source3/libgpo/gpo_reg.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2007-2008
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "../libgpo/gpo.h"
  22 #include "libgpo/gpo_proto.h"
  23 #include "registry.h"
  24 #include "registry/reg_backend_db.h"
  25
  26
  27 /****************************************************************
  28 ****************************************************************/
  29
  30 struct nt_user_token *registry_create_system_token(TALLOC_CTX *mem_ctx)
  31 {
  32         struct nt_user_token *token = NULL;
  33
  34         token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token);
  35         if (!token) {
  36                 DEBUG(1,("talloc failed\n"));
  37                 return NULL;
  38         }
  39
  40         token->privileges = se_priv_all;
  41
  42         if (!NT_STATUS_IS_OK(add_sid_to_array(token, &global_sid_System,
  43                          &token->user_sids, &token->num_sids))) {
  44                 DEBUG(1,("Error adding nt-authority system sid to token\n"));
  45                 return NULL;
  46         }
  47
  48         return token;
  49 }
  50
  51 /****************************************************************
  52 ****************************************************************/
  53
  54 WERROR gp_init_reg_ctx(TALLOC_CTX *mem_ctx,
  55                        const char *initial_path,
  56                        uint32_t desired_access,
  57                        const struct nt_user_token *token,
  58                        struct gp_registry_context **reg_ctx)
  59 {
  60         struct gp_registry_context *tmp_ctx;
  61         WERROR werr;
  62
  63         if (!reg_ctx) {
  64                 return WERR_INVALID_PARAM;
  65         }
  66
  67         werr = registry_init_basic();
  68         if (!W_ERROR_IS_OK(werr)) {
  69                 return werr;
  70         }
  71
  72         tmp_ctx = TALLOC_ZERO_P(mem_ctx, struct gp_registry_context);
  73         W_ERROR_HAVE_NO_MEMORY(tmp_ctx);
  74
  75         if (token) {
  76                 tmp_ctx->token = token;
  77         } else {
  78                 tmp_ctx->token = registry_create_system_token(mem_ctx);
  79         }
  80         if (!tmp_ctx->token) {
  81                 TALLOC_FREE(tmp_ctx);
  82                 return WERR_NOMEM;
  83         }
  84
  85         werr = regdb_open();
  86         if (!W_ERROR_IS_OK(werr)) {
  87                 return werr;
  88         }
  89
  90         if (initial_path) {
  91                 tmp_ctx->path = talloc_strdup(mem_ctx, initial_path);
  92                 if (!tmp_ctx->path) {
  93                         TALLOC_FREE(tmp_ctx);
  94                         return WERR_NOMEM;
  95                 }
  96
  97                 werr = reg_open_path(mem_ctx, tmp_ctx->path, desired_access,
  98                                      tmp_ctx->token, &tmp_ctx->curr_key);
  99                 if (!W_ERROR_IS_OK(werr)) {
 100                         TALLOC_FREE(tmp_ctx);
 101                         return werr;
 102                 }
 103         }
 104
 105         *reg_ctx = tmp_ctx;
 106
 107         return WERR_OK;
 108 }
 109
 110 /****************************************************************
 111 ****************************************************************/
 112
 113 void gp_free_reg_ctx(struct gp_registry_context *reg_ctx)
 114 {
 115         TALLOC_FREE(reg_ctx);
 116 }
 117
 118 /****************************************************************
 119 ****************************************************************/
 120
 121 WERROR gp_store_reg_subkey(TALLOC_CTX *mem_ctx,
 122                            const char *subkeyname,
 123                            struct registry_key *curr_key,
 124                            struct registry_key **new_key)
 125 {
 126         enum winreg_CreateAction action = REG_ACTION_NONE;
 127         WERROR werr;
 128
 129         werr = reg_createkey(mem_ctx, curr_key, subkeyname,
 130                              REG_KEY_WRITE, new_key, &action);
 131         if (W_ERROR_IS_OK(werr) && (action != REG_CREATED_NEW_KEY)) {
 132                 return WERR_OK;
 133         }
 134
 135         return werr;
 136 }
 137
 138 /****************************************************************
 139 ****************************************************************/
 140
 141 WERROR gp_read_reg_subkey(TALLOC_CTX *mem_ctx,
 142                           struct gp_registry_context *reg_ctx,
 143                           const char *subkeyname,
 144                           struct registry_key **key)
 145 {
 146         const char *tmp = NULL;
 147
 148         if (!reg_ctx || !subkeyname || !key) {
 149                 return WERR_INVALID_PARAM;
 150         }
 151
 152         tmp = talloc_asprintf(mem_ctx, "%s\\%s", reg_ctx->path, subkeyname);
 153         W_ERROR_HAVE_NO_MEMORY(tmp);
 154
 155         return reg_open_path(mem_ctx, tmp, REG_KEY_READ,
