2 Unix SMB/CIFS implementation.
4 security descriptor description language functions
6 Copyright (C) Andrew Tridgell 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "lib/util/debug.h"
24 #include "libcli/security/security.h"
25 #include "libcli/security/conditional_ace.h"
26 #include "librpc/gen_ndr/ndr_misc.h"
27 #include "lib/util/smb_strtox.h"
28 #include "libcli/security/sddl.h"
29 #include "system/locale.h"
30 #include "lib/util/util_str_hex.h"
33 struct sddl_transition_state
{
34 const struct dom_sid
*machine_sid
;
35 const struct dom_sid
*domain_sid
;
36 const struct dom_sid
*forest_sid
;
44 static bool sddl_map_flag(
45 const struct flag_map
*map
,
50 while (map
->name
!= NULL
) {
51 size_t len
= strlen(map
->name
);
52 int cmp
= strncmp(map
->name
, str
, len
);
65 map a series of letter codes into a uint32_t
67 static bool sddl_map_flags(const struct flag_map
*map
, const char *str
,
68 uint32_t *pflags
, size_t *plen
,
69 bool unknown_flag_is_part_of_next_thing
)
71 const char *str0
= str
;
76 while (str
[0] != '\0' && isupper((unsigned char)str
[0])) {
81 found
= sddl_map_flag(map
, str
, &len
, &flags
);
93 * For ACL flags, unknown_flag_is_part_of_next_thing is set,
94 * and we expect some more stuff that isn't flags.
96 * For ACE flags, unknown_flag_is_part_of_next_thing is unset,
97 * and the flags have been tokenised into their own little
98 * string. We don't expect anything here, even whitespace.
100 if (*str
== '\0' || unknown_flag_is_part_of_next_thing
) {
103 DBG_WARNING("Unknown flag - '%s' in '%s'\n", str
, str0
);
109 a mapping between the 2 letter SID codes and sid strings
111 static const struct {
114 uint32_t machine_rid
;
118 { .code
= "WD", .sid
= SID_WORLD
},
120 { .code
= "CO", .sid
= SID_CREATOR_OWNER
},
121 { .code
= "CG", .sid
= SID_CREATOR_GROUP
},
122 { .code
= "OW", .sid
= SID_OWNER_RIGHTS
},
124 { .code
= "NU", .sid
= SID_NT_NETWORK
},
125 { .code
= "IU", .sid
= SID_NT_INTERACTIVE
},
126 { .code
= "SU", .sid
= SID_NT_SERVICE
},
127 { .code
= "AN", .sid
= SID_NT_ANONYMOUS
},
128 { .code
= "ED", .sid
= SID_NT_ENTERPRISE_DCS
},
129 { .code
= "PS", .sid
= SID_NT_SELF
},
130 { .code
= "AU", .sid
= SID_NT_AUTHENTICATED_USERS
},
131 { .code
= "RC", .sid
= SID_NT_RESTRICTED
},
132 { .code
= "SY", .sid
= SID_NT_SYSTEM
},
133 { .code
= "LS", .sid
= SID_NT_LOCAL_SERVICE
},
134 { .code
= "NS", .sid
= SID_NT_NETWORK_SERVICE
},
135 { .code
= "WR", .sid
= SID_SECURITY_RESTRICTED_CODE
},
137 { .code
= "BA", .sid
= SID_BUILTIN_ADMINISTRATORS
},
138 { .code
= "BU", .sid
= SID_BUILTIN_USERS
},
139 { .code
= "BG", .sid
= SID_BUILTIN_GUESTS
},
140 { .code
= "PU", .sid
= SID_BUILTIN_POWER_USERS
},
141 { .code
= "AO", .sid
= SID_BUILTIN_ACCOUNT_OPERATORS
},
142 { .code
= "SO", .sid
= SID_BUILTIN_SERVER_OPERATORS
},
143 { .code
= "PO", .sid
= SID_BUILTIN_PRINT_OPERATORS
},
144 { .code
= "BO", .sid
= SID_BUILTIN_BACKUP_OPERATORS
},
145 { .code
= "RE", .sid
= SID_BUILTIN_REPLICATOR
},
146 { .code
= "RU", .sid
= SID_BUILTIN_PREW2K
},
147 { .code
= "RD", .sid
= SID_BUILTIN_REMOTE_DESKTOP_USERS
},
148 { .code
= "NO", .sid
= SID_BUILTIN_NETWORK_CONF_OPERATORS
},
150 { .code
= "MU", .sid
= SID_BUILTIN_PERFMON_USERS
},
151 { .code
