libgpo/gpo_sec.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2007
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "libcli/security/security.h"
  22 #include "../libgpo/gpo.h"
  23 #include "auth.h"
  24 #include "../librpc/ndr/libndr.h"
  25 #if _SAMBA_BUILD_ == 4
  26 #include "libgpo/ads_convenience.h"
  27 #include "librpc/gen_ndr/security.h"
  28 #include "librpc/gen_ndr/ndr_misc.h"
  29 #include "../libcli/security/secace.h"
  30 #endif
  31
  32 /****************************************************************
  33 ****************************************************************/
  34
  35 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
  36 {
  37         struct GUID ext_right_apg_guid;
  38         NTSTATUS status;
  39
  40         if (!object) {
  41                 return false;
  42         }
  43
  44         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
  45                                   &ext_right_apg_guid);
  46         if (!NT_STATUS_IS_OK(status)) {
  47                 return false;
  48         }
  49
  50         switch (object->flags) {
  51                 case SEC_ACE_OBJECT_TYPE_PRESENT:
  52                         if (GUID_equal(&object->type.type,
  53                                        &ext_right_apg_guid)) {
  54                                 return true;
  55                         }
  56                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
  57                         if (GUID_equal(&object->inherited_type.inherited_type,
  58                                        &ext_right_apg_guid)) {
  59                                 return true;
  60                         }
  61                 default:
  62                         break;
  63         }
  64
  65         return false;
  66 }
  67
  68 /****************************************************************
  69 ****************************************************************/
  70
  71 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
  72 {
  73         if (!sec_ace_object(ace->type)) {
  74                 return false;
  75         }
  76
  77         return gpo_sd_check_agp_object_guid(&ace->object.object);
  78 }
  79
  80 /****************************************************************
  81 ****************************************************************/
  82
  83 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
  84 {
  85         return (access_mask & SEC_ADS_CONTROL_ACCESS);
  86 }
  87
  88 #if 0
  89 /****************************************************************
  90 ****************************************************************/
  91
  92 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
  93 {
  94         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
  95                            SEC_RIGHTS_READ_ALL_PROP |
  96                            SEC_RIGHTS_READ_PERMS;
  97
  98         return (read_bits == (access_mask & read_bits));
  99 }
 100 #endif
 101
 102 /****************************************************************
 103 ****************************************************************/
 104
 105 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
 106                                                const struct security_token *token)
 107 {
 108         char *sid_str;
 109
 110         if (gpo_sd_check_agp_object(ace) &&
 111             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 112             nt_token_check_sid(&ace->trustee, token)) {
 113                 sid_str = dom_sid_string(NULL, &ace->trustee);
 114                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
 115                         "Access denied as of ace for %s\n",
 116                         sid_str));
 117                 talloc_free(sid_str);
 118                 return NT_STATUS_ACCESS_DENIED;
 119         }
 120
 121         return STATUS_MORE_ENTRIES;
 122 }
 123
 124 /****************************************************************
 125 ****************************************************************/
 126
 127 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
 128                                                 const struct security_token *token)
 129 {
 130         char *sid_str;
 131
 132         if (gpo_sd_check_agp_object(ace) &&
 133             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 134             nt_token_check_sid(&ace->trustee, token)) {
 135                 sid_str = dom_sid_string(NULL, &ace->trustee);
 136                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
 137                         "Access granted as of ace for %s\n",
 138                         sid_str));
 139                 talloc_free(sid_str);
 140
 141                 return NT_STATUS_OK;
 142         }
 143
 144         return STATUS_MORE_ENTRIES;
 145 }
 146
 147 /****************************************************************
 148 ****************************************************************/
 149
 150 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
 151                                  const struct security_token *token)
 152 {
 153         switch (ace->type) {
 154                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 155                         return gpo_sd_check_ace_denied_object(ace, token);
 156                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 157                         return gpo_sd_check_ace_allowed_object(ace, token);
 158                 default:
 159                         return STATUS_MORE_ENTRIES;
 160         }
 161 }
 162
 163 /****************************************************************
 164 ****************************************************************/
 165
 166 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
 167                                       const struct security_token *token)
 168 {
 169         struct security_descriptor *sd = gpo->security_descriptor;
 170         struct security_acl *dacl = NULL;
 171         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 172         int i;
 173
 174         if (!token) {
 175                 return NT_STATUS_INVALID_USER_BUFFER;
 176         }
 177
 178         if (!sd) {
 179                 return NT_STATUS_INVALID_SECURITY_DESCR;
 180         }
 181
 182         dacl = sd->dacl;
 183         if (!dacl) {
 184                 return NT_STATUS_INVALID_SECURITY_DESCR;
 185         }
 186
 187         /* check all aces and only return NT_STATUS_OK (== Access granted) or
 188          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
 189          * deny access */
 190
 191         for (i = 0; i < dacl->num_aces; i ++) {
 192
 193                 status = gpo_sd_check_ace(&dacl->aces[i], token);
 194
 195                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 196                         return status;
 197                 } else if (NT_STATUS_IS_OK(status)) {
 198                         return status;
 199                 }
 200
 201                 continue;
 202         }
 203
 204         return NT_STATUS_ACCESS_DENIED;
 205 }