libcli/security/display_sec.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions
   4    Copyright (C) Andrew Tridgell 1992-1999
   5    Copyright (C) Luke Kenneth Casson Leighton 1996 - 1999
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "libcli/security/security.h"
  23 #include "librpc/ndr/libndr.h"
  24 #include "libcli/security/display_sec.h"
  25
  26 /****************************************************************************
  27 convert a security permissions into a string
  28 ****************************************************************************/
  29
  30 char *get_sec_mask_str(TALLOC_CTX *ctx, uint32_t type)
  31 {
  32         char *typestr = talloc_strdup(ctx, "");
  33
  34         if (!typestr) {
  35                 return NULL;
  36         }
  37
  38         if (type & SEC_GENERIC_ALL) {
  39                 typestr = talloc_asprintf_append(typestr,
  40                                 "Generic all access ");
  41                 if (!typestr) {
  42                         return NULL;
  43                 }
  44         }
  45         if (type & SEC_GENERIC_EXECUTE) {
  46                 typestr = talloc_asprintf_append(typestr,
  47                                 "Generic execute access");
  48                 if (!typestr) {
  49                         return NULL;
  50                 }
  51         }
  52         if (type & SEC_GENERIC_WRITE) {
  53                 typestr = talloc_asprintf_append(typestr,
  54                                 "Generic write access ");
  55                 if (!typestr) {
  56                         return NULL;
  57                 }
  58         }
  59         if (type & SEC_GENERIC_READ) {
  60                 typestr = talloc_asprintf_append(typestr,
  61                                 "Generic read access ");
  62                 if (!typestr) {
  63                         return NULL;
  64                 }
  65         }
  66         if (type & SEC_FLAG_MAXIMUM_ALLOWED) {
  67                 typestr = talloc_asprintf_append(typestr,
  68                                 "MAXIMUM_ALLOWED_ACCESS ");
  69                 if (!typestr) {
  70                         return NULL;
  71                 }
  72         }
  73         if (type & SEC_FLAG_SYSTEM_SECURITY) {
  74                 typestr = talloc_asprintf_append(typestr,
  75                                 "SYSTEM_SECURITY_ACCESS ");
  76                 if (!typestr) {
  77                         return NULL;
  78                 }
  79         }
  80         if (type & SEC_STD_SYNCHRONIZE) {
  81                 typestr = talloc_asprintf_append(typestr,
  82                                 "SYNCHRONIZE_ACCESS ");
  83                 if (!typestr) {
  84                         return NULL;
  85                 }
  86         }
  87         if (type & SEC_STD_WRITE_OWNER) {
  88                 typestr = talloc_asprintf_append(typestr,
  89                                 "WRITE_OWNER_ACCESS ");
  90                 if (!typestr) {
  91                         return NULL;
  92                 }
  93         }
  94         if (type & SEC_STD_WRITE_DAC) {
  95                 typestr = talloc_asprintf_append(typestr,
  96                                 "WRITE_DAC_ACCESS ");
  97                 if (!typestr) {
  98                         return NULL;
  99                 }
 100         }
 101         if (type & SEC_STD_READ_CONTROL) {
 102                 typestr = talloc_asprintf_append(typestr,
 103                                 "READ_CONTROL_ACCESS ");
 104                 if (!typestr) {
 105                         return NULL;
 106                 }
 107         }
 108         if (type & SEC_STD_DELETE) {
 109                 typestr = talloc_asprintf_append(typestr,
 110                                 "DELETE_ACCESS ");
 111                 if (!typestr) {
 112                         return NULL;
 113                 }
 114         }
 115
 116         printf("\t\tSpecific bits: 0x%lx\n", (unsigned long)type&SEC_MASK_SPECIFIC);
 117
 118         return typestr;
 119 }
 120
 121 /****************************************************************************
 122  display sec_access structure
 123  ****************************************************************************/
 124 void display_sec_access(uint32_t *info)
 125 {
 126         char *mask_str = get_sec_mask_str(NULL, *info);
