4 Copyright (C) Simo Sorce 2006-2008
5 Copyright (C) Nadezhda Ivanova 2010
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * Component: ldb ACL Read module
26 * Description: Module that performs authorisation access checks on read requests
27 * Only DACL checks implemented at this point
29 * Author: Nadezhda Ivanova
33 #include "ldb_module.h"
34 #include "auth/auth.h"
35 #include "libcli/security/security.h"
36 #include "dsdb/samdb/samdb.h"
37 #include "librpc/gen_ndr/ndr_security.h"
38 #include "param/param.h"
39 #include "dsdb/samdb/ldb_modules/util.h"
42 struct aclread_context
{
43 struct ldb_module
*module
;
44 struct ldb_request
*req
;
45 const char * const *attrs
;
46 const struct dsdb_schema
*schema
;
53 struct aclread_private
{
57 static void aclread_mark_inaccesslible(struct ldb_message_element
*el
) {
58 el
->flags
|= LDB_FLAG_INTERNAL_INACCESSIBLE_ATTRIBUTE
;
61 static bool aclread_is_inaccessible(struct ldb_message_element
*el
) {
62 return el
->flags
& LDB_FLAG_INTERNAL_INACCESSIBLE_ATTRIBUTE
;
65 static int aclread_callback(struct ldb_request
*req
, struct ldb_reply
*ares
)
67 struct ldb_context
*ldb
;
68 struct aclread_context
*ac
;
69 struct ldb_message
*ret_msg
;
70 struct ldb_message
*msg
;
71 int ret
, num_of_attrs
= 0;
72 unsigned int i
, k
= 0;
73 struct security_descriptor
*sd
;
74 struct dom_sid
*sid
= NULL
;
76 uint32_t instanceType
;
78 ac
= talloc_get_type(req
->context
, struct aclread_context
);
79 ldb
= ldb_module_get_ctx(ac
->module
);
81 return ldb_module_done(ac
->req
, NULL
, NULL
, LDB_ERR_OPERATIONS_ERROR
);
83 if (ares
->error
!= LDB_SUCCESS
) {
84 return ldb_module_done(ac
->req
, ares
->controls
,
85 ares
->response
, ares
->error
);
87 tmp_ctx
= talloc_new(ac
);
91 ret
= dsdb_get_sd_from_ldb_message(ldb
, tmp_ctx
, msg
, &sd
);
92 if (ret
!= LDB_SUCCESS
|| sd
== NULL
) {
93 DEBUG(10, ("acl_read: cannot get descriptor\n"));
94 ret
= LDB_ERR_OPERATIONS_ERROR
;
97 sid
= samdb_result_dom_sid(tmp_ctx
, msg
, "objectSid");
98 /* get the object instance type */
99 instanceType
= ldb_msg_find_attr_as_uint(msg
,
101 if (!ldb_dn_is_null(msg
->dn
) && !(instanceType
& INSTANCE_TYPE_IS_NC_HEAD
))
103 /* the object has a parent, so we have to check for visibility */
104 struct ldb_dn
*parent_dn
= ldb_dn_get_parent(tmp_ctx
, msg
->dn
);
106 ret
= dsdb_module_check_access_on_dn(ac
->module
,
111 if (ret
== LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
) {
112 talloc_free(tmp_ctx
);
114 } else if (ret
!= LDB_SUCCESS
) {
118 /* for every element in the message check RP */
119 for (i
=0; i
< msg
->num_elements
; i
++) {
120 const struct dsdb_attribute
*attr
;
121 bool is_sd
, is_objectsid
, