2 Unix SMB/CIFS implementation.
3 Privileges handling functions
4 Copyright (C) Jean François Micouleau 1998-2001
5 Copyright (C) Simo Sorce 2002-2003
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #define ALLOC_CHECK(ptr, err, label, str) do { if ((ptr) == NULL) { DEBUG(0, ("%s: out of memory!\n", str)); err = NT_STATUS_NO_MEMORY; goto label; } } while(0)
27 #define NTSTATUS_CHECK(err, label, str1, str2) do { if (!NT_STATUS_IS_OK(err)) { DEBUG(0, ("%s: %s failed!\n", str1, str2)); } } while(0)
29 /****************************************************************************
30 Check if a user is a mapped group.
32 This function will check if the group SID is mapped onto a
33 system managed gid or onto a winbind manged sid.
34 In the first case it will be threated like a mapped group
35 and the backend should take the member list with a getgrgid
36 and ignore any user that have been possibly set into the group
39 In the second case, the group is a fully SAM managed group
40 served back to the system through winbind. In this case the
41 members of a Local group are "unrolled" to cope with the fact
42 that unix cannot contain groups inside groups.
43 The backend MUST never call any getgr* / getpw* function or
44 loops with winbind may happen.
45 ****************************************************************************/
48 NTSTATUS
is_mapped_group(BOOL
*mapped
, const DOM_SID
*sid
)
53 /* look if mapping exist, do not make idmap alloc an uid if SID is not found */
54 result
= idmap_get_gid_from_sid(&id
, sid
, False
);
55 if (NT_STATUS_IS_OK(result
)) {
56 *mapped
= gid_is_in_winbind_range(id
);
65 /****************************************************************************
66 duplicate alloc luid_attr
67 ****************************************************************************/
68 NTSTATUS
dupalloc_luid_attr(TALLOC_CTX
*mem_ctx
, LUID_ATTR
**new_la
, LUID_ATTR
*old_la
)
72 *new_la
= (LUID_ATTR
*)talloc(mem_ctx
, sizeof(LUID_ATTR
));
73 ALLOC_CHECK(new_la
, ret
, done
, "dupalloc_luid_attr");
75 (*new_la
)->luid
.high
= old_la
->luid
.high
;
76 (*new_la
)->luid
.low
= old_la
->luid
.low
;
77 (*new_la
)->attr
= old_la
->attr
;
85 /****************************************************************************
86 initialise a privilege list
87 ****************************************************************************/
88 NTSTATUS
init_privilege(PRIVILEGE_SET
**priv_set
)
91 TALLOC_CTX
*mem_ctx
= talloc_init("privilege set");
92 ALLOC_CHECK(mem_ctx
, ret
, done
, "init_privilege");
94 *priv_set
= talloc_zero(mem_ctx
, sizeof(PRIVILEGE_SET
));
95 ALLOC_CHECK(*priv_set
, ret
, done
, "init_privilege");
97 (*priv_set
)->mem_ctx
= mem_ctx
;
105 NTSTATUS
init_priv_with_ctx(TALLOC_CTX
*mem_ctx
, PRIVILEGE_SET
**priv_set
)
109 *priv_set
= talloc_zero(mem_ctx
, sizeof(PRIVILEGE_SET
));
110 ALLOC_CHECK(*priv_set
, ret
, done
, "init_privilege");
112 (*priv_set
)->mem_ctx
= mem_ctx
;
113 (*priv_set
)->ext_ctx
= True
;
121 void reset_privilege(PRIVILEGE_SET
*priv_set
)
124 priv_set
->control
= 0;
125 priv_set
->set
= NULL
;
128 void destroy_privilege(PRIVILEGE_SET
**priv_set
)
130 reset_privilege(*priv_set
);
131 if (!((*priv_set
)->ext_ctx
))
132 /* mem_ctx is local, destroy it */
133 talloc_destroy((*priv_set
)->mem_ctx
);
137 /****************************************************************************
138 add a privilege to a privilege array
139 ****************************************************************************/
140 NTSTATUS
add_privilege(PRIVILEGE_SET
*priv_set
, LUID_ATTR set
)
145 /* check if the privilege is not already in the list */
146 if (NT_STATUS_IS_OK(check_priv_in_privilege(priv_set
, set
)))
147 return NT_STATUS_UNSUCCESSFUL
;
149 /* we can allocate memory to add the new privilege */
151 new_set
= (LUID_ATTR
*)talloc_realloc(priv_set
->mem_ctx
, priv_set
->set
, (priv_set
->count
+ 1) * (sizeof(LUID_ATTR
)));
152 ALLOC_CHECK(new_set
, ret
, done
, "add_privilege");
154 new_set
[priv_set
->count
].luid
.high
= set
.luid
.high
;
155 new_set
[priv_set
->count
].luid
.low
= set
.luid
.low
;
156 new_set
[priv_set
->count
].attr
= set
.attr
;
159 priv_set
->set
= new_set
;
167 /****************************************************************************
168 add all the privileges to a privilege array
169 ****************************************************************************/
