->extensions[i]));
 219
 220                 DEBUGADD(lvl,("\tsnapin:\t\t\t%s\n",
 221                         gp_ext->snapins_guid[i]));
 222                 DEBUGADD(lvl,("\tsnapin (name):\t\t\t%s\n",
 223                         gp_ext->snapins[i]));
 224         }
 225 }
 226
 227 #ifdef HAVE_LDAP
 228
 229 /****************************************************************
 230 ****************************************************************/
 231
 232 void dump_gpo(const struct GROUP_POLICY_OBJECT *gpo,
 233               int debuglevel)
 234 {
 235         int lvl = debuglevel;
 236         TALLOC_CTX *frame = talloc_stackframe();
 237
 238         if (gpo == NULL) {
 239                 goto out;
 240         }
 241
 242         DEBUG(lvl,("---------------------\n\n"));
 243
 244         DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name));
 245         DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name));
 246         DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version));
 247         DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n",
 248                 GPO_VERSION_USER(gpo->version),
 249                 GPO_VERSION_USER(gpo->version)));
 250         DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n",
 251                 GPO_VERSION_MACHINE(gpo->version),
 252                  GPO_VERSION_MACHINE(gpo->version)));
 253         DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path));
 254         DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path));
 255
 256         DEBUGADD(lvl,("options:\t\t%d ", gpo->options));
 257         switch (gpo->options) {
 258                 case GPFLAGS_ALL_ENABLED:
 259                         DEBUGADD(lvl,("GPFLAGS_ALL_ENABLED\n"));
 260                         break;
 261                 case GPFLAGS_USER_SETTINGS_DISABLED:
 262                         DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED\n"));
 263                         break;
 264                 case GPFLAGS_MACHINE_SETTINGS_DISABLED:
 265                         DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED\n"));
 266                         break;
 267                 case GPFLAGS_ALL_DISABLED:
 268                         DEBUGADD(lvl,("GPFLAGS_ALL_DISABLED\n"));
 269                         break;
 270                 default:
 271                         DEBUGADD(lvl,("unknown option: %d\n", gpo->options));
 272                         break;
 273         }
 274
 275         DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link));
 276         DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type));
 277         switch (gpo->link_type) {
 278                 case GP_LINK_UNKOWN:
 279                         DEBUGADD(lvl,("GP_LINK_UNKOWN\n"));
 280                         break;
 281                 case GP_LINK_OU:
 282                         DEBUGADD(lvl,("GP_LINK_OU\n"));
 283                         break;
 284                 case GP_LINK_DOMAIN:
 285                         DEBUGADD(lvl,("GP_LINK_DOMAIN\n"));
 286                         break;
 287                 case GP_LINK_SITE:
 288                         DEBUGADD(lvl,("GP_LINK_SITE\n"));
 289                         break;
 290                 case GP_LINK_MACHINE:
 291                         DEBUGADD(lvl,("GP_LINK_MACHINE\n"));
 292                         break;
 293                 default:
 294                         break;
 295         }
 296
 297         DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions));
 298
 299         if (gpo->machine_extensions) {
 300
 301                 struct GP_EXT *gp_ext = NULL;
 302
 303                 if (!ads_parse_gp_ext(frame, gpo->machine_extensions,
 304                                       &gp_ext)) {
 305                         goto out;
 306                 }
 307                 dump_gp_ext(gp_ext, lvl);
 308         }
 309
 310         DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions));
 311
 312         if (gpo->user_extensions) {
 313
 314                 struct GP_EXT *gp_ext = NULL;
 315
 316                 if (!ads_parse_gp_ext(frame, gpo->user_extensions,
 317                                       &gp_ext)) {
 318                         goto out;
 319                 }
 320                 dump_gp_ext(gp_ext, lvl);
 321         }
 322         if (gpo->security_descriptor) {
 323                 DEBUGADD(lvl,("security descriptor:\n"));
 324
 325                 NDR_PRINT_DEBUG(security_descriptor, gpo->security_descriptor);
 326         }
 327  out:
 328         talloc_free(frame);
 329 }
 330
