source4/dsdb/samdb/samdb_privilege.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    manipulate privilege records in samdb
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/ldap/ldap.h"
  25 #include "dsdb/samdb/samdb.h"
  26 #include "auth/auth.h"
  27 #include "libcli/security/security.h"
  28 #include "db_wrap.h"
  29
  30 /*
  31   add privilege bits for one sid to a security_token
  32 */
  33 static NTSTATUS samdb_privilege_setup_sid(void *samctx, TALLOC_CTX *mem_ctx,
  34                                           struct security_token *token,
  35                                           const struct dom_sid *sid)
  36 {
  37         const char * const attrs[] = { "privilege", NULL };
  38         struct ldb_message **res = NULL;
  39         struct ldb_message_element *el;
  40         int ret, i;
  41         char *sidstr;
  42
  43         sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
  44         NT_STATUS_HAVE_NO_MEMORY(sidstr);
  45
  46         ret = gendb_search(samctx, mem_ctx, NULL, &res, attrs, "objectSid=%s", sidstr);
  47         talloc_free(sidstr);
  48         if (ret != 1) {
  49                 /* not an error to not match */
  50                 return NT_STATUS_OK;
  51         }
  52
  53         el = ldb_msg_find_element(res[0], "privilege");
  54         if (el == NULL) {
  55                 return NT_STATUS_OK;
  56         }
  57
  58         for (i=0;i<el->num_values;i++) {
  59                 const char *priv_str = (const char *)el->values[i].data;
  60                 enum sec_privilege privilege = sec_privilege_id(priv_str);
  61                 if (privilege == -1) {
  62                         DEBUG(1,("Unknown privilege '%s' in samdb\n",
  63                                  priv_str));
  64                         continue;
  65                 }
  66                 security_token_set_privilege(token, privilege);
  67         }
  68
  69         return NT_STATUS_OK;
  70 }
  71
  72 /*
  73   setup the privilege mask for this security token based on our
  74   local SAM
  75 */
  76 _PUBLIC_ NTSTATUS samdb_privilege_setup(struct security_token *token)
  77 {
  78         void *samctx;
  79         TALLOC_CTX *mem_ctx;
  80         int i;
  81         NTSTATUS status;
  82
  83         /* Shortcuts to prevent recursion and avoid lookups */
  84         if (security_token_is_system(token)) {
  85                 token->privilege_mask = ~0;
  86                 return NT_STATUS_OK;
  87         }
  88
  89         if (security_token_is_anonymous(token)) {
  90                 token->privilege_mask = 0;
  91                 return NT_STATUS_OK;
  92         }
  93
  94         mem_ctx = talloc_new(token);
  95         samctx = samdb_connect(mem_ctx, system_session(mem_ctx));
  96         if (samctx == NULL) {
  97                 talloc_free(mem_ctx);
  98                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
  99         }
 100
 101         token->privilege_mask = 0;
 102
 103         for (i=0;i<token->num_sids;i++) {
 104                 status = samdb_privilege_setup_sid(samctx, mem_ctx,
 105                                                    token, token->sids[i]);
 106                 if (!NT_STATUS_IS_OK(status)) {
 107                         talloc_free(mem_ctx);
 108                         return status;
 109                 }
 110         }
 111
 112         talloc_free(mem_ctx);
 113
 114         return NT_STATUS_OK;
 115 }