 156                              reg_ctx->token, key);
 157 }
 158
 159 /****************************************************************
 160 ****************************************************************/
 161
 162 WERROR gp_store_reg_val_sz(TALLOC_CTX *mem_ctx,
 163                            struct registry_key *key,
 164                            const char *val_name,
 165                            const char *val)
 166 {
 167         struct registry_value reg_val;
 168         ZERO_STRUCT(reg_val);
 169
 170         /* FIXME: hack */
 171         val = val ? val : " ";
 172
 173         reg_val.type = REG_SZ;
 174         reg_val.v.sz.len = strlen(val);
 175         reg_val.v.sz.str = talloc_strdup(mem_ctx, val);
 176         W_ERROR_HAVE_NO_MEMORY(reg_val.v.sz.str);
 177
 178         return reg_setvalue(key, val_name, &reg_val);
 179 }
 180
 181 /****************************************************************
 182 ****************************************************************/
 183
 184 static WERROR gp_store_reg_val_dword(TALLOC_CTX *mem_ctx,
 185                                      struct registry_key *key,
 186                                      const char *val_name,
 187                                      uint32_t val)
 188 {
 189         struct registry_value reg_val;
 190         ZERO_STRUCT(reg_val);
 191
 192         reg_val.type = REG_DWORD;
 193         reg_val.v.dword = val;
 194
 195         return reg_setvalue(key, val_name, &reg_val);
 196 }
 197
 198 /****************************************************************
 199 ****************************************************************/
 200
 201 WERROR gp_read_reg_val_sz(TALLOC_CTX *mem_ctx,
 202                           struct registry_key *key,
 203                           const char *val_name,
 204                           const char **val)
 205 {
 206         WERROR werr;
 207         struct registry_value *reg_val = NULL;
 208
 209         werr = reg_queryvalue(mem_ctx, key, val_name, &reg_val);
 210         W_ERROR_NOT_OK_RETURN(werr);
 211
 212         if (reg_val->type != REG_SZ) {
 213                 return WERR_INVALID_DATATYPE;
 214         }
 215
 216         *val = talloc_strdup(mem_ctx, reg_val->v.sz.str);
 217         W_ERROR_HAVE_NO_MEMORY(*val);
 218
 219         return WERR_OK;
 220 }
 221
 222 /****************************************************************
 223 ****************************************************************/
 224
 225 static WERROR gp_read_reg_val_dword(TALLOC_CTX *mem_ctx,
 226                                     struct registry_key *key,
 227                                     const char *val_name,
 228                                     uint32_t *val)
 229 {
 230         WERROR werr;
 231         struct registry_value *reg_val = NULL;
 232
 233         werr = reg_queryvalue(mem_ctx, key, val_name, &reg_val);
 234         W_ERROR_NOT_OK_RETURN(werr);
 235
 236         if (reg_val->type != REG_DWORD) {
 237                 return WERR_INVALID_DATATYPE;
 238         }
 239
 240         *val = reg_val->v.dword;
 241
 242         return WERR_OK;
 243 }
 244
 245 /****************************************************************
 246 ****************************************************************/
 247
 248 static WERROR gp_store_reg_gpovals(TALLOC_CTX *mem_ctx,
 249                                    struct registry_key *key,
 250                                    struct GROUP_POLICY_OBJECT *gpo)
 251 {
 252         WERROR werr;
 253
 254         if (!key || !gpo) {
 255                 return WERR_INVALID_PARAM;
 256         }
 257
 258         werr = gp_store_reg_val_dword(mem_ctx, key, "Version",
 259                                       gpo->version);
 260         W_ERROR_NOT_OK_RETURN(werr);
 261
 262         werr = gp_store_reg_val_dword(mem_ctx, key, "WQLFilterPass",
 263                                       true); /* fake */
 264         W_ERROR_NOT_OK_RETURN(werr);
 265
 266         werr = gp_store_reg_val_dword(mem_ctx, key, "AccessDenied",
 267                                       false); /* fake */
 268         W_ERROR_NOT_OK_RETURN(werr);
 269
 270         werr = gp_store_reg_val_dword(mem_ctx, key, "GPO-Disabled",
 271                                       (gpo->options & GPO_FLAG_DISABLE));
 272         W_ERROR_NOT_OK_RETURN(werr);
 273
 274         werr = gp_store_reg_val_dword(mem_ctx, key, "Options",
 275                                       gpo->options);
 276         W_ERROR_NOT_OK_RETURN(werr);
 277
 278         werr = gp_store_reg_val_sz(mem_ctx, key, "GPOID",
 279                                    gpo->name);
 280         W_ERROR_NOT_OK_RETURN(werr);
 281
 282         werr = gp_store_reg_val_sz(mem_ctx, key, "SOM",
 283                                    gpo->link);
 284         W_ERROR_NOT_OK_RETURN(werr);
 285
 286         werr = gp_store_reg_val_sz(mem_ctx, key, "DisplayName",