= "LU", .sid
= SID_BUILTIN_PERFLOG_USERS
},
152 { .code
= "IS", .sid
= SID_BUILTIN_IUSERS
},
153 { .code
= "CY", .sid
= SID_BUILTIN_CRYPTO_OPERATORS
},
154 { .code
= "ER", .sid
= SID_BUILTIN_EVENT_LOG_READERS
},
155 { .code
= "CD", .sid
= SID_BUILTIN_CERT_SERV_DCOM_ACCESS
},
156 { .code
= "RA", .sid
= SID_BUILTIN_RDS_REMOTE_ACCESS_SERVERS
},
157 { .code
= "ES", .sid
= SID_BUILTIN_RDS_ENDPOINT_SERVERS
},
158 { .code
= "MS", .sid
= SID_BUILTIN_RDS_MANAGEMENT_SERVERS
},
159 { .code
= "HA", .sid
= SID_BUILTIN_HYPER_V_ADMINS
},
160 { .code
= "AA", .sid
= SID_BUILTIN_ACCESS_CONTROL_ASSISTANCE_OPS
},
161 { .code
= "RM", .sid
= SID_BUILTIN_REMOTE_MANAGEMENT_USERS
},
163 { .code
= "UD", .sid
= SID_USER_MODE_DRIVERS
},
165 { .code
= "AC", .sid
= SID_SECURITY_BUILTIN_PACKAGE_ANY_PACKAGE
},
167 { .code
= "LW", .sid
= SID_SECURITY_MANDATORY_LOW
},
168 { .code
= "ME", .sid
= SID_SECURITY_MANDATORY_MEDIUM
},
169 { .code
= "MP", .sid
= SID_SECURITY_MANDATORY_MEDIUM_PLUS
},
170 { .code
= "HI", .sid
= SID_SECURITY_MANDATORY_HIGH
},
171 { .code
= "SI", .sid
= SID_SECURITY_MANDATORY_SYSTEM
},
173 { .code
= "AS", .sid
= SID_AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY
},
174 { .code
= "SS", .sid
= SID_SERVICE_ASSERTED_IDENTITY
},
176 { .code
= "RO", .forest_rid
= DOMAIN_RID_ENTERPRISE_READONLY_DCS
},
178 { .code
= "LA", .machine_rid
= DOMAIN_RID_ADMINISTRATOR
},
179 { .code
= "LG", .machine_rid
= DOMAIN_RID_GUEST
},
181 { .code
= "DA", .domain_rid
= DOMAIN_RID_ADMINS
},
182 { .code
= "DU", .domain_rid
= DOMAIN_RID_USERS
},
183 { .code
= "DG", .domain_rid
= DOMAIN_RID_GUESTS
},
184 { .code
= "DC", .domain_rid
= DOMAIN_RID_DOMAIN_MEMBERS
},
185 { .code
= "DD", .domain_rid
= DOMAIN_RID_DCS
},
186 { .code
= "CA", .domain_rid
= DOMAIN_RID_CERT_ADMINS
},
187 { .code
= "SA", .forest_rid
= DOMAIN_RID_SCHEMA_ADMINS
},
188 { .code
= "EA", .forest_rid
= DOMAIN_RID_ENTERPRISE_ADMINS
},
189 { .code
= "PA", .domain_rid
= DOMAIN_RID_POLICY_ADMINS
},
191 { .code
= "CN", .domain_rid
= DOMAIN_RID_CLONEABLE_CONTROLLERS
},
193 { .code
= "AP", .domain_rid
= DOMAIN_RID_PROTECTED_USERS
},
194 { .code
= "KA", .domain_rid
= DOMAIN_RID_KEY_ADMINS
},
195 { .code
= "EK", .forest_rid
= DOMAIN_RID_ENTERPRISE_KEY_ADMINS
},
197 { .code
= "RS", .domain_rid
= DOMAIN_RID_RAS_SERVERS
}
202 It can either be a special 2 letter code, or in S-* format
204 static struct dom_sid
*sddl_transition_decode_sid(TALLOC_CTX
*mem_ctx
, const char **sddlp
,
205 struct sddl_transition_state
*state
)
207 const char *sddl
= (*sddlp
);
210 /* see if its in the numeric format */
211 if (strncasecmp(sddl
, "S-", 2) == 0) {
212 struct dom_sid
*sid
= NULL
;
213 char *sid_str
= NULL
;
214 const char *end
= NULL
;
216 size_t len
= strspn(sddl
+ 2, "-0123456789ABCDEFabcdefxX") + 2;
217 if (len
< 5) { /* S-1-x */
220 if (sddl
[len
- 1] == 'D' && sddl
[len
] == ':') {
222 * we have run into the "D:" dacl marker, mistaking it
223 * for a hex digit. There is no other way for this
224 * pair to occur at the end of a SID in SDDL.
229 sid_str
= talloc_strndup(mem_ctx
, sddl
, len
);
230 if (sid_str
== NULL
) {
233 if (sid_str
[0] == 's') {
235 * In SDDL, but not in the dom_sid parsers, a
236 * lowercase "s-1-1-0" is accepted.
