libcli/security/access_check.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Andrew Tridgell 2004
   5    Copyright (C) Gerald Carter 2005
   6    Copyright (C) Volker Lendecke 2007
   7    Copyright (C) Jeremy Allison 2008
   8    Copyright (C) Andrew Bartlett 2010
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "libcli/security/security.h"
  26
  27 /* Map generic access rights to object specific rights.  This technique is
  28    used to give meaning to assigning read, write, execute and all access to
  29    objects.  Each type of object has its own mapping of generic to object
  30    specific access rights. */
  31
  32 void se_map_generic(uint32_t *access_mask, const struct generic_mapping *mapping)
  33 {
  34         uint32_t old_mask = *access_mask;
  35
  36         if (*access_mask & GENERIC_READ_ACCESS) {
  37                 *access_mask &= ~GENERIC_READ_ACCESS;
  38                 *access_mask |= mapping->generic_read;
  39         }
  40
  41         if (*access_mask & GENERIC_WRITE_ACCESS) {
  42                 *access_mask &= ~GENERIC_WRITE_ACCESS;
  43                 *access_mask |= mapping->generic_write;
  44         }
  45
  46         if (*access_mask & GENERIC_EXECUTE_ACCESS) {
  47                 *access_mask &= ~GENERIC_EXECUTE_ACCESS;
  48                 *access_mask |= mapping->generic_execute;
  49         }
  50
  51         if (*access_mask & GENERIC_ALL_ACCESS) {
  52                 *access_mask &= ~GENERIC_ALL_ACCESS;
  53                 *access_mask |= mapping->generic_all;
  54         }
  55
  56         if (old_mask != *access_mask) {
  57                 DEBUG(10, ("se_map_generic(): mapped mask 0x%08x to 0x%08x\n",
  58                            old_mask, *access_mask));
  59         }
  60 }
  61
  62 /* Map generic access rights to object specific rights for all the ACE's
  63  * in a security_acl.
  64  */
  65
  66 void security_acl_map_generic(struct security_acl *sa,
  67                                 const struct generic_mapping *mapping)
  68 {
  69         unsigned int i;
  70
  71         if (!sa) {
  72                 return;
  73         }
  74
  75         for (i = 0; i < sa->num_aces; i++) {
  76                 se_map_generic(&sa->aces[i].access_mask, mapping);
  77         }
  78 }
  79
  80 /* Map standard access rights to object specific rights.  This technique is
  81    used to give meaning to assigning read, write, execute and all access to
  82    objects.  Each type of object has its own mapping of standard to object
  83    specific access rights. */
  84
  85 void se_map_standard(uint32_t *access_mask, const struct standard_mapping *mapping)
  86 {
  87         uint32_t old_mask = *access_mask;
  88
  89         if (*access_mask & SEC_STD_READ_CONTROL) {
  90                 *access_mask &= ~SEC_STD_READ_CONTROL;
  91                 *access_mask |= mapping->std_read;
  92         }
  93
  94         if (*access_mask & (SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE)) {
  95                 *access_mask &= ~(SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE);
  96                 *access_mask |= mapping->std_all;
  97         }
  98
  99         if (old_mask != *access_mask) {
 100                 DEBUG(10, ("se_map_standard(): mapped mask 0x%08x to 0x%08x\n",
 101                            old_mask, *access_mask));
 102         }
 103 }
 104
 105 /*
 106   perform a SEC_FLAG_MAXIMUM_ALLOWED access check
 107 */
 108 static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
 109                                         const struct security_token *token)
 110 {
 111         uint32_t denied = 0, granted = 0;
 112         unsigned i;
 113
 114         if (security_token_has_sid(token, sd->owner_sid)) {
 115                 granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL;
 116         }
 117
 118         if (sd->dacl == NULL) {
 119                 return granted & ~denied;
 120         }
 121
 122         for (i = 0;i<sd->dacl->num_aces; i++) {
 123                 struct security_ace *ace = &sd->dacl->aces[i];
 124
 125                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 126                         continue;
 127                 }
 128
 129                 if (!security_token_has_sid(token, &ace->trustee)) {
 130                         continue;
 131                 }
 132
 133                 switch (ace->type) {
 134                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 135                         granted |= ace->access_mask;
 136                         break;
 137                 case SEC_ACE_TYPE_ACCESS_DENIED:
 138                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 139                         denied |= ace->access_mask;
 140                         break;
 141                 default:        /* Other ACE types not handled/supported */
 142                         break;
 143                 }
 144         }
 145
 146         return granted & ~denied;
 147 }
 148
 149 /*
 150   The main entry point for access checking. If returning ACCESS_DENIED
 151   this function returns the denied bits in the uint32_t pointed
 152   to by the access_granted pointer.