 287                                    gpo->display_name);
 288         W_ERROR_NOT_OK_RETURN(werr);
 289
 290         werr = gp_store_reg_val_sz(mem_ctx, key, "WQL-Id",
 291                                    NULL);
 292         W_ERROR_NOT_OK_RETURN(werr);
 293
 294         return werr;
 295 }
 296
 297 /****************************************************************
 298 ****************************************************************/
 299
 300 static const char *gp_reg_groupmembership_path(TALLOC_CTX *mem_ctx,
 301                                                const struct dom_sid *sid,
 302                                                uint32_t flags)
 303 {
 304         if (flags & GPO_LIST_FLAG_MACHINE) {
 305                 return "GroupMembership";
 306         }
 307
 308         return talloc_asprintf(mem_ctx, "%s\\%s", sid_string_tos(sid),
 309                                "GroupMembership");
 310 }
 311
 312 /****************************************************************
 313 ****************************************************************/
 314
 315 static WERROR gp_reg_del_groupmembership(TALLOC_CTX *mem_ctx,
 316                                          struct registry_key *key,
 317                                          const struct nt_user_token *token,
 318                                          uint32_t flags)
 319 {
 320         const char *path = NULL;
 321
 322         path = gp_reg_groupmembership_path(mem_ctx, &token->user_sids[0],
 323                                            flags);
 324         W_ERROR_HAVE_NO_MEMORY(path);
 325
 326         return reg_deletekey_recursive(mem_ctx, key, path);
 327
 328 }
 329
 330 /****************************************************************
 331 ****************************************************************/
 332
 333 static WERROR gp_reg_store_groupmembership(TALLOC_CTX *mem_ctx,
 334                                            struct gp_registry_context *reg_ctx,
 335                                            const struct nt_user_token *token,
 336                                            uint32_t flags)
 337 {
 338         struct registry_key *key = NULL;
 339         WERROR werr;
 340         int i = 0;
 341         const char *valname = NULL;
 342         const char *path = NULL;
 343         const char *val = NULL;
 344         int count = 0;
 345
 346         path = gp_reg_groupmembership_path(mem_ctx, &token->user_sids[0],
 347                                            flags);
 348         W_ERROR_HAVE_NO_MEMORY(path);
 349
 350         gp_reg_del_groupmembership(mem_ctx, reg_ctx->curr_key, token, flags);
 351
 352         werr = gp_store_reg_subkey(mem_ctx, path,
 353                                    reg_ctx->curr_key, &key);
 354         W_ERROR_NOT_OK_RETURN(werr);
 355
 356         for (i=0; i<token->num_sids; i++) {
 357
 358                 valname = talloc_asprintf(mem_ctx, "Group%d", count++);
 359                 W_ERROR_HAVE_NO_MEMORY(valname);
 360
 361                 val = sid_string_talloc(mem_ctx, &token->user_sids[i]);
 362                 W_ERROR_HAVE_NO_MEMORY(val);
 363                 werr = gp_store_reg_val_sz(mem_ctx, key, valname, val);
 364                 W_ERROR_NOT_OK_RETURN(werr);
 365         }
 366
 367         werr = gp_store_reg_val_dword(mem_ctx, key, "Count", count);
 368         W_ERROR_NOT_OK_RETURN(werr);
 369
 370         return WERR_OK;
 371 }
 372
 373 /****************************************************************
 374 ****************************************************************/
 375 #if 0
 376 /* not used yet */
 377 static WERROR gp_reg_read_groupmembership(TALLOC_CTX *mem_ctx,
 378                                           struct gp_registry_context *reg_ctx,
 379                                           const struct dom_sid *object_sid,
 380                                           struct nt_user_token **token,
 381                                           uint32_t flags)
 382 {
 383         struct registry_key *key = NULL;
 384         WERROR werr;
 385         int i = 0;
 386         const char *valname = NULL;
 387         const char *val = NULL;
 388         const char *path = NULL;
 389         uint32_t count = 0;
 390         int num_token_sids = 0;
 391         struct nt_user_token *tmp_token = NULL;
 392
 393         tmp_token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token);
 394         W_ERROR_HAVE_NO_MEMORY(tmp_token);
 395
 396         path = gp_reg_groupmembership_path(mem_ctx, object_sid, flags);
 397         W_ERROR_HAVE_NO_MEMORY(path);
 398
 399         werr = gp_read_reg_subkey(mem_ctx, reg_ctx, path, &key);
 400         W_ERROR_NOT_OK_RETURN(werr);
 401
 402         werr = gp_read_reg_val_dword(mem_ctx, key, "Count", &count);
 403         W_ERROR_NOT_OK_RETURN(werr);
 404
 405         for (i=0; i<count; i++) {
 406
 407                 valname = talloc_asprintf(mem_ctx, "Group%d", i);