240 sid
= talloc(mem_ctx
, struct dom_sid
);
242 TALLOC_FREE(sid_str
);
245 ok
= dom_sid_parse_endp(sid_str
, sid
, &end
);
247 DBG_WARNING("could not parse SID '%s'\n", sid_str
);
248 TALLOC_FREE(sid_str
);
252 if (end
- sid_str
!= len
) {
253 DBG_WARNING("trailing junk after SID '%s'\n", sid_str
);
254 TALLOC_FREE(sid_str
);
258 TALLOC_FREE(sid_str
);
263 /* now check for one of the special codes */
264 for (i
=0;i
<ARRAY_SIZE(sid_codes
);i
++) {
265 if (strncmp(sid_codes
[i
].code
, sddl
, 2) == 0) break;
267 if (i
== ARRAY_SIZE(sid_codes
)) {
268 DEBUG(1,("Unknown sddl sid code '%2.2s'\n", sddl
));
275 if (sid_codes
[i
].machine_rid
!= 0) {
276 return dom_sid_add_rid(mem_ctx
, state
->machine_sid
,
277 sid_codes
[i
].machine_rid
);
280 if (sid_codes
[i
].domain_rid
!= 0) {
281 return dom_sid_add_rid(mem_ctx
, state
->domain_sid
,
282 sid_codes
[i
].domain_rid
);
285 if (sid_codes
[i
].forest_rid
!= 0) {
286 return dom_sid_add_rid(mem_ctx
, state
->forest_sid
,
287 sid_codes
[i
].forest_rid
);
290 return dom_sid_parse_talloc(mem_ctx
, sid_codes
[i
].sid
);
293 struct dom_sid
*sddl_decode_sid(TALLOC_CTX
*mem_ctx
, const char **sddlp
,
294 const struct dom_sid
*domain_sid
)
296 struct sddl_transition_state state
= {
298 * TODO: verify .machine_rid values really belong
299 * to the machine_sid on a member, once
300 * we pass machine_sid from the caller...
302 .machine_sid
= domain_sid
,
303 .domain_sid
= domain_sid
,
304 .forest_sid
= domain_sid
,
306 return sddl_transition_decode_sid(mem_ctx
, sddlp
, &state
);
310 static const struct flag_map ace_types
[] = {
311 { "AU", SEC_ACE_TYPE_SYSTEM_AUDIT
},
312 { "AL", SEC_ACE_TYPE_SYSTEM_ALARM
},
313 { "OA", SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
},
314 { "OD", SEC_ACE_TYPE_ACCESS_DENIED_OBJECT
},
315 { "OU", SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT
},
316 { "OL", SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT
},
317 { "A", SEC_ACE_TYPE_ACCESS_ALLOWED
},
318 { "D", SEC_ACE_TYPE_ACCESS_DENIED
},
320 { "XA", SEC_ACE_TYPE_ACCESS_ALLOWED_CALLBACK
},
321 { "XD", SEC_ACE_TYPE_ACCESS_DENIED_CALLBACK
},
322 { "ZA", SEC_ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT
},
324 * SEC_ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT exists but has
327 * ZA and XU are switched in [MS-DTYP] as of version 36.0,
328 * but this should be corrected in later versions.
330 { "XU", SEC_ACE_TYPE_SYSTEM_AUDIT_CALLBACK
},
332 { "RA", SEC_ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE
},
336 static const struct flag_map ace_flags
[] = {
337 { "OI", SEC_ACE_FLAG_OBJECT_INHERIT
},
338 { "CI", SEC_ACE_FLAG_CONTAINER_INHERIT
},
339 { "NP", SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
},
340 { "IO", SEC_ACE_FLAG_INHERIT_ONLY
},
341 { "ID", SEC_ACE_FLAG_INHERITED_ACE
},
342 { "SA", SEC_ACE_FLAG_SUCCESSFUL_ACCESS
},
343 { "FA", SEC_ACE_FLAG_FAILED_ACCESS
},
347 static const struct flag_map ace_access_mask
[] = {
348 { "CC", SEC_ADS_CREATE_CHILD
},
349 { "DC", SEC_ADS_DELETE_CHILD
},
350 { "LC", SEC_ADS_LIST
},
351 { "SW", SEC_ADS_SELF_WRITE
},
352 { "RP", SEC_ADS_READ_PROP
},
353 { "WP", SEC_ADS_WRITE_PROP
},
354 { "DT", SEC_ADS_DELETE_TREE
},
355 { "LO", SEC_ADS_LIST_OBJECT
},
356 { "CR", SEC_ADS_CONTROL_ACCESS
},
357 { "SD", SEC_STD_DELETE
},
358 { "RC", SEC_STD_READ_CONTROL
},
359 { "WD", SEC_STD_WRITE_DAC
},
360 { "WO", SEC_STD_WRITE_OWNER
},
361 { "GA", SEC_GENERIC_ALL
},
362 { "GX", SEC_GENERIC_EXECUTE
},
363 { "GW", SEC_GENERIC_WRITE
},
364 { "GR", SEC_GENERIC_READ
},
368 static const struct flag_map decode_ace_access_mask
[] = {
369 { "FA", FILE_GENERIC_ALL
},
370 { "FR", FILE_GENERIC_READ
},
371 { "FW", FILE_GENERIC_WRITE
},
372 { "FX", FILE_GENERIC_EXECUTE
},
377 static char *sddl_match_file_rights(TALLOC_CTX
*mem_ctx
,
382 /* try to find an exact match */
383 for (i
=0;decode_ace_access_mask
[i
].name
;i
++) {
384 if (decode_ace_access_mask
[i
].flag
== flags
) {
385 return talloc_strdup(mem_ctx
,
386 decode_ace_access_mask
[i
].name
);
392 static bool sddl_decode_access(const char *str
, uint32_t *pmask
)
394 const char *str0
= str
;
397 unsigned long long numeric_mask
;
400 * The access mask can be a number or a series of flags.
402 * Canonically the number is expressed in hexadecimal (with 0x), but
403 * per MS-DTYP and Windows behaviour, octal and decimal numbers are
406 * Windows has two behaviours we choose not to replicate:
408 * 1. numbers exceeding 0xffffffff are truncated at that point,
409 * turning on all access flags.