 153 */
 154 NTSTATUS se_access_check(const struct security_descriptor *sd,
 155                           const struct security_token *token,
 156                           uint32_t access_desired,
 157                           uint32_t *access_granted)
 158 {
 159         uint32_t i;
 160         uint32_t bits_remaining;
 161         uint32_t explicitly_denied_bits = 0;
 162         /*
 163          * Up until Windows Server 2008, owner always had these rights. Now
 164          * we have to use Owner Rights perms if they are on the file.
 165          *
 166          * In addition we have to accumulate these bits and apply them
 167          * correctly. See bug #8795
 168          */
 169         uint32_t owner_rights_allowed = 0;
 170         uint32_t owner_rights_denied = 0;
 171         bool owner_rights_default = true;
 172
 173         *access_granted = access_desired;
 174         bits_remaining = access_desired;
 175
 176         /* handle the maximum allowed flag */
 177         if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
 178                 uint32_t orig_access_desired = access_desired;
 179
 180                 access_desired |= access_check_max_allowed(sd, token);
 181                 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
 182                 *access_granted = access_desired;
 183                 bits_remaining = access_desired;
 184
 185                 DEBUG(10,("se_access_check: MAX desired = 0x%x, granted = 0x%x, remaining = 0x%x\n",
 186                         orig_access_desired,
 187                         *access_granted,
 188                         bits_remaining));
 189         }
 190
 191         /* a NULL dacl allows access */
 192         if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
 193                 *access_granted = access_desired;
 194                 return NT_STATUS_OK;
 195         }
 196
 197         if (sd->dacl == NULL) {
 198                 goto done;
 199         }
 200
 201         /* check each ace in turn. */
 202         for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
 203                 struct security_ace *ace = &sd->dacl->aces[i];
 204
 205                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 206                         continue;
 207                 }
 208
 209                 /*
 210                  * We need the Owner Rights permissions to ensure we
 211                  * give or deny the correct permissions to the owner. Replace
 212                  * owner_rights with the perms here if it is present.
 213                  *
 214                  * We don't care if we are not the owner because that is taken
 215                  * care of below when we check if our token has the owner SID.
 216                  *
 217                  */
 218                 if (dom_sid_equal(&ace->trustee, &global_sid_Owner_Rights)) {
 219                         if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
 220                                 owner_rights_allowed |= ace->access_mask;
 221                                 owner_rights_default = false;
 222                         } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
 223                                 owner_rights_denied |= ace->access_mask;
 224                                 owner_rights_default = false;
 225                         }
 226                         continue;
 227                 }
 228
 229                 if (!security_token_has_sid(token, &ace->trustee)) {
 230                         continue;
 231                 }
 232
 233                 switch (ace->type) {
 234                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 235                         bits_remaining &= ~ace->access_mask;
 236                         break;
 237                 case SEC_ACE_TYPE_ACCESS_DENIED:
 238                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 239                         explicitly_denied_bits |= (bits_remaining & ace->access_mask);
 240                         break;
 241                 default:        /* Other ACE types not handled/supported */
 242                         break;
 243                 }
 244         }
 245
 246         /* The owner always gets owner rights as defined above. */
 247         if (security_token_has_sid(token, sd->owner_sid)) {
 248                 if (owner_rights_default) {
 249                         /*
 250                          * Just remove them, no need to check if they are
 251                          * there.