 408                 W_ERROR_HAVE_NO_MEMORY(valname);
 409
 410                 werr = gp_read_reg_val_sz(mem_ctx, key, valname, &val);
 411                 W_ERROR_NOT_OK_RETURN(werr);
 412
 413                 if (!string_to_sid(&tmp_token->user_sids[num_token_sids++],
 414                                    val)) {
 415                         return WERR_INSUFFICIENT_BUFFER;
 416                 }
 417         }
 418
 419         tmp_token->num_sids = num_token_sids;
 420
 421         *token = tmp_token;
 422
 423         return WERR_OK;
 424 }
 425 #endif
 426 /****************************************************************
 427 ****************************************************************/
 428
 429 static const char *gp_req_state_path(TALLOC_CTX *mem_ctx,
 430                                      const struct dom_sid *sid,
 431                                      uint32_t flags)
 432 {
 433         if (flags & GPO_LIST_FLAG_MACHINE) {
 434                 return GPO_REG_STATE_MACHINE;
 435         }
 436
 437         return talloc_asprintf(mem_ctx, "%s\\%s", "State", sid_string_tos(sid));
 438 }
 439
 440 /****************************************************************
 441 ****************************************************************/
 442
 443 static WERROR gp_del_reg_state(TALLOC_CTX *mem_ctx,
 444                                struct registry_key *key,
 445                                const char *path)
 446 {
 447         return reg_deletesubkeys_recursive(mem_ctx, key, path);
 448 }
 449
 450 /****************************************************************
 451 ****************************************************************/
 452
 453 WERROR gp_reg_state_store(TALLOC_CTX *mem_ctx,
 454                           uint32_t flags,
 455                           const char *dn,
 456                           const struct nt_user_token *token,
 457                           struct GROUP_POLICY_OBJECT *gpo_list)
 458 {
 459         struct gp_registry_context *reg_ctx = NULL;
 460         WERROR werr = WERR_GENERAL_FAILURE;
 461         const char *subkeyname = NULL;
 462         struct GROUP_POLICY_OBJECT *gpo;
 463         int count = 0;
 464         struct registry_key *key;
 465
 466         werr = gp_init_reg_ctx(mem_ctx, KEY_GROUP_POLICY, REG_KEY_WRITE,
 467                                token, &reg_ctx);
 468         W_ERROR_NOT_OK_RETURN(werr);
 469
 470         werr = gp_secure_key(mem_ctx, flags, reg_ctx->curr_key,
 471                              &token->user_sids[0]);
 472         if (!W_ERROR_IS_OK(werr)) {
 473                 DEBUG(0,("failed to secure key: %s\n", win_errstr(werr)));
 474                 goto done;
 475         }
 476
 477         werr = gp_reg_store_groupmembership(mem_ctx, reg_ctx, token, flags);
 478         if (!W_ERROR_IS_OK(werr)) {
 479                 DEBUG(0,("failed to store group membership: %s\n", win_errstr(werr)));
 480                 goto done;
 481         }
 482
 483         subkeyname = gp_req_state_path(mem_ctx, &token->user_sids[0], flags);
 484         if (!subkeyname) {
 485                 werr = WERR_NOMEM;
 486                 goto done;
 487         }
 488
 489         werr = gp_del_reg_state(mem_ctx, reg_ctx->curr_key, subkeyname);
 490         if (!W_ERROR_IS_OK(werr)) {
 491                 DEBUG(0,("failed to delete old state: %s\n", win_errstr(werr)));
 492                 /* goto done; */
 493         }
 494
 495         werr = gp_store_reg_subkey(mem_ctx, subkeyname,
 496                                    reg_ctx->curr_key, &reg_ctx->curr_key);
 497         if (!W_ERROR_IS_OK(werr)) {
 498                 goto done;
 499         }
 500
 501         werr = gp_store_reg_val_sz(mem_ctx, reg_ctx->curr_key,
 502                                    "Distinguished-Name", dn);
 503         if (!W_ERROR_IS_OK(werr)) {
 504                 goto done;
 505         }
 506
 507         /* store link list */
 508
 509         werr = gp_store_reg_subkey(mem_ctx, "GPLink-List",
 510                                    reg_ctx->curr_key, &key);
 511         if (!W_ERROR_IS_OK(werr)) {
 512                 goto done;
 513         }
 514
 515         /* store gpo list */
 516
 517         werr = gp_store_reg_subkey(mem_ctx, "GPO-List",
 518                                    reg_ctx->curr_key, &reg_ctx->curr_key);
 519         if (!W_ERROR_IS_OK(werr)) {
 520                 goto done;
 521         }
 522
 523         for (gpo = gpo_list; gpo; gpo = gpo->next) {
 524
 525                 subkeyname = talloc_asprintf(mem_ctx, "%d", count++);
 526                 if (!subkeyname) {
 527                         werr = WERR_NOMEM;
 528                         goto done;
 529                 }
 530
 531                 werr = gp_store_reg_subkey(mem_ctx, subkeyname,
 532                                            reg_ctx->curr_key, &key);
 533                 if (!W_ERROR_IS_OK(werr)) {