411 * 2. negative numbers are accepted, so e.g. -2 becomes 0xfffffffe.
413 numeric_mask
= smb_strtoull(str
, &end
, 0, &err
, SMB_STR_STANDARD
);
415 if (numeric_mask
> UINT32_MAX
) {
416 DBG_WARNING("Bad numeric flag value - %llu in %s\n",
420 if (end
- str
> sizeof("037777777777")) {
421 /* here's the tricky thing: if a number is big
422 * enough to overflow the uint64, it might end
423 * up small enough to fit in the uint32, and
424 * we'd miss that it overflowed. So we count
425 * the digits -- any more than 12 (for
426 * "037777777777") is too long for 32 bits,
427 * and the shortest 64-bit wrapping string is
428 * 19 (for "0x1" + 16 zeros).
430 DBG_WARNING("Bad numeric flag value in '%s'\n", str0
);
434 DBG_WARNING("Bad characters in '%s'\n", str0
);
437 *pmask
= numeric_mask
;
440 /* It's not a positive number, so we'll look for flags */
442 while ((str
[0] != '\0') &&
443 (isupper((unsigned char)str
[0]) || str
[0] == ' ')) {
447 while (str
[0] == ' ') {
449 * Following Windows we accept spaces between flags
450 * but not after flags. Not tabs, though, never tabs.
453 if (str
[0] == '\0') {
454 DBG_WARNING("trailing whitespace in flags "
459 found
= sddl_map_flag(
460 ace_access_mask
, str
, &len
, &flags
);
461 found
|= sddl_map_flag(
462 decode_ace_access_mask
, str
, &len
, &flags
);
464 DEBUG(1, ("Unknown flag - %s in %s\n", str
, str0
));
471 DBG_WARNING("Bad characters in '%s'\n", str0
);
479 static bool sddl_decode_guid(const char *str
, struct GUID
*guid
)
481 if (strlen(str
) != 36) {
484 return parse_guid_string(str
, guid
);
489 static DATA_BLOB
sddl_decode_conditions(TALLOC_CTX
*mem_ctx
,
490 const enum ace_condition_flags ace_condition_flags
,
491 const char *conditions
,
496 DATA_BLOB blob
= {0};
497 struct ace_condition_script
*script
= NULL
;
498 script
= ace_conditions_compile_sddl(mem_ctx
,
504 if (script
!= NULL
) {
505 bool ok
= conditional_ace_encode_binary(mem_ctx
,
509 DBG_ERR("could not blobify '%s'\n", conditions
);
518 return true on success, false on failure
519 note that this routine modifies the string
521 static bool sddl_decode_ace(TALLOC_CTX
*mem_ctx
,
522 struct security_ace
*ace
,
523 const enum ace_condition_flags ace_condition_flags
,
525 struct sddl_transition_state
*state
,
526 const char **msg
, size_t *msg_offset
)
535 char *str
= *sddl_copy
;
536 bool has_extra_data
= false;
541 *msg
= talloc_strdup(mem_ctx
, "Not an ACE");
546 * First we split apart the 6 (or 7) tokens.
555 * 6/extra_data rare optional extra data
558 while (*str
!= '\0') {
566 * this looks like a conditional ACE
567 * or resource ACE, but we can't say
568 * for sure until we look at the ACE
569 * type (tok[0]), after the loop.
571 has_extra_data
= true;
577 * we are not expecting a ')' in the 6 sections of an
578 * ordinary ACE, except ending the last one.
589 /* we hit the '\0' or ')' before all of ';;;;;)' */
590 *msg
= talloc_asprintf(mem_ctx
,
591 "malformed ACE with only %zu ';'",
592 MIN(count
- 1, count
));
597 ok
= sddl_map_flag(ace_types
, tok
[0], &len
, &v
);
599 *msg
= talloc_asprintf(mem_ctx
,
600 "Unknown ACE type - %s", tok
[0]);
603 if (tok
[0][len
] != '\0') {
604 *msg
= talloc_asprintf(mem_ctx
,
605 "Garbage after ACE type - %s", tok
[0]);
612 * Only callback and resource aces should have trailing data.
