libcli/security/secace.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  struct security_ace handling functions
   4  *  Copyright (C) Andrew Tridgell              1992-1998,
   5  *  Copyright (C) Jeremy R. Allison            1995-2003.
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   7  *  Copyright (C) Paul Ashton                  1997-1998.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 3 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include "includes.h"
  24 #include "librpc/gen_ndr/ndr_security.h"
  25 #include "libcli/security/security.h"
  26 #include "lib/util/tsort.h"
  27
  28 #define  SEC_ACE_HEADER_SIZE (2 * sizeof(uint8_t) + sizeof(uint16_t) + sizeof(uint32_t))
  29
  30 /**
  31  * Check if ACE has OBJECT type.
  32  */
  33 bool sec_ace_object(uint8_t type)
  34 {
  35         if (type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT ||
  36             type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT ||
  37             type == SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT ||
  38             type == SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT) {
  39                 return true;
  40         }
  41         return false;
  42 }
  43
  44 /**
  45  * copy a struct security_ace structure.
  46  */
  47 void sec_ace_copy(struct security_ace *ace_dest, const struct security_ace *ace_src)
  48 {
  49         ace_dest->type  = ace_src->type;
  50         ace_dest->flags = ace_src->flags;
  51         ace_dest->size  = ace_src->size;
  52         ace_dest->access_mask = ace_src->access_mask;
  53         ace_dest->object = ace_src->object;
  54         ace_dest->trustee = ace_src->trustee;
  55 }
  56
  57 /*******************************************************************
  58  Sets up a struct security_ace structure.
  59 ********************************************************************/
  60
  61 void init_sec_ace(struct security_ace *t, const struct dom_sid *sid, enum security_ace_type type,
  62                   uint32_t mask, uint8_t flag)
  63 {
  64         t->type = type;
  65         t->flags = flag;
  66         t->size = ndr_size_dom_sid(sid, 0) + 8;
  67         t->access_mask = mask;
  68
  69         t->trustee = *sid;
  70 }
  71
  72 /*******************************************************************
  73   modify SID's permissions at ACL
  74 ********************************************************************/
  75
  76 NTSTATUS sec_ace_mod_sid(struct security_ace *ace, size_t num, const struct dom_sid *sid, uint32_t mask)
  77 {
  78         unsigned int i = 0;
  79
  80         if (!ace || !sid)  return NT_STATUS_INVALID_PARAMETER;
  81
  82         for (i = 0; i < num; i ++) {
  83                 if (dom_sid_equal(&ace[i].trustee, sid)) {
  84                         ace[i].access_mask = mask;
  85                         return NT_STATUS_OK;
  86                 }
  87         }
  88         return NT_STATUS_NOT_FOUND;
  89 }
  90
  91 /*******************************************************************
  92  Compares two struct security_ace structures
  93 ********************************************************************/
  94
  95 bool sec_ace_equal(const struct security_ace *s1, const struct security_ace *s2)
  96 {
  97         /* Trivial case */
  98
  99         if (!s1 && !s2) {
 100                 return true;
 101         }
 102
 103         if (!s1 || !s2) {
 104                 return false;
 105         }
 106
 107         /* Check top level stuff */
 108
 109         if (s1->type != s2->type || s1->flags != s2->flags ||
 110             s1->access_mask != s2->access_mask) {
 111                 return false;
 112         }
 113
 114         /* Check SID */
 115
 116         if (!dom_sid_equal(&s1->trustee, &s2->trustee)) {
 117                 return false;
 118         }
 119
 120         return true;
 121 }
 122
 123 int nt_ace_inherit_comp(const struct security_ace *a1, const struct security_ace *a2)
 124 {
 125         int a1_inh = a1->flags & SEC_ACE_FLAG_INHERITED_ACE;
 126         int a2_inh = a2->flags & SEC_ACE_FLAG_INHERITED_ACE;
 127
 128         if (a1_inh == a2_inh)
 129                 return 0;
 130
 131         if (!a1_inh && a2_inh)
 132                 return -1;
 133         return 1;