 252                          */
 253                         bits_remaining &= ~(SEC_STD_WRITE_DAC |
 254                                                 SEC_STD_READ_CONTROL);
 255                 } else {
 256                         bits_remaining &= ~owner_rights_allowed;
 257                         bits_remaining |= owner_rights_denied;
 258                 }
 259         }
 260
 261         /* Explicitly denied bits always override */
 262         bits_remaining |= explicitly_denied_bits;
 263
 264         /*
 265          * We check privileges here because they override even DENY entries.
 266          */
 267
 268         /* Does the user have the privilege to gain SEC_PRIV_SECURITY? */
 269         if (bits_remaining & SEC_FLAG_SYSTEM_SECURITY) {
 270                 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
 271                         bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
 272                 } else {
 273                         return NT_STATUS_PRIVILEGE_NOT_HELD;
 274                 }
 275         }
 276
 277         if ((bits_remaining & SEC_STD_WRITE_OWNER) &&
 278              security_token_has_privilege(token, SEC_PRIV_TAKE_OWNERSHIP)) {
 279                 bits_remaining &= ~(SEC_STD_WRITE_OWNER);
 280         }
 281
 282 done:
 283         if (bits_remaining != 0) {
 284                 *access_granted = bits_remaining;
 285                 return NT_STATUS_ACCESS_DENIED;
 286         }
 287
 288         return NT_STATUS_OK;
 289 }
 290
 291 /*
 292   The main entry point for access checking FOR THE FILE SERVER ONLY !
 293   If returning ACCESS_DENIED this function returns the denied bits in
 294   the uint32_t pointed to by the access_granted pointer.
 295 */
 296 NTSTATUS se_file_access_check(const struct security_descriptor *sd,
 297                           const struct security_token *token,
 298                           bool priv_open_requested,
 299                           uint32_t access_desired,
 300                           uint32_t *access_granted)
 301 {
 302         uint32_t bits_remaining;
 303         NTSTATUS status;
 304
 305         if (!priv_open_requested) {
 306                 /* Fall back to generic se_access_check(). */
 307                 return se_access_check(sd,
 308                                 token,
 309                                 access_desired,
 310                                 access_granted);
 311         }
 312
 313         /*
 314          * We need to handle the maximum allowed flag
 315          * outside of se_access_check(), as we need to
 316          * add in the access allowed by the privileges
 317          * as well.
 318          */
 319
 320         if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
 321                 uint32_t orig_access_desired = access_desired;
 322
 323                 access_desired |= access_check_max_allowed(sd, token);
 324                 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
 325
 326                 if (security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
 327                         access_desired |= SEC_RIGHTS_PRIV_BACKUP;
 328                 }
 329
 330                 if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
 331                         access_desired |= SEC_RIGHTS_PRIV_RESTORE;
 332                 }
 333
 334                 DEBUG(10,("se_file_access_check: MAX desired = 0x%x "
 335                         "mapped to 0x%x\n",
 336                         orig_access_desired,
 337                         access_desired));
 338         }
 339
 340         status = se_access_check(sd,
 341                                 token,
 342                                 access_desired,
 343                                 access_granted);
 344
 345         if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 346                 return status;
 347         }
 348
 349         bits_remaining = *access_granted;
 350
 351         /* Check if we should override with privileges. */
 352         if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
 353             security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
 354                 bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
 355         }
 356         if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
 357             security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
 358                 bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
 359         }
 360         if (bits_remaining != 0) {
 361                 *access_granted = bits_remaining;
 362                 return NT_STATUS_ACCESS_DENIED;
 363         }
 364
 365         return NT_STATUS_OK;
 366 }
 367
 368 static const struct GUID *get_ace_object_type(struct security_ace *ace)
 369 {
 370         struct GUID *type;
 371
 372         if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT)
 373                 type = &ace->object.object.type.type;
 374         else if (ace->object.object.flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)
 375                 type = &ace->object.object.inherited_type.inherited_type; /* This doesn't look right. Is something wrong with the IDL? */
 376         else
 377                 type = NULL;
 378
 379         return type;
 380
 381 }
 382
 383 /* modified access check for the purposes of DS security
 384  * Lots of code duplication, it will ve united in just one
 385  * function eventually */
 386
 387 NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
 388                              const struct security_token *token,
 389                              uint32_t access_desired,
 390                              uint32_t *access_granted,
 391                              struct object_tree *tree,