614 if (sec_ace_callback(ace
->type
)) {
615 if (! has_extra_data
) {
616 *msg
= talloc_strdup(
618 "callback ACE has no trailing data");
619 *msg_offset
= str
- *sddl_copy
;
622 } else if (sec_ace_resource(ace
->type
)) {
623 if (! has_extra_data
) {
624 *msg
= talloc_strdup(
626 "resource attribute ACE has no trailing data");
627 *msg_offset
= str
- *sddl_copy
;
630 } else if (has_extra_data
) {
631 *msg
= talloc_strdup(
633 "ACE has trailing section but is not a "
634 "callback or resource ACE");
635 *msg_offset
= str
- *sddl_copy
;
640 if (!sddl_map_flags(ace_flags
, tok
[1], &v
, NULL
, false)) {
641 *msg
= talloc_strdup(mem_ctx
,
642 "could not parse flags");
643 *msg_offset
= tok
[1] - *sddl_copy
;
649 ok
= sddl_decode_access(tok
[2], &ace
->access_mask
);
651 *msg
= talloc_strdup(mem_ctx
,
652 "could not parse access string");
653 *msg_offset
= tok
[2] - *sddl_copy
;
658 if (tok
[3][0] != 0) {
659 ok
= sddl_decode_guid(tok
[3], &ace
->object
.object
.type
.type
);
661 *msg
= talloc_strdup(mem_ctx
,
662 "could not parse object GUID");
663 *msg_offset
= tok
[3] - *sddl_copy
;
666 ace
->object
.object
.flags
|= SEC_ACE_OBJECT_TYPE_PRESENT
;
670 if (tok
[4][0] != 0) {
671 ok
= sddl_decode_guid(tok
[4],
672 &ace
->object
.object
.inherited_type
.inherited_type
);
674 *msg
= talloc_strdup(
676 "could not parse inherited object GUID");
677 *msg_offset
= tok
[4] - *sddl_copy
;
680 ace
->object
.object
.flags
|= SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
;
685 sid
= sddl_transition_decode_sid(mem_ctx
, &s
, state
);
687 *msg
= talloc_strdup(
689 "could not parse trustee SID");
690 *msg_offset
= tok
[5] - *sddl_copy
;
696 *msg
= talloc_strdup(
698 "garbage after trustee SID");
699 *msg_offset
= s
- *sddl_copy
;
703 if (sec_ace_callback(ace
->type
)) {
705 * This is either a conditional ACE or some unknown
706 * type of callback ACE that will be rejected by the
707 * conditional ACE compiler.
710 DATA_BLOB conditions
= {0};
713 conditions
= sddl_decode_conditions(mem_ctx
,
719 if (conditions
.data
== NULL
) {
720 DBG_NOTICE("Conditional ACE compilation failure at %zu: %s\n",
722 *msg_offset
+= s
- *sddl_copy
;
725 ace
->coda
.conditions
= conditions
;
728 * We have found the end of the conditions, and the
729 * next character should be the ')' to end the ACE.
731 if (s
[length
] != ')') {
732 *msg
= talloc_strdup(
734 "Conditional ACE has trailing bytes"
736 *msg_offset
= s
+ length
- *sddl_copy
;
739 str
= discard_const_p(char, s
+ length
+ 1);
740 } else if (sec_ace_resource(ace
->type
)) {
742 struct CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1
*claim
= NULL
;
744 if (! dom_sid_equal(&ace
->trustee
, &global_sid_World
)) {
745 /* these are just the rules */
746 *msg
= talloc_strdup(
748 "Resource Attribute ACE trustee must be "
749 "'S-1-1-0' or 'WD'.");
750 *msg_offset
= tok
[5] - *sddl_copy
;
755 claim
= sddl_decode_resource_attr(mem_ctx
, s
, &length
);
757 *msg
= talloc_strdup(
759 "Resource Attribute ACE parse failure");
760 *msg_offset
= s
- *sddl_copy
;
763 ace
->coda
.claim
= *claim
;
766 * We want a ')' to end the ACE.
768 if (s
[length
] != ')') {
769 *msg
= talloc_strdup(
771 "Resource Attribute ACE has trailing bytes"
773 *msg_offset
= s
+ length
- *sddl_copy
;
776 str
= discard_const_p(char, s
+ length
+ 1);
783 static const struct flag_map acl_flags
[] = {
784 { "P", SEC_DESC_DACL_PROTECTED
},
785 { "AR", SEC_DESC_DACL_AUTO_INHERIT_REQ
},
786 { "AI", SEC_DESC_DACL_AUTO_INHERITED
},
793 static struct security_acl
*sddl_decode_acl(struct security_descriptor
*sd
,
794 const enum ace_condition_flags ace_condition_flags
,
795 const char **sddlp
, uint32_t *flags
,
796 struct sddl_transition_state
*state
,
797 const char **msg
, size_t *msg_offset
)
799 const char *sddl
= *sddlp
;
800 char *sddl_copy
= NULL
;
801 char *aces_start
= NULL
;
802 struct security_acl
*acl
;
806 acl
= talloc_zero(sd
, struct security_acl
);
810 acl
->revision
= SECURITY_ACL_REVISION_ADS
;
812 if (isupper((unsigned char)sddl
[0]) && sddl
[1] == ':') {
813 /* its an empty ACL */
817 /* Windows AD allows spaces here */
818 while (*sddl
== ' ') {
822 /* work out the ACL flags */
823 if (!sddl_map_flags(acl_flags
, sddl
, flags
, &len
, true)) {
824 *msg
= talloc_strdup(sd
, "bad ACL flags");
831 if (sddl
[0] != '(') {
833 * it is empty apart from the flags
834 * (or the flags are bad, and we will find out when
835 * we try to parse the next bit as a top-level fragment)
844 * For this we make a copy of the rest of the SDDL, which the ACE
845 * tokeniser will mutilate by putting '\0' where it finds ';'.
847 * We need to copy the rest of the SDDL string because it is not
848 * possible in general to find where an ACL ends if there are
852 sddl_copy
= talloc_strdup(acl
, sddl
);
853 if (sddl_copy
== NULL
) {
857 aces_start
= sddl_copy
;
859 while (*sddl_copy
== '(') {
861 if (acl
->num_aces
> UINT16_MAX
/ 16) {
863 * We can't fit this many ACEs in a wire ACL
864 * which has a 16 bit size field (and 16 is
865 * the minimal size of an ACE with no subauths).
871 acl
->aces
= talloc_realloc(acl
, acl
->aces
, struct security_ace
,
873 if (acl
->aces
== NULL
) {
877 ok
= sddl_decode_ace(acl
->aces
, &acl
->aces
[acl
->num_aces
],
879 &sddl_copy
, state
, msg
, msg_offset
);
881 *msg_offset
+= sddl_copy
- aces_start
;
882 talloc_steal(sd
, *msg
);
888 sddl
+= sddl_copy
- aces_start
;
889 TALLOC_FREE(aces_start
);
895 * Decode a security descriptor in SDDL format, catching compilation
896 * error messages, if any.
898 * The message will be a direct talloc child of mem_ctx or NULL.
900 struct security_descriptor
*sddl_decode_err_msg(TALLOC_CTX
*mem_ctx
, const char *sddl
,
901 const struct dom_sid
*domain_sid
,
902 const enum ace_condition_flags ace_condition_flags
,
903 const char **msg
, size_t *msg_offset
)
905 struct sddl_transition_state state
= {
907 * TODO: verify .machine_rid values really belong
908 * to the machine_sid on a member, once
909 * we pass machine_sid from the caller...
911 .machine_sid
= domain_sid
,
912 .domain_sid
= domain_sid
,
913 .forest_sid
= domain_sid
,
915 const char *start
= sddl
;
916 struct security_descriptor
*sd
= NULL
;
918 if (msg
== NULL
|| msg_offset
== NULL
) {
919 DBG_ERR("Programmer misbehaviour: use sddl_decode() "
920 "or provide msg pointers.\n");
926 sd
= talloc_zero(mem_ctx
, struct security_descriptor
);
930 sd
->revision
= SECURITY_DESCRIPTOR_REVISION_1
;
931 sd
->type
= SEC_DESC_SELF_RELATIVE
;
936 if (sddl
[1] != ':') {
937 *msg
= talloc_strdup(mem_ctx
,
938 "expected '[OGDS]:' section start "
939 "(or the previous section ended prematurely)");
945 if (sd
->dacl
!= NULL
) goto failed
;
946 sd
->dacl
= sddl_decode_acl(sd
, ace_condition_flags
, &sddl
, &flags
, &state
, msg
, msg_offset
);
947 if (sd
->dacl
== NULL
) goto failed
;
948 sd
->type
|= flags
| SEC_DESC_DACL_PRESENT
;
951 if (sd
->sacl
!= NULL
) goto failed
;
952 sd
->sacl
= sddl_decode_acl(sd
, ace_condition_flags
, &sddl
, &flags
, &state
, msg
, msg_offset
);
953 if (sd
->sacl
== NULL
) goto failed
;
954 /* this relies on the SEC_DESC_SACL_* flags being
955 1 bit shifted from the SEC_DESC_DACL_* flags */
956 sd
->type
|= (flags
<<1) | SEC_DESC_SACL_PRESENT
;
959 if (sd
->owner_sid
!= NULL
) goto failed
;
960 sd
->owner_sid
= sddl_transition_decode_sid(sd
, &sddl
, &state
);
961 if (sd
->owner_sid
== NULL
) goto failed
;
964 if (sd
->group_sid
!= NULL
) goto failed
;
965 sd
->group_sid
= sddl_transition_decode_sid(sd
, &sddl
, &state
);
966 if (sd
->group_sid
== NULL
) goto failed
;
969 *msg
= talloc_strdup(mem_ctx
, "unexpected character (expected [OGDS])");
976 *msg
= talloc_steal(mem_ctx
, *msg
);
979 * The actual message (*msg) might still be NULL, but the
980 * offset at least provides a clue.
982 *msg_offset
+= sddl
- start
;
984 if (*msg_offset
> strlen(sddl
)) {
986 * It's not that we *don't* trust our pointer difference
987 * arithmetic, just that we *shouldn't*. Let's render it
988 * harmless, before Python tries printing 18 quadrillion
991 DBG_WARNING("sddl error message offset %zu is too big\n",
995 DEBUG(2,("Badly formatted SDDL '%s'\n", sddl
));
1002 decode a security descriptor in SDDL format
1004 struct security_descriptor
*sddl_decode(TALLOC_CTX
*mem_ctx
, const char *sddl
,
1005 const struct dom_sid
*domain_sid
)
1007 const char *msg
= NULL
;
1008 size_t msg_offset
= 0;
1009 struct security_descriptor
*sd
= sddl_decode_err_msg(mem_ctx
,
1012 ACE_CONDITION_FLAG_ALLOW_DEVICE
,
1016 DBG_NOTICE("could not decode '%s'\n", sddl
);
1018 DBG_NOTICE(" %*c\n",
1019 (int)msg_offset
, '^');
1020 DBG_NOTICE("error '%s'\n", msg
);
1021 talloc_free(discard_const(msg
));
1028 turn a set of flags into a string
1030 static char *sddl_flags_to_string(TALLOC_CTX
*mem_ctx
, const struct flag_map
*map
,
1031 uint32_t flags
, bool check_all
)
1036 /* try to find an exact match */