 331 /****************************************************************
 332 ****************************************************************/
 333
 334 void dump_gpo_list(const struct GROUP_POLICY_OBJECT *gpo_list,
 335                    int debuglevel)
 336 {
 337         const struct GROUP_POLICY_OBJECT *gpo = NULL;
 338
 339         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 340                 dump_gpo(gpo, debuglevel);
 341         }
 342 }
 343
 344 /****************************************************************
 345 ****************************************************************/
 346
 347 void dump_gplink(const struct GP_LINK *gp_link)
 348 {
 349         int i;
 350         int lvl = 10;
 351
 352         if (gp_link == NULL) {
 353                 return;
 354         }
 355
 356         DEBUG(lvl,("---------------------\n\n"));
 357
 358         DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link));
 359         DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts));
 360         switch (gp_link->gp_opts) {
 361                 case GPOPTIONS_INHERIT:
 362                         DEBUGADD(lvl,("GPOPTIONS_INHERIT\n"));
 363                         break;
 364                 case GPOPTIONS_BLOCK_INHERITANCE:
 365                         DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n"));
 366                         break;
 367                 default:
 368                         break;
 369         }
 370
 371         DEBUGADD(lvl,("num links: %d\n", gp_link->num_links));
 372
 373         for (i = 0; i < gp_link->num_links; i++) {
 374
 375                 DEBUGADD(lvl,("---------------------\n\n"));
 376
 377                 DEBUGADD(lvl,("link: #%d\n", i + 1));
 378                 DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i]));
 379
 380                 DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i]));
 381                 if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) {
 382                         DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED "));
 383                 }
 384                 if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) {
 385                         DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED"));
 386                 }
 387                 DEBUGADD(lvl,("\n"));
 388         }
 389 }
 390
 391 #endif /* HAVE_LDAP */
 392
 393 /****************************************************************
 394 ****************************************************************/
 395
 396 bool gpo_get_gp_ext_from_gpo(TALLOC_CTX *mem_ctx,
 397                              uint32_t flags,
 398                              const struct GROUP_POLICY_OBJECT *gpo,
 399                              struct GP_EXT **gp_ext)
 400 {
 401         ZERO_STRUCTP(*gp_ext);
 402
 403         if (flags & GPO_INFO_FLAG_MACHINE) {
 404
 405                 if (gpo->machine_extensions) {
 406
 407                         if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
 408                                               gp_ext)) {
 409                                 return false;
 410                         }
 411                 }
 412         } else {
 413
 414                 if (gpo->user_extensions) {
 415
 416                         if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
 417                                               gp_ext)) {
 418                                 return false;
 419                         }
 420                 }
 421         }
 422
 423         return true;
 424 }
 425
 426 /****************************************************************
 427 ****************************************************************/
 428
 429 NTSTATUS gpo_process_gpo_list(TALLOC_CTX *mem_ctx,
 430                               const struct security_token *token,
 431                               const struct GROUP_POLICY_OBJECT *deleted_gpo_list,
 432                               const struct GROUP_POLICY_OBJECT *changed_gpo_list,
 433                               const char *extensions_guid_filter,
 434                               uint32_t flags)
 435 {
 436         NTSTATUS status = NT_STATUS_OK;
 437         struct registry_key *root_key = NULL;
 438         struct gp_registry_context *reg_ctx = NULL;
 439         WERROR werr;
 440
 441         /* get the key here */
 442         if (flags & GPO_LIST_FLAG_MACHINE) {
 443                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKLM, REG_KEY_WRITE,
 444                                        get_system_token(),
 445                                        &reg_ctx);
 446         } else {
