2 Unix SMB/CIFS implementation.
4 manipulate privilege records in samdb
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libcli/ldap/ldap_ndr.h"
24 #include "dsdb/samdb/samdb.h"
25 #include "auth/auth.h"
26 #include "libcli/security/security.h"
27 #include "../lib/util/util_ldb.h"
28 #include "param/param.h"
31 /* connect to the privilege database */
32 struct ldb_context
*privilege_connect(TALLOC_CTX
*mem_ctx
,
33 struct tevent_context
*ev_ctx
,
34 struct loadparm_context
*lp_ctx
)
37 struct ldb_context
*pdb
;
39 path
= private_path(mem_ctx
, lp_ctx
, "privilege.ldb");
40 if (!path
) return NULL
;
42 pdb
= ldb_wrap_connect(mem_ctx
, ev_ctx
, lp_ctx
, path
,
50 add privilege bits for one sid to a security_token
52 static NTSTATUS
samdb_privilege_setup_sid(struct ldb_context
*pdb
, TALLOC_CTX
*mem_ctx
,
53 struct security_token
*token
,
54 const struct dom_sid
*sid
)
56 const char * const attrs
[] = { "privilege", NULL
};
57 struct ldb_message
**res
= NULL
;
58 struct ldb_message_element
*el
;
62 sidstr
= ldap_encode_ndr_dom_sid(mem_ctx
, sid
);
63 NT_STATUS_HAVE_NO_MEMORY(sidstr
);
65 ret
= gendb_search(pdb
, mem_ctx
, NULL
, &res
, attrs
, "objectSid=%s", sidstr
);
68 /* not an error to not match */
72 el
= ldb_msg_find_element(res
[0], "privilege");
77 for (i
=0;i
<el
->num_values
;i
++) {
78 const char *priv_str
= (const char *)el
->values
[i
].data
;
79 enum sec_privilege privilege
= sec_privilege_id(priv_str
);
80 if (privilege
== -1) {
81 DEBUG(1,("Unknown privilege '%s' in samdb\n",
85 security_token_set_privilege(token
, privilege
);
92 setup the privilege mask for this security token based on our
95 NTSTATUS
samdb_privilege_setup(struct tevent_context
*ev_ctx
,
96 struct loadparm_context
*lp_ctx
, struct security_token
*token
)
98 struct ldb_context
*pdb
;
103 /* Shortcuts to prevent recursion and avoid lookups */
104 if (token
->user_sid
== NULL
) {
105 token
->privilege_mask
= 0;
109 if (security_token_is_system(token
)) {
110 token
->privilege_mask
= ~0;
114 if (security_token_is_anonymous(token
)) {
115 token
->privilege_mask
= 0;
119 mem_ctx
= talloc_new(token
);
120 pdb
= privilege_connect(mem_ctx
, ev_ctx
, lp_ctx
);
122 talloc_free(mem_ctx
);
123 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
126 token
->privilege_mask
= 0;
128 for (i
=0;i
<token
->num_sids
;i
++) {
129 status
= samdb_privilege_setup_sid(pdb
, mem_ctx
,
130 token
, token
->sids
[i
]);
131 if (!NT_STATUS_IS_OK(status
)) {
132 talloc_free(mem_ctx
);
137 talloc_free(mem_ctx
);