1037 for (i
=0;map
[i
].name
;i
++) {
1038 if (map
[i
].flag
== flags
) {
1039 return talloc_strdup(mem_ctx
, map
[i
].name
);
1043 s
= talloc_strdup(mem_ctx
, "");
1046 for (i
=0;map
[i
].name
;i
++) {
1047 if ((flags
& map
[i
].flag
) != 0) {
1048 s
= talloc_asprintf_append_buffer(s
, "%s", map
[i
].name
);
1049 if (s
== NULL
) goto failed
;
1050 flags
&= ~map
[i
].flag
;
1054 if (check_all
&& flags
!= 0) {
1066 encode a sid in SDDL format
1068 static char *sddl_transition_encode_sid(TALLOC_CTX
*mem_ctx
, const struct dom_sid
*sid
,
1069 struct sddl_transition_state
*state
)
1071 bool in_machine
= dom_sid_in_domain(state
->machine_sid
, sid
);
1072 bool in_domain
= dom_sid_in_domain(state
->domain_sid
, sid
);
1073 bool in_forest
= dom_sid_in_domain(state
->forest_sid
, sid
);
1074 struct dom_sid_buf buf
;
1075 const char *sidstr
= dom_sid_str_buf(sid
, &buf
);
1079 if (sid
->num_auths
> 1) {
1080 rid
= sid
->sub_auths
[sid
->num_auths
-1];
1083 for (i
=0;i
<ARRAY_SIZE(sid_codes
);i
++) {
1084 /* seen if its a well known sid */
1085 if (sid_codes
[i
].sid
!= NULL
) {
1088 cmp
= strcmp(sidstr
, sid_codes
[i
].sid
);
1093 return talloc_strdup(mem_ctx
, sid_codes
[i
].code
);
1100 if (in_machine
&& sid_codes
[i
].machine_rid
== rid
) {
1101 return talloc_strdup(mem_ctx
, sid_codes
[i
].code
);
1103 if (in_domain
&& sid_codes
[i
].domain_rid
== rid
) {
1104 return talloc_strdup(mem_ctx
, sid_codes
[i
].code
);
1106 if (in_forest
&& sid_codes
[i
].forest_rid
== rid
) {
1107 return talloc_strdup(mem_ctx
, sid_codes
[i
].code
);
1111 return talloc_strdup(mem_ctx
, sidstr
);
1114 char *sddl_encode_sid(TALLOC_CTX
*mem_ctx
, const struct dom_sid
*sid
,
1115 const struct dom_sid
*domain_sid
)
1117 struct sddl_transition_state state
= {
1119 * TODO: verify .machine_rid values really belong
1120 * to the machine_sid on a member, once
1121 * we pass machine_sid from the caller...
1123 .machine_sid
= domain_sid
,
1124 .domain_sid
= domain_sid
,
1125 .forest_sid
= domain_sid
,
1127 return sddl_transition_encode_sid(mem_ctx
, sid
, &state
);
1133 encode an ACE in SDDL format
1135 static char *sddl_transition_encode_ace(TALLOC_CTX
*mem_ctx
, const struct security_ace
*ace
,
1136 struct sddl_transition_state
*state
)
1139 TALLOC_CTX
*tmp_ctx
;
1140 struct GUID_txt_buf object_buf
, iobject_buf
;
1141 const char *sddl_type
="", *sddl_flags
="", *sddl_mask
="",
1142 *sddl_object
="", *sddl_iobject
="", *sddl_trustee
="";
1143 tmp_ctx
= talloc_new(mem_ctx
);
1144 if (tmp_ctx
== NULL
) {
1145 DEBUG(0, ("talloc_new failed\n"));
1149 sddl_type
= sddl_flags_to_string(tmp_ctx
, ace_types
, ace
->type
, true);
1150 if (sddl_type
== NULL
) {
1154 sddl_flags
= sddl_flags_to_string(tmp_ctx
, ace_flags
, ace
->flags
,
1156 if (sddl_flags
== NULL
) {
1160 sddl_mask
= sddl_flags_to_string(tmp_ctx
, ace_access_mask
,
1161 ace
->access_mask
, true);
1162 if (sddl_mask
== NULL
) {
1163 sddl_mask
= sddl_match_file_rights(tmp_ctx
,
1165 if (sddl_mask
== NULL
) {
1166 sddl_mask
= talloc_asprintf(tmp_ctx
, "0x%x",
1169 if (sddl_mask
== NULL
) {
1174 if (sec_ace_object(ace
->type
)) {
1175 const struct security_ace_object
*object
= &ace
->object
.object
;
1177 if (ace
->object
.object
.flags
& SEC_ACE_OBJECT_TYPE_PRESENT
) {
1178 sddl_object
= GUID_buf_string(
1179 &object
->type
.type
, &object_buf
);
1182 if (ace
->object
.object
.flags
&
1183 SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
) {
1184 sddl_iobject
= GUID_buf_string(
1185 &object
->inherited_type
.inherited_type
,
1189 sddl_trustee
= sddl_transition_encode_sid(tmp_ctx
, &ace
->trustee
, state
);
1190 if (sddl_trustee
== NULL
) {
1194 if (sec_ace_callback(ace
->type
)) {
1195 /* encode the conditional part */
1196 struct ace_condition_script
*s
= NULL
;
1197 const char *sddl_conditions