 534                         goto done;
 535                 }
 536
 537                 werr = gp_store_reg_gpovals(mem_ctx, key, gpo);
 538                 if (!W_ERROR_IS_OK(werr)) {
 539                         DEBUG(0,("gp_reg_state_store: "
 540                                 "gpo_store_reg_gpovals failed for %s: %s\n",
 541                                 gpo->display_name, win_errstr(werr)));
 542                         goto done;
 543                 }
 544         }
 545  done:
 546         gp_free_reg_ctx(reg_ctx);
 547         return werr;
 548 }
 549
 550 /****************************************************************
 551 ****************************************************************/
 552
 553 static WERROR gp_read_reg_gpovals(TALLOC_CTX *mem_ctx,
 554                                   struct registry_key *key,
 555                                   struct GROUP_POLICY_OBJECT *gpo)
 556 {
 557         WERROR werr;
 558
 559         if (!key || !gpo) {
 560                 return WERR_INVALID_PARAM;
 561         }
 562
 563         werr = gp_read_reg_val_dword(mem_ctx, key, "Version",
 564                                      &gpo->version);
 565         W_ERROR_NOT_OK_RETURN(werr);
 566
 567         werr = gp_read_reg_val_dword(mem_ctx, key, "Options",
 568                                      &gpo->options);
 569         W_ERROR_NOT_OK_RETURN(werr);
 570
 571         werr = gp_read_reg_val_sz(mem_ctx, key, "GPOID",
 572                                   &gpo->name);
 573         W_ERROR_NOT_OK_RETURN(werr);
 574
 575         werr = gp_read_reg_val_sz(mem_ctx, key, "SOM",
 576                                   &gpo->link);
 577         W_ERROR_NOT_OK_RETURN(werr);
 578
 579         werr = gp_read_reg_val_sz(mem_ctx, key, "DisplayName",
 580                                   &gpo->display_name);
 581         W_ERROR_NOT_OK_RETURN(werr);
 582
 583         return werr;
 584 }
 585
 586 /****************************************************************
 587 ****************************************************************/
 588
 589 static WERROR gp_read_reg_gpo(TALLOC_CTX *mem_ctx,
 590                               struct registry_key *key,
 591                               struct GROUP_POLICY_OBJECT **gpo_ret)
 592 {
 593         struct GROUP_POLICY_OBJECT *gpo = NULL;
 594         WERROR werr;
 595
 596         if (!gpo_ret || !key) {
 597                 return WERR_INVALID_PARAM;
 598         }
 599
 600         gpo = TALLOC_ZERO_P(mem_ctx, struct GROUP_POLICY_OBJECT);
 601         W_ERROR_HAVE_NO_MEMORY(gpo);
 602
 603         werr = gp_read_reg_gpovals(mem_ctx, key, gpo);
 604         W_ERROR_NOT_OK_RETURN(werr);
 605
 606         *gpo_ret = gpo;
 607
 608         return werr;
 609 }
 610
 611 /****************************************************************
 612 ****************************************************************/
 613
 614 WERROR gp_reg_state_read(TALLOC_CTX *mem_ctx,
 615                          uint32_t flags,
 616                          const struct dom_sid *sid,
 617                          struct GROUP_POLICY_OBJECT **gpo_list)
 618 {
 619         struct gp_registry_context *reg_ctx = NULL;
 620         WERROR werr = WERR_GENERAL_FAILURE;
 621         const char *subkeyname = NULL;
 622         struct GROUP_POLICY_OBJECT *gpo = NULL;
 623         int count = 0;
 624         struct registry_key *key = NULL;
 625         const char *path = NULL;
 626         const char *gp_state_path = NULL;
 627
 628         if (!gpo_list) {
 629                 return WERR_INVALID_PARAM;
 630         }
 631
 632         ZERO_STRUCTP(gpo_list);
 633
 634         gp_state_path = gp_req_state_path(mem_ctx, sid, flags);
 635         if (!gp_state_path) {
 636                 werr = WERR_NOMEM;
 637                 goto done;
 638         }
 639
 640         path = talloc_asprintf(mem_ctx, "%s\\%s\\%s",
 641                                KEY_GROUP_POLICY,
 642                                gp_state_path,
 643                                "GPO-List");
 644         if (!path) {
 645                 werr = WERR_NOMEM;
 646                 goto done;
 647         }
 648
 649         werr = gp_init_reg_ctx(mem_ctx, path, REG_KEY_READ, NULL, &reg_ctx);
 650         if (!W_ERROR_IS_OK(werr)) {
 651                 goto done;
 652         }
 653
 654         while (1) {
 655
 656                 subkeyname = talloc_asprintf(mem_ctx, "%d", count++);
 657                 if (!subkeyname) {
 658                         werr = WERR_NOMEM;
 659                         goto done;
 660                 }
 661
 662                 werr = gp_read_reg_subkey(mem_ctx, reg_ctx, subkeyname, &key);
 663                 if (W_ERROR_EQUAL(werr, WERR_BADFILE)) {
 664                         werr = WERR_OK;
 665                         break;
 666                 }
 667                 if (!W_ERROR_IS_OK(werr)) {
 668                         DEBUG(0,("gp_reg_state_read: "
 669                                 "gp_read_reg_subkey gave: %s\n",
 670                                 win_errstr(werr)));
 671                         goto done;
 672                 }
 673
 674                 werr = gp_read_reg_gpo(mem_ctx, key, &gpo);
 675                 if (!W_ERROR_IS_OK(werr)) {
 676                         goto done;
 677                 }
 678
 679                 DLIST_ADD(*gpo_list, gpo);
 680         }
 681
 682  done:
 683         gp_free_reg_ctx(reg_ctx);
 684         return werr;
 685 }
 686
 687 /****************************************************************
 688 ****************************************************************/
 689
 690 static WERROR gp_reg_generate_sd(TALLOC_CTX *mem_ctx,
 691                                  const struct dom_sid *sid,
 692                                  struct security_descriptor **sd,
 693                                  size_t *sd_size)
 694 {
 695         struct security_ace ace[6];
 696         uint32_t mask;
 697
 698         struct security_acl *theacl = NULL;
 699
 700         uint8_t inherit_flags;
 701
 702         mask = REG_KEY_ALL;
 703         init_sec_ace(&ace[0],
 704                      &global_sid_System,
 705                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 706                      mask, 0);
 707
 708         mask = REG_KEY_ALL;
 709         init_sec_ace(&ace[1],
 710                      &global_sid_Builtin_Administrators,
 711                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 712                      mask, 0);
 713
 714         mask = REG_KEY_READ;
 715         init_sec_ace(&ace[2],
 716                      sid ? sid : &global_sid_Authenticated_Users,
 717                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 718                      mask, 0);
 719
 720         inherit_flags = SEC_ACE_FLAG_OBJECT_INHERIT |
 721                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 722                         SEC_ACE_FLAG_INHERIT_ONLY;
 723
 724         mask = REG_KEY_ALL;
 725         init_sec_ace(&ace[3],
 726                      &global_sid_System,
 727                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 728                      mask, inherit_flags);
 729
 730         mask = REG_KEY_ALL;
 731         init_sec_ace(&ace[4],
 732                      &global_sid_Builtin_Administrators,
 733                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 734                      mask, inherit_flags);
 735
 736         mask = REG_KEY_READ;
 737         init_sec_ace(&ace[5],
 738                      sid ? sid : &global_sid_Authenticated_Users,
 739                      SEC_ACE_TYPE_ACCESS_ALLOWED,
 740                      mask, inherit_flags);
 741
 742         theacl = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 6, ace);
 743         W_ERROR_HAVE_NO_MEMORY(theacl);
 744
 745         *sd = make_sec_desc(mem_ctx, SD_REVISION,
 746                             SEC_DESC_SELF_RELATIVE |
 747                             SEC_DESC_DACL_AUTO_INHERITED | /* really ? */
 748                             SEC_DESC_DACL_AUTO_INHERIT_REQ, /* really ? */
 749                             NULL, NULL, NULL,
 750                             theacl, sd_size);
 751         W_ERROR_HAVE_NO_MEMORY(*sd);
 752
 753         return WERR_OK;
 754 }
 755
 756 /****************************************************************
 757 ****************************************************************/
 758
 759 WERROR gp_secure_key(TALLOC_CTX *mem_ctx,
 760                      uint32_t flags,
 761                      struct registry_key *key,
 762                      const struct dom_sid *sid)
 763 {
 764         struct security_descriptor *sd = NULL;
 765         size_t sd_size = 0;
 766         const struct dom_sid *sd_sid = NULL;
 767         WERROR werr;
 768
 769         if (!(flags & GPO_LIST_FLAG_MACHINE)) {
 770                 sd_sid = sid;
 771         }
 772
 773         werr = gp_reg_generate_sd(mem_ctx, sd_sid, &sd, &sd_size);
 774         W_ERROR_NOT_OK_RETURN(werr);
 775
 776         return reg_setkeysecurity(key, sd);
 777 }
 778
 779 /****************************************************************
 780 ****************************************************************/
 781
 782 void dump_reg_val(int lvl, const char *direction,
 783                   const char *key, const char *subkey,
 784                   struct registry_value *val)
 785 {
 786         int i = 0;
 787         const char *type_str = NULL;
 788
 789         if (!val) {
 790                 DEBUG(lvl,("no val!\n"));
 791                 return;
 792         }
 793
 794         type_str = str_regtype(val->type);
 795
 796         DEBUG(lvl,("\tdump_reg_val:\t%s '%s'\n\t\t\t'%s' %s: ",
 797                 direction, key, subkey, type_str));
 798
 799         switch (val->type) {
 800                 case REG_DWORD:
 801                         DEBUG(lvl,("%d (0x%08x)\n",
 802                                 (int)val->v.dword, val->v.dword));
 803                         break;
 804                 case REG_QWORD:
 805                         DEBUG(lvl,("%d (0x%016llx)\n",
 806                                 (int)val->v.qword,
 807                                 (unsigned long long)val->v.qword));
 808                         break;
 809                 case REG_SZ:
 810                         DEBUG(lvl,("%s (length: %d)\n",
 811                                    val->v.sz.str,
 812                                    (int)val->v.sz.len));
 813                         break;
 814                 case REG_MULTI_SZ:
 815                         DEBUG(lvl,("(num_strings: %d)\n",
 816                                    val->v.multi_sz.num_strings));
 817                         for (i=0; i < val->v.multi_sz.num_strings; i++) {
 818                                 DEBUGADD(lvl,("\t%s\n",
 819                                         val->v.multi_sz.strings[i]));
 820                         }
 821                         break;
 822                 case REG_NONE:
 823                         DEBUG(lvl,("\n"));
 824                         break;
 825                 case REG_BINARY:
 826                         dump_data(lvl, val->v.binary.data,
 827                                   val->v.binary.length);
 828                         break;
 829                 default:
 830                         DEBUG(lvl,("unsupported type: %d\n", val->type));
 831                         break;
 832         }
 833 }
 834
 835 /****************************************************************
 836 ****************************************************************/
 837
 838 void dump_reg_entry(uint32_t flags,
 839                     const char *dir,
 840                     struct gp_registry_entry *entry)
 841 {
 842         if (!(flags & GPO_INFO_FLAG_VERBOSE))
 843                 return;
 844
 845         dump_reg_val(1, dir,
 846                      entry->key,
 847                      entry->value,
 848                      entry->data);
 849 }
 850
 851 /****************************************************************
 852 ****************************************************************/
 853
 854 void dump_reg_entries(uint32_t flags,
 855                       const char *dir,
 856                       struct gp_registry_entry *entries,
 857                       size_t num_entries)
 858 {
 859         size_t i;
 860
 861         if (!(flags & GPO_INFO_FLAG_VERBOSE))
 862                 return;
 863
 864         for (i=0; i < num_entries; i++) {
 865                 dump_reg_entry(flags, dir, &entries[i]);
 866         }
 867 }
 868
 869 /****************************************************************
 870 ****************************************************************/
 871
 872 bool add_gp_registry_entry_to_array(TALLOC_CTX *mem_ctx,
 873                                     struct gp_registry_entry *entry,
 874                                     struct gp_registry_entry **entries,
 875                                     size_t *num)
 876 {
 877         *entries = TALLOC_REALLOC_ARRAY(mem_ctx, *entries,
 878                                         struct gp_registry_entry,
 879                                         (*num)+1);
 880
 881         if (*entries == NULL) {
 882                 *num = 0;
 883                 return false;
 884         }
 885
 886         (*entries)[*num].action = entry->action;
 887         (*entries)[*num].key = entry->key;
 888         (*entries)[*num].value = entry->value;
 889         (*entries)[*num].data = entry->data;
 890
 891         *num += 1;
 892         return true;
 893 }
 894
 895 /****************************************************************
 896 ****************************************************************/
 897
 898 static const char *gp_reg_action_str(enum gp_reg_action action)
 899 {
 900         switch (action) {
 901                 case GP_REG_ACTION_NONE:
 902                         return "GP_REG_ACTION_NONE";
 903                 case GP_REG_ACTION_ADD_VALUE:
 904                         return "GP_REG_ACTION_ADD_VALUE";
 905                 case GP_REG_ACTION_ADD_KEY:
 906                         return "GP_REG_ACTION_ADD_KEY";
 907                 case GP_REG_ACTION_DEL_VALUES:
 908                         return "GP_REG_ACTION_DEL_VALUES";
 909                 case GP_REG_ACTION_DEL_VALUE:
 910                         return "GP_REG_ACTION_DEL_VALUE";
 911                 case GP_REG_ACTION_DEL_ALL_VALUES:
 912                         return "GP_REG_ACTION_DEL_ALL_VALUES";
 913                 case GP_REG_ACTION_DEL_KEYS:
 914                         return "GP_REG_ACTION_DEL_KEYS";
 915                 case GP_REG_ACTION_SEC_KEY_SET:
 916                         return "GP_REG_ACTION_SEC_KEY_SET";