 127         printf("\t\tPermissions: 0x%x: %s\n", *info, mask_str ? mask_str : "");
 128         talloc_free(mask_str);
 129 }
 130
 131 /****************************************************************************
 132  display sec_ace flags
 133  ****************************************************************************/
 134 void display_sec_ace_flags(uint8_t flags)
 135 {
 136         if (flags & SEC_ACE_FLAG_OBJECT_INHERIT)
 137                 printf("SEC_ACE_FLAG_OBJECT_INHERIT ");
 138         if (flags & SEC_ACE_FLAG_CONTAINER_INHERIT)
 139                 printf(" SEC_ACE_FLAG_CONTAINER_INHERIT ");
 140         if (flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)
 141                 printf("SEC_ACE_FLAG_NO_PROPAGATE_INHERIT ");
 142         if (flags & SEC_ACE_FLAG_INHERIT_ONLY)
 143                 printf("SEC_ACE_FLAG_INHERIT_ONLY ");
 144         if (flags & SEC_ACE_FLAG_INHERITED_ACE)
 145                 printf("SEC_ACE_FLAG_INHERITED_ACE ");
 146 /*      if (flags & SEC_ACE_FLAG_VALID_INHERIT)
 147                 printf("SEC_ACE_FLAG_VALID_INHERIT "); */
 148         if (flags & SEC_ACE_FLAG_SUCCESSFUL_ACCESS)
 149                 printf("SEC_ACE_FLAG_SUCCESSFUL_ACCESS ");
 150         if (flags & SEC_ACE_FLAG_FAILED_ACCESS)
 151                 printf("SEC_ACE_FLAG_FAILED_ACCESS ");
 152
 153         printf("\n");
 154 }
 155
 156 /****************************************************************************
 157  display sec_ace object
 158  ****************************************************************************/
 159 static void disp_sec_ace_object(struct security_ace_object *object)
 160 {
 161         char *str;
 162         if (object->flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
 163                 str = GUID_string(NULL, &object->type.type);
 164                 if (str == NULL) return;
 165                 printf("Object type: SEC_ACE_OBJECT_TYPE_PRESENT\n");
 166                 printf("Object GUID: %s\n", str);
 167                 talloc_free(str);
 168         }
 169         if (object->flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT) {
 170                 str = GUID_string(NULL, &object->inherited_type.inherited_type);
 171                 if (str == NULL) return;
 172                 printf("Object type: SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT\n");
 173                 printf("Object GUID: %s\n", str);
 174                 talloc_free(str);
 175         }
 176 }
 177
 178 /****************************************************************************
 179  display sec_ace structure
 180  ****************************************************************************/
 181 void display_sec_ace(struct security_ace *ace)
 182 {
 183         struct dom_sid_buf sid_str;
 184
 185         printf("\tACE\n\t\ttype: ");
 186         switch (ace->type) {
 187                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 188                         printf("ACCESS ALLOWED");
 189                         break;
 190                 case SEC_ACE_TYPE_ACCESS_DENIED:
 191                         printf("ACCESS DENIED");
 192                         break;
 193                 case SEC_ACE_TYPE_SYSTEM_AUDIT:
 194                         printf("SYSTEM AUDIT");
 195                         break;
 196                 case SEC_ACE_TYPE_SYSTEM_ALARM:
 197                         printf("SYSTEM ALARM");
 198                         break;
 199                 case SEC_ACE_TYPE_ALLOWED_COMPOUND:
 200                         printf("SEC_ACE_TYPE_ALLOWED_COMPOUND");
 201                         break;
 202                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 203                         printf("SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT");
 204                         break;
 205                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 206                         printf("SEC_ACE_TYPE_ACCESS_DENIED_OBJECT");
 207                         break;
 208                 case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
 209                         printf("SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT");
 210                         break;
 211                 case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
 212                         printf("SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT");
 213                         break;
 214                 default:
 215                         printf("????");