= NULL
;
1199 s
= parse_conditional_ace(tmp_ctx
, ace
->coda
.conditions
);
1205 sddl_conditions
= sddl_from_conditional_ace(tmp_ctx
, s
);
1206 if (sddl_conditions
== NULL
) {
1210 sddl
= talloc_asprintf(mem_ctx
, "%s;%s;%s;%s;%s;%s;%s",
1211 sddl_type
, sddl_flags
, sddl_mask
,
1212 sddl_object
, sddl_iobject
,
1213 sddl_trustee
, sddl_conditions
);
1214 } else if (sec_ace_resource(ace
->type
)) {
1215 /* encode the resource part */
1216 const char *coda
= NULL
;
1217 coda
= sddl_resource_attr_from_claim(tmp_ctx
,
1221 DBG_WARNING("resource ACE has invalid claim\n");
1224 sddl
= talloc_asprintf(mem_ctx
, "%s;%s;%s;%s;%s;%s;%s",
1225 sddl_type
, sddl_flags
, sddl_mask
,
1226 sddl_object
, sddl_iobject
,
1227 sddl_trustee
, coda
);
1229 sddl
= talloc_asprintf(mem_ctx
, "%s;%s;%s;%s;%s;%s",
1230 sddl_type
, sddl_flags
, sddl_mask
,
1231 sddl_object
, sddl_iobject
, sddl_trustee
);
1234 talloc_free(tmp_ctx
);
1238 char *sddl_encode_ace(TALLOC_CTX
*mem_ctx
, const struct security_ace
*ace
,
1239 const struct dom_sid
*domain_sid
)
1241 struct sddl_transition_state state
= {
1243 * TODO: verify .machine_rid values really belong
1244 * to the machine_sid on a member, once
1245 * we pass machine_sid from the caller...
1247 .machine_sid
= domain_sid
,
1248 .domain_sid
= domain_sid
,
1249 .forest_sid
= domain_sid
,
1251 return sddl_transition_encode_ace(mem_ctx
, ace
, &state
);
1255 encode an ACL in SDDL format
1257 static char *sddl_encode_acl(TALLOC_CTX
*mem_ctx
, const struct security_acl
*acl
,
1258 uint32_t flags
, struct sddl_transition_state
*state
)
1263 /* add any ACL flags */
1264 sddl
= sddl_flags_to_string(mem_ctx
, acl_flags
, flags
, false);
1265 if (sddl
== NULL
) goto failed
;
1267 /* now the ACEs, encoded in braces */
1268 for (i
=0;i
<acl
->num_aces
;i
++) {
1269 char *ace
= sddl_transition_encode_ace(sddl
, &acl
->aces
[i
], state
);
1270 if (ace
== NULL
) goto failed
;
1271 sddl
= talloc_asprintf_append_buffer(sddl
, "(%s)", ace
);
1272 if (sddl
== NULL
) goto failed
;
1285 encode a security descriptor to SDDL format
1287 char *sddl_encode(TALLOC_CTX
*mem_ctx
, const struct security_descriptor
*sd
,
1288 const struct dom_sid
*domain_sid
)
1290 struct sddl_transition_state state
= {
1292 * TODO: verify .machine_rid values really belong
1293 * to the machine_sid on a member, once
1294 * we pass machine_sid from the caller...
1296 .machine_sid
= domain_sid
,
1297 .domain_sid
= domain_sid
,
1298 .forest_sid
= domain_sid
,
1301 TALLOC_CTX
*tmp_ctx
;
1303 /* start with a blank string */
1304 sddl
= talloc_strdup(mem_ctx
, "");
1305 if (sddl
== NULL
) goto failed
;
1307 tmp_ctx
= talloc_new(sddl
);
1308 if (tmp_ctx
== NULL
) {
1312 if (sd
->owner_sid
!= NULL
) {
1313 char *sid
= sddl_transition_encode_sid(tmp_ctx
, sd
->owner_sid
, &state
);
1314 if (sid
== NULL
) goto failed
;
1315 sddl
= talloc_asprintf_append_buffer(sddl
, "O:%s", sid
);
1316 if (sddl
== NULL
) goto failed
;
1319 if (sd
->group_sid
!= NULL
) {
1320 char *sid
= sddl_transition_encode_sid(tmp_ctx
, sd
->group_sid
, &state
);
1321 if (sid
== NULL
) goto failed
;
1322 sddl
= talloc_asprintf_append_buffer(sddl
, "G:%s", sid
);
1323 if (sddl
== NULL
) goto failed
;
1326 if ((sd
->type
& SEC_DESC_DACL_PRESENT
) && sd
->dacl
!= NULL
) {
1327 char *acl
= sddl_encode_acl(tmp_ctx
, sd
->dacl
, sd
->type
, &state
);
1328 if (acl
== NULL
) goto failed
;
1329 sddl
= talloc_asprintf_append_buffer(sddl
, "D:%s", acl
);
1330 if (sddl
== NULL
) goto failed
;
1333 if ((sd
->type
& SEC_DESC_SACL_PRESENT
) && sd
->sacl
!= NULL
) {
1334 char *acl
= sddl_encode_acl(tmp_ctx
, sd
->sacl
, sd
->type
>>1, &state
);
1335 if (acl
== NULL
) goto failed
;
1336 sddl
= talloc_asprintf_append_buffer(sddl
, "S:%s", acl
);
1337 if (sddl
== NULL
) goto failed
;
1340 talloc_free(tmp_ctx
);