 392                              struct dom_sid *replace_sid)
 393 {
 394         uint32_t i;
 395         uint32_t bits_remaining;
 396         struct object_tree *node;
 397         const struct GUID *type;
 398         struct dom_sid *ps_sid = dom_sid_parse_talloc(NULL, SID_NT_SELF);
 399
 400         *access_granted = access_desired;
 401         bits_remaining = access_desired;
 402
 403         /* handle the maximum allowed flag */
 404         if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
 405                 access_desired |= access_check_max_allowed(sd, token);
 406                 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
 407                 *access_granted = access_desired;
 408                 bits_remaining = access_desired;
 409         }
 410
 411         if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
 412                 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
 413                         bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
 414                 } else {
 415                         talloc_free(ps_sid);
 416                         return NT_STATUS_PRIVILEGE_NOT_HELD;
 417                 }
 418         }
 419
 420         /* the owner always gets SEC_STD_WRITE_DAC and SEC_STD_READ_CONTROL */
 421         if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL)) &&
 422             security_token_has_sid(token, sd->owner_sid)) {
 423                 bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL);
 424         }
 425
 426         /* TODO: remove this, as it is file server specific */
 427         if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
 428             security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
 429                 bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
 430         }
 431         if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
 432             security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
 433                 bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
 434         }
 435
 436         /* a NULL dacl allows access */
 437         if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
 438                 *access_granted = access_desired;
 439                 talloc_free(ps_sid);
 440                 return NT_STATUS_OK;
 441         }
 442
 443         if (sd->dacl == NULL) {
 444                 goto done;
 445         }
 446
 447         /* check each ace in turn. */
 448         for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
 449                 struct dom_sid *trustee;
 450                 struct security_ace *ace = &sd->dacl->aces[i];
 451
 452                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 453                         continue;
 454                 }
 455                 if (dom_sid_equal(&ace->trustee, ps_sid) && replace_sid) {
 456                         trustee = replace_sid;
 457                 }
 458                 else
 459                 {
 460                         trustee = &ace->trustee;
 461                 }
 462                 if (!security_token_has_sid(token, trustee)) {
 463                         continue;
 464                 }
 465
 466                 switch (ace->type) {
 467                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 468                         if (tree)
 469                                 object_tree_modify_access(tree, ace->access_mask);
 470
 471                         bits_remaining &= ~ace->access_mask;
 472                         break;
 473                 case SEC_ACE_TYPE_ACCESS_DENIED:
 474                         if (bits_remaining & ace->access_mask) {
 475                                 talloc_free(ps_sid);
 476                                 return NT_STATUS_ACCESS_DENIED;
 477                         }
 478                         break;
 479                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 480                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 481                         /* check only in case we have provided a tree,
 482                          * the ACE has an object type and that type
 483                          * is in the tree                           */
 484                         type = get_ace_object_type(ace);
 485
 486                         if (!tree)
 487                                 continue;
 488
 489                         if (!type)
 490                                 node = tree;
 491                         else
 492                                 if (!(node = get_object_tree_by_GUID(tree, type)))
 493                                         continue;
 494
 495                         if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
 496                                 object_tree_modify_access(node, ace->access_mask);
 497                                 if (node->remaining_access == 0) {
 498                                         talloc_free(ps_sid);
 499                                         return NT_STATUS_OK;
 500                                 }
 501                         } else {
 502                                 if (node->remaining_access & ace->access_mask){
 503                                         talloc_free(ps_sid);
 504                                         return NT_STATUS_ACCESS_DENIED;
 505                                 }
 506                         }
 507                         break;
 508                 default:        /* Other ACE types not handled/supported */
 509                         break;
 510                 }
 511         }
 512
 513 done:
 514         talloc_free(ps_sid);
 515         if (bits_remaining != 0) {
 516                 return NT_STATUS_ACCESS_DENIED;
 517         }
 518
 519         return NT_STATUS_OK;
 520 }