 447                 werr = gp_init_reg_ctx(mem_ctx, KEY_HKCU, REG_KEY_WRITE,
 448                                        token,
 449                                        &reg_ctx);
 450         }
 451         if (!W_ERROR_IS_OK(werr)) {
 452                 talloc_free(reg_ctx);
 453                 return werror_to_ntstatus(werr);
 454         }
 455
 456         root_key = reg_ctx->curr_key;
 457
 458         status = gpext_process_extension(mem_ctx,
 459                                          flags, token, root_key,
 460                                          deleted_gpo_list,
 461                                          changed_gpo_list,
 462                                          extensions_guid_filter);
 463         talloc_free(reg_ctx);
 464         talloc_free(root_key);
 465         gpext_free_gp_extensions();
 466
 467         return status;
 468 }
 469
 470
 471 /****************************************************************
 472  check wether the version number in a GROUP_POLICY_OBJECT match those of the
 473  locally stored version. If not, fetch the required policy via CIFS
 474 ****************************************************************/
 475
 476 NTSTATUS check_refresh_gpo(ADS_STRUCT *ads,
 477                            TALLOC_CTX *mem_ctx,
 478                            const char *cache_dir,
 479                            uint32_t flags,
 480                            const struct GROUP_POLICY_OBJECT *gpo)
 481 {
 482         NTSTATUS result;
 483         char *server = NULL;
 484         char *share = NULL;
 485         char *nt_path = NULL;
 486         char *unix_path = NULL;
 487         uint32_t sysvol_gpt_version = 0;
 488         char *display_name = NULL;
 489
 490         result = gpo_explode_filesyspath(mem_ctx, cache_dir, gpo->file_sys_path,
 491                                          &server, &share, &nt_path, &unix_path);
 492
 493         if (!NT_STATUS_IS_OK(result)) {
 494                 goto out;
 495         }
 496
 497         result = gpo_get_sysvol_gpt_version(mem_ctx,
 498                                             unix_path,
 499                                             &sysvol_gpt_version,
 500                                             &display_name);
 501         if (!NT_STATUS_IS_OK(result) &&
 502             !NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_FILE)) {
 503                 DEBUG(10,("check_refresh_gpo: "
 504                         "failed to get local gpt version: %s\n",
 505                         nt_errstr(result)));
 506                 goto out;
 507         }
 508
 509         DEBUG(10,("check_refresh_gpo: versions gpo %d sysvol %d\n",
 510                 gpo->version, sysvol_gpt_version));
 511
 512         /* FIXME: handle GPO_INFO_FLAG_FORCED_REFRESH from flags */
 513
 514         while (gpo->version > sysvol_gpt_version) {
 515
 516                 DEBUG(1,("check_refresh_gpo: need to refresh GPO\n"));
 517
 518                 result = gpo_fetch_files(mem_ctx, ads, cache_dir, gpo);
 519                 if (!NT_STATUS_IS_OK(result)) {
 520                         goto out;
 521                 }
 522
 523                 result = gpo_get_sysvol_gpt_version(mem_ctx,
 524                                                     unix_path,
 525                                                     &sysvol_gpt_version,
 526                                                     &display_name);
 527                 if (!NT_STATUS_IS_OK(result)) {
 528                         DEBUG(10,("check_refresh_gpo: "
 529                                 "failed to get local gpt version: %s\n",
 530                                 nt_errstr(result)));
 531                         goto out;
 532                 }
 533
 534                 if (gpo->version == sysvol_gpt_version) {
 535                         break;
 536                 }
 537         }
 538
 539         DEBUG(10,("Name:\t\t\t%s (%s)\n", gpo->display_name, gpo->name));
 540         DEBUGADD(10,("sysvol GPT version:\t%d (user: %d, machine: %d)\n",
 541                 sysvol_gpt_version,
 542                 GPO_VERSION_USER(sysvol_gpt_version),
 543                 GPO_VERSION_MACHINE(sysvol_gpt_version)));
 544         DEBUGADD(10,("LDAP GPO version:\t%d (user: %d, machine: %d)\n",
 545                 gpo->version,
 546                 GPO_VERSION_USER(gpo->version),
 547                 GPO_VERSION_MACHINE(gpo->version)));
 548         DEBUGADD(10,("LDAP GPO link:\t\t%s\n", gpo->link));
 549
 550         result = NT_STATUS_OK;
 551
 552  out:
 553         return result;
 554
 555 }
 556