 917                 case GP_REG_ACTION_SEC_KEY_RESET:
 918                         return "GP_REG_ACTION_SEC_KEY_RESET";
 919                 default:
 920                         return "unknown";
 921         }
 922 }
 923
 924 /****************************************************************
 925 ****************************************************************/
 926
 927 WERROR reg_apply_registry_entry(TALLOC_CTX *mem_ctx,
 928                                 struct registry_key *root_key,
 929                                 struct gp_registry_context *reg_ctx,
 930                                 struct gp_registry_entry *entry,
 931                                 const struct nt_user_token *token,
 932                                 uint32_t flags)
 933 {
 934         WERROR werr;
 935         struct registry_key *key = NULL;
 936
 937         if (flags & GPO_INFO_FLAG_VERBOSE) {
 938                 printf("about to store key:    [%s]\n", entry->key);
 939                 printf("               value:  [%s]\n", entry->value);
 940                 printf("               data:   [%s]\n", str_regtype(entry->data->type));
 941                 printf("               action: [%s]\n", gp_reg_action_str(entry->action));
 942         }
 943
 944         werr = gp_store_reg_subkey(mem_ctx, entry->key,
 945                                    root_key, &key);
 946                                    /* reg_ctx->curr_key, &key); */
 947         if (!W_ERROR_IS_OK(werr)) {
 948                 DEBUG(0,("gp_store_reg_subkey failed: %s\n", win_errstr(werr)));
 949                 return werr;
 950         }
 951
 952         switch (entry->action) {
 953                 case GP_REG_ACTION_NONE:
 954                 case GP_REG_ACTION_ADD_KEY:
 955                         return WERR_OK;
 956
 957                 case GP_REG_ACTION_SEC_KEY_SET:
 958                         werr = gp_secure_key(mem_ctx, flags,
 959                                              key,
 960                                              &token->user_sids[0]);
 961                         if (!W_ERROR_IS_OK(werr)) {
 962                                 DEBUG(0,("reg_apply_registry_entry: "
 963                                         "gp_secure_key failed: %s\n",
 964                                         win_errstr(werr)));
 965                                 return werr;
 966                         }
 967                         break;
 968                 case GP_REG_ACTION_ADD_VALUE:
 969                         werr = reg_setvalue(key, entry->value, entry->data);
 970                         if (!W_ERROR_IS_OK(werr)) {
 971                                 DEBUG(0,("reg_apply_registry_entry: "
 972                                         "reg_setvalue failed: %s\n",
 973                                         win_errstr(werr)));
 974                                 dump_reg_entry(flags, "STORE", entry);
 975                                 return werr;
 976                         }
 977                         break;
 978                 case GP_REG_ACTION_DEL_VALUE:
 979                         werr = reg_deletevalue(key, entry->value);
 980                         if (!W_ERROR_IS_OK(werr)) {
 981                                 DEBUG(0,("reg_apply_registry_entry: "
 982                                         "reg_deletevalue failed: %s\n",
 983                                         win_errstr(werr)));
 984                                 dump_reg_entry(flags, "STORE", entry);
 985                                 return werr;
 986                         }
 987                         break;
 988                 case GP_REG_ACTION_DEL_ALL_VALUES:
 989                         werr = reg_deleteallvalues(key);
 990                         if (!W_ERROR_IS_OK(werr)) {
 991                                 DEBUG(0,("reg_apply_registry_entry: "
 992                                         "reg_deleteallvalues failed: %s\n",
 993                                         win_errstr(werr)));
 994                                 dump_reg_entry(flags, "STORE", entry);
 995                                 return werr;
 996                         }
 997                         break;
 998                 case GP_REG_ACTION_DEL_VALUES:
 999                 case GP_REG_ACTION_DEL_KEYS:
1000                 case GP_REG_ACTION_SEC_KEY_RESET:
1001                         DEBUG(0,("reg_apply_registry_entry: "
1002                                 "not yet supported: %s (%d)\n",
1003                                 gp_reg_action_str(entry->action),
1004                                 entry->action));
1005                         return WERR_NOT_SUPPORTED;
1006                 default:
1007                         DEBUG(0,("invalid action: %d\n", entry->action));
1008                         return WERR_INVALID_PARAM;
1009         }
1010
1011         return werr;
1012 }
1013