 216                         break;
 217         }
 218
 219         printf(" (%d) flags: 0x%02x ", ace->type, ace->flags);
 220         display_sec_ace_flags(ace->flags);
 221         display_sec_access(&ace->access_mask);
 222         printf("\t\tSID: %s\n\n", dom_sid_str_buf(&ace->trustee, &sid_str));
 223
 224         if (sec_ace_object(ace->type)) {
 225                 disp_sec_ace_object(&ace->object.object);
 226         }
 227
 228 }
 229
 230 /****************************************************************************
 231  display sec_acl structure
 232  ****************************************************************************/
 233 void display_sec_acl(struct security_acl *sec_acl)
 234 {
 235         uint32_t i;
 236
 237         printf("\tACL\tNum ACEs:\t%u\trevision:\t%x\n",
 238                sec_acl->num_aces, sec_acl->revision);
 239         printf("\t---\n");
 240
 241         if (sec_acl->size != 0 && sec_acl->num_aces != 0) {
 242                 for (i = 0; i < sec_acl->num_aces; i++) {
 243                         display_sec_ace(&sec_acl->aces[i]);
 244                 }
 245         }
 246 }
 247
 248 void display_acl_type(uint16_t type)
 249 {
 250         printf("type: 0x%04x: ", type);
 251
 252         if (type & SEC_DESC_OWNER_DEFAULTED)    /* 0x0001 */
 253                 printf("SEC_DESC_OWNER_DEFAULTED ");
 254         if (type & SEC_DESC_GROUP_DEFAULTED)    /* 0x0002 */
 255                 printf("SEC_DESC_GROUP_DEFAULTED ");
 256         if (type & SEC_DESC_DACL_PRESENT)       /* 0x0004 */
 257                 printf("SEC_DESC_DACL_PRESENT ");
 258         if (type & SEC_DESC_DACL_DEFAULTED)     /* 0x0008 */
 259                 printf("SEC_DESC_DACL_DEFAULTED ");
 260         if (type & SEC_DESC_SACL_PRESENT)       /* 0x0010 */
 261                 printf("SEC_DESC_SACL_PRESENT ");
 262         if (type & SEC_DESC_SACL_DEFAULTED)     /* 0x0020 */
 263                 printf("SEC_DESC_SACL_DEFAULTED ");
 264         if (type & SEC_DESC_DACL_TRUSTED)       /* 0x0040 */
 265                 printf("SEC_DESC_DACL_TRUSTED ");
 266         if (type & SEC_DESC_SERVER_SECURITY)    /* 0x0080 */
 267                 printf("SEC_DESC_SERVER_SECURITY ");
 268         if (type & SEC_DESC_DACL_AUTO_INHERIT_REQ) /* 0x0100 */
 269                 printf("SEC_DESC_DACL_AUTO_INHERIT_REQ ");
 270         if (type & SEC_DESC_SACL_AUTO_INHERIT_REQ) /* 0x0200 */
 271                 printf("SEC_DESC_SACL_AUTO_INHERIT_REQ ");
 272         if (type & SEC_DESC_DACL_AUTO_INHERITED) /* 0x0400 */
 273                 printf("SEC_DESC_DACL_AUTO_INHERITED ");
 274         if (type & SEC_DESC_SACL_AUTO_INHERITED) /* 0x0800 */
 275                 printf("SEC_DESC_SACL_AUTO_INHERITED ");
 276         if (type & SEC_DESC_DACL_PROTECTED)     /* 0x1000 */
 277                 printf("SEC_DESC_DACL_PROTECTED ");
 278         if (type & SEC_DESC_SACL_PROTECTED)     /* 0x2000 */
 279                 printf("SEC_DESC_SACL_PROTECTED ");
 280         if (type & SEC_DESC_RM_CONTROL_VALID)   /* 0x4000 */
 281                 printf("SEC_DESC_RM_CONTROL_VALID ");
 282         if (type & SEC_DESC_SELF_RELATIVE)      /* 0x8000 */
 283                 printf("SEC_DESC_SELF_RELATIVE ");
 284
 285         printf("\n");
 286 }
 287
 288 /****************************************************************************
 289  display sec_desc structure
 290  ****************************************************************************/
 291 void display_sec_desc(struct security_descriptor *sec)
 292 {
 293         struct dom_sid_buf sid_str;
 294
 295         if (!sec) {
 296                 printf("NULL\n");
 297                 return;
 298         }
 299
 300         printf("revision: %d\n", sec->revision);
 301         display_acl_type(sec->type);
 302
 303         if (sec->sacl) {
 304                 printf("SACL\n");
 305                 display_sec_acl(sec->sacl);
 306         }
 307
 308         if (sec->dacl) {
 309                 printf("DACL\n");
 310                 display_sec_acl(sec->dacl);
 311         }
 312
 313         if (sec->owner_sid) {
 314                 printf("\tOwner SID:\t%s\n",
 315                        dom_sid_str_buf(sec->owner_sid, &sid_str));
 316         }
 317
 318         if (sec->group_sid) {
 319                 printf("\tGroup SID:\t%s\n",
 320                        dom_sid_str_buf(sec->group_sid, &sid_str));
 321         }
 322 }