 557 /****************************************************************
 558  check wether the version numbers in the gpo_list match the locally stored, if
 559  not, go and get each required GPO via CIFS
 560  ****************************************************************/
 561
 562 NTSTATUS check_refresh_gpo_list(ADS_STRUCT *ads,
 563                                 TALLOC_CTX *mem_ctx,
 564                                 const char *cache_dir,
 565                                 uint32_t flags,
 566                                 const struct GROUP_POLICY_OBJECT *gpo_list)
 567 {
 568         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 569         const struct GROUP_POLICY_OBJECT *gpo;
 570
 571         if (!gpo_list) {
 572                 return NT_STATUS_INVALID_PARAMETER;
 573         }
 574
 575         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 576
 577                 result = check_refresh_gpo(ads, mem_ctx, cache_dir, flags, gpo);
 578                 if (!NT_STATUS_IS_OK(result)) {
 579                         goto out;
 580                 }
 581         }
 582
 583         result = NT_STATUS_OK;
 584
 585  out:
 586         /* FIXME close cli connection */
 587
 588         return result;
 589 }
 590
 591 /****************************************************************
 592 ****************************************************************/
 593
 594 NTSTATUS gpo_get_unix_path(TALLOC_CTX *mem_ctx,
 595                            const char *cache_dir,
 596                            const struct GROUP_POLICY_OBJECT *gpo,
 597                            char **unix_path)
 598 {
 599         char *server, *share, *nt_path;
 600         return gpo_explode_filesyspath(mem_ctx, cache_dir, gpo->file_sys_path,
 601                                        &server, &share, &nt_path, unix_path);
 602 }
 603
 604 /****************************************************************
 605 ****************************************************************/
 606
 607 char *gpo_flag_str(TALLOC_CTX *ctx, uint32_t flags)
 608 {
 609         char *str = NULL;
 610
 611         if (flags == 0) {
 612                 return NULL;
 613         }
 614
 615         str = talloc_strdup(ctx, "");
 616         if (!str) {
 617                 return NULL;
 618         }
 619
 620         if (flags & GPO_INFO_FLAG_SLOWLINK)
 621                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_SLOWLINK ");
 622         if (flags & GPO_INFO_FLAG_VERBOSE)
 623                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_VERBOSE ");
 624         if (flags & GPO_INFO_FLAG_SAFEMODE_BOOT)
 625                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_SAFEMODE_BOOT ");
 626         if (flags & GPO_INFO_FLAG_NOCHANGES)
 627                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_NOCHANGES ");
 628         if (flags & GPO_INFO_FLAG_MACHINE)
 629                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_MACHINE ");
 630         if (flags & GPO_INFO_FLAG_LOGRSOP_TRANSITION)
 631                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_LOGRSOP_TRANSITION ");
 632         if (flags & GPO_INFO_FLAG_LINKTRANSITION)
 633                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_LINKTRANSITION ");
 634         if (flags & GPO_INFO_FLAG_FORCED_REFRESH)
 635                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_FORCED_REFRESH ");
 636         if (flags & GPO_INFO_FLAG_BACKGROUND)
 637                 str = talloc_strdup_append(str, "GPO_INFO_FLAG_BACKGROUND ");
 638
 639         return str;
 640 }
 641
 642 /****************************************************************
 643 ****************************************************************/
 644
 645 NTSTATUS gp_find_file(TALLOC_CTX *mem_ctx,
 646                       uint32_t flags,
 647                       const char *filename,
 648                       const char *suffix,
 649                       const char **filename_out)
 650 {
 651         const char *tmp = NULL;
 652         struct stat sbuf;
 653         const char *path = NULL;
 654
 655         if (flags & GPO_LIST_FLAG_MACHINE) {
 656                 path = "Machine";
 657         } else {
 658                 path = "User";
 659         }
 660
 661         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
 662                               path, suffix);
 663         NT_STATUS_HAVE_NO_MEMORY(tmp);
 664
 665         if (stat(tmp, &sbuf) == 0) {
 666                 *filename_out = tmp;
 667                 return NT_STATUS_OK;
 668         }
 669
 670         path = talloc_strdup_upper(mem_ctx, path);