170 NTSTATUS
add_all_privilege(PRIVILEGE_SET
*priv_set
)
172 NTSTATUS result
= NT_STATUS_OK
;
178 /* TODO: set a proper list of privileges */
179 set
.luid
.low
= SE_PRIV_ADD_USERS
;
180 result
= add_privilege(priv_set
, set
);
181 NTSTATUS_CHECK(result
, done
, "add_all_privilege", "add_privilege");
183 set
.luid
.low
= SE_PRIV_ADD_MACHINES
;
184 result
= add_privilege(priv_set
, set
);
185 NTSTATUS_CHECK(result
, done
, "add_all_privilege", "add_privilege");
187 set
.luid
.low
= SE_PRIV_PRINT_OPERATOR
;
188 result
= add_privilege(priv_set
, set
);
189 NTSTATUS_CHECK(result
, done
, "add_all_privilege", "add_privilege");
195 /****************************************************************************
196 check if the privilege list is empty
197 ****************************************************************************/
198 NTSTATUS
check_empty_privilege(PRIVILEGE_SET
*priv_set
)
201 return NT_STATUS_INVALID_PARAMETER
;
203 if (priv_set
->count
== 0)
206 return NT_STATUS_UNSUCCESSFUL
;
209 /****************************************************************************
210 check if the privilege is in the privilege list
211 ****************************************************************************/
212 NTSTATUS
check_priv_in_privilege(PRIVILEGE_SET
*priv_set
, LUID_ATTR set
)
217 return NT_STATUS_INVALID_PARAMETER
;
219 /* if the list is empty, obviously we can't have it */
220 if (NT_STATUS_IS_OK(check_empty_privilege(priv_set
)))
221 return NT_STATUS_UNSUCCESSFUL
;
223 for (i
= 0; i
< priv_set
->count
; i
++) {
226 cur_set
= &priv_set
->set
[i
];
227 /* check only the low and high part. Checking the attr field has no meaning */
228 if ( (cur_set
->luid
.low
== set
.luid
.low
) &&
229 (cur_set
->luid
.high
== set
.luid
.high
) ) {
234 return NT_STATUS_UNSUCCESSFUL
;
237 /****************************************************************************
238 remove a privilege from a privilege array
239 ****************************************************************************/
240 NTSTATUS
remove_privilege(PRIVILEGE_SET
*priv_set
, LUID_ATTR set
)
248 return NT_STATUS_INVALID_PARAMETER
;
250 /* check if the privilege is in the list */
251 if (!NT_STATUS_IS_OK(check_priv_in_privilege(priv_set
, set
)))
252 return NT_STATUS_UNSUCCESSFUL
;
254 /* special case if it's the only privilege in the list */
255 if (priv_set
->count
== 1) {
256 reset_privilege(priv_set
);
261 * the privilege is there, create a new list,
262 * and copy the other privileges
265 old_set
= priv_set
->set
;
267 new_set
= (LUID_ATTR
*)talloc(priv_set
->mem_ctx
, (priv_set
->count
- 1) * (sizeof(LUID_ATTR
)));
268 ALLOC_CHECK(new_set
, ret
, done
, "remove_privilege");
270 for (i
=0, j
=0; i
< priv_set
->count
; i
++) {
271 if ( (old_set
[i
].luid
.low
== set
.luid
.low
) &&
272 (old_set
[i
].luid
.high
== set
.luid
.high
) ) {
276 new_set
[j
].luid
.low
= old_set
[i
].luid
.low
;
277 new_set
[j
].luid
.high
= old_set
[i
].luid
.high
;
278 new_set
[j
].attr
= old_set
[i
].attr
;
283 if (j
!= priv_set
->count
- 1) {
284 DEBUG(0,("remove_privilege: mismatch ! difference is not -1\n"));
285 DEBUGADD(0,("old count:%d, new count:%d\n", priv_set
->count
, j
));
286 return NT_STATUS_INTERNAL_ERROR
;
289 /* ok everything is fine */
292 priv_set
->set
= new_set
;
300 /****************************************************************************
301 duplicates a privilege array
302 the new privilege set must be passed inited
303 (use init_privilege or init_priv_with_ctx)
304 ****************************************************************************/
305 NTSTATUS
dup_priv_set(PRIVILEGE_SET
*new_priv_set
, PRIVILEGE_SET
*priv_set
)
312 if (!new_priv_set
|| !priv_set
)
313 return NT_STATUS_INVALID_PARAMETER
;
315 /* special case if there are no privileges in the list */
316 if (priv_set
->count
== 0) {
322 * and copy the other privileges
325 old_set
= priv_set
->set
;
327 new_set
= (LUID_ATTR
*)talloc(new_priv_set
->mem_ctx
, (priv_set
->count
- 1) * (sizeof(LUID_ATTR
)));
328 ALLOC_CHECK(new_set
, ret
, done
, "dup_priv_set");
330 for (i
=0; i
< priv_set
->count
; i
++) {
332 new_set
[i
].luid
.low
= old_set
[i
].luid
.low
;
333 new_set
[i
].luid
.high
= old_set
[i
].luid
.high
;
334 new_set
[i
].attr
= old_set
[i
].attr
;
337 new_priv_set
->count
= priv_set
->count
;
338 new_priv_set
->control
= priv_set
->control
;
339 new_priv_set
->set
= new_set
;