 134 }
 135
 136 /*******************************************************************
 137   Comparison function to apply the order explained below in a group.
 138 *******************************************************************/
 139
 140 int nt_ace_canon_comp( const struct security_ace *a1,  const struct security_ace *a2)
 141 {
 142         if ((a1->type == SEC_ACE_TYPE_ACCESS_DENIED) &&
 143                                 (a2->type != SEC_ACE_TYPE_ACCESS_DENIED))
 144                 return -1;
 145
 146         if ((a2->type == SEC_ACE_TYPE_ACCESS_DENIED) &&
 147                                 (a1->type != SEC_ACE_TYPE_ACCESS_DENIED))
 148                 return 1;
 149
 150         /* Both access denied or access allowed. */
 151
 152         /* 1. ACEs that apply to the object itself */
 153
 154         if (!(a1->flags & SEC_ACE_FLAG_INHERIT_ONLY) &&
 155                         (a2->flags & SEC_ACE_FLAG_INHERIT_ONLY))
 156                 return -1;
 157         else if (!(a2->flags & SEC_ACE_FLAG_INHERIT_ONLY) &&
 158                         (a1->flags & SEC_ACE_FLAG_INHERIT_ONLY))
 159                 return 1;
 160
 161         /* 2. ACEs that apply to a subobject of the object, such as
 162          * a property set or property. */
 163
 164         if (a1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT) &&
 165                         !(a2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT)))
 166                 return -1;
 167         else if (a2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT) &&
 168                         !(a1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT)))
 169                 return 1;
 170
 171         return 0;
 172 }
 173
 174 /*******************************************************************
 175  Functions to convert a SEC_DESC ACE DACL list into canonical order.
 176  JRA.
 177
 178 --- from http://msdn.microsoft.com/library/default.asp?url=/library/en-us/security/security/order_of_aces_in_a_dacl.asp
 179
 180 The following describes the preferred order:
 181
 182  To ensure that noninherited ACEs have precedence over inherited ACEs,
 183  place all noninherited ACEs in a group before any inherited ACEs.
 184  This ordering ensures, for example, that a noninherited access-denied ACE
 185  is enforced regardless of any inherited ACE that allows access.
 186
 187  Within the groups of noninherited ACEs and inherited ACEs, order ACEs according to ACE type, as the following shows:
 188         1. Access-denied ACEs that apply to the object itself
 189         2. Access-denied ACEs that apply to a subobject of the object, such as a property set or property
 190         3. Access-allowed ACEs that apply to the object itself
 191         4. Access-allowed ACEs that apply to a subobject of the object"
 192
 193 ********************************************************************/
 194
 195 void dacl_sort_into_canonical_order(struct security_ace *srclist, unsigned int num_aces)
 196 {
 197         unsigned int i;
 198
 199         if (!srclist || num_aces == 0)
 200                 return;
 201
 202         /* Sort so that non-inherited ACE's come first. */
 203         TYPESAFE_QSORT(srclist, num_aces, nt_ace_inherit_comp);
 204
 205         /* Find the boundary between non-inherited ACEs. */
 206         for (i = 0; i < num_aces; i++ ) {
 207                 struct security_ace *curr_ace = &srclist[i];
 208
 209                 if (curr_ace->flags & SEC_ACE_FLAG_INHERITED_ACE)
 210                         break;
 211         }
 212
 213         /* i now points at entry number of the first inherited ACE. */
 214
 215         /* Sort the non-inherited ACEs. */
 216         TYPESAFE_QSORT(srclist, i, nt_ace_canon_comp);
 217
 218         /* Now sort the inherited ACEs. */
 219         TYPESAFE_QSORT(&srclist[i], num_aces - i, nt_ace_canon_comp);
 220 }
 221
 222