 671         NT_STATUS_HAVE_NO_MEMORY(path);
 672
 673         tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
 674                               path, suffix);
 675         NT_STATUS_HAVE_NO_MEMORY(tmp);
 676
 677         if (stat(tmp, &sbuf) == 0) {
 678                 *filename_out = tmp;
 679                 return NT_STATUS_OK;
 680         }
 681
 682         return NT_STATUS_NO_SUCH_FILE;
 683 }
 684
 685 /****************************************************************
 686 ****************************************************************/
 687
 688 ADS_STATUS gp_get_machine_token(ADS_STRUCT *ads,
 689                                 TALLOC_CTX *mem_ctx,
 690                                 const char *dn,
 691                                 struct security_token **token)
 692 {
 693 #ifdef HAVE_ADS
 694         struct security_token *ad_token = NULL;
 695         ADS_STATUS status;
 696         NTSTATUS ntstatus;
 697
 698         status = ads_get_sid_token(ads, mem_ctx, dn, &ad_token);
 699         if (!ADS_ERR_OK(status)) {
 700                 return status;
 701         }
 702         ntstatus = merge_nt_token(mem_ctx, ad_token, get_system_token(),
 703                                   token);
 704         if (!NT_STATUS_IS_OK(ntstatus)) {
 705                 return ADS_ERROR_NT(ntstatus);
 706         }
 707         return ADS_SUCCESS;
 708 #else
 709         return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
 710 #endif
 711 }
 712
 713 /****************************************************************
 714 ****************************************************************/
 715
 716 NTSTATUS gpo_copy(TALLOC_CTX *mem_ctx,
 717                   const struct GROUP_POLICY_OBJECT *gpo_src,
 718                   struct GROUP_POLICY_OBJECT **gpo_dst)
 719 {
 720         struct GROUP_POLICY_OBJECT *gpo;
 721
 722         gpo = talloc_zero(mem_ctx, struct GROUP_POLICY_OBJECT);
 723         NT_STATUS_HAVE_NO_MEMORY(gpo);
 724
 725         gpo->options            = gpo_src->options;
 726         gpo->version            = gpo_src->version;
 727
 728         gpo->ds_path            = talloc_strdup(gpo, gpo_src->ds_path);
 729         if (gpo->ds_path == NULL) {
 730                 TALLOC_FREE(gpo);
 731                 return NT_STATUS_NO_MEMORY;
 732         }
 733
 734         gpo->file_sys_path      = talloc_strdup(gpo, gpo_src->file_sys_path);
 735         if (gpo->file_sys_path == NULL) {
 736                 TALLOC_FREE(gpo);
 737                 return NT_STATUS_NO_MEMORY;
 738         }
 739
 740         gpo->display_name       = talloc_strdup(gpo, gpo_src->display_name);
 741         if (gpo->display_name == NULL) {
 742                 TALLOC_FREE(gpo);
 743                 return NT_STATUS_NO_MEMORY;
 744         }
 745
 746         gpo->name               = talloc_strdup(gpo, gpo_src->name);
 747         if (gpo->name == NULL) {
 748                 TALLOC_FREE(gpo);
 749                 return NT_STATUS_NO_MEMORY;
 750         }
 751
 752         gpo->link               = talloc_strdup(gpo, gpo_src->link);
 753         if (gpo->link == NULL) {
 754                 TALLOC_FREE(gpo);
 755                 return NT_STATUS_NO_MEMORY;
 756         }
 757
 758         gpo->link_type          = gpo_src->link_type;
 759
 760         if (gpo_src->user_extensions) {
 761                 gpo->user_extensions = talloc_strdup(gpo, gpo_src->user_extensions);
 762                 if (gpo->user_extensions == NULL) {
 763                         TALLOC_FREE(gpo);
 764                         return NT_STATUS_NO_MEMORY;
 765                 }
 766         }
 767
 768         if (gpo_src->machine_extensions) {
 769                 gpo->machine_extensions = talloc_strdup(gpo, gpo_src->machine_extensions);
 770                 if (gpo->machine_extensions == NULL) {
 771                         TALLOC_FREE(gpo);
 772                         return NT_STATUS_NO_MEMORY;
 773                 }
 774         }
 775
 776         if (gpo_src->security_descriptor == NULL) {
 777                 /* existing SD assumed */
 778                 TALLOC_FREE(gpo);
 779                 return NT_STATUS_INVALID_PARAMETER;
 780         }
 781         gpo->security_descriptor = security_descriptor_copy(gpo,
 782                                                 gpo_src->security_descriptor);
 783         if (gpo->security_descriptor == NULL) {
 784                 TALLOC_FREE(gpo);
 785                 return NT_STATUS_NO_MEMORY;
 786         }
 787
 788         gpo->next = gpo->prev = NULL;
 789
 790         *gpo_dst = gpo;
 791
 792         return NT_STATUS_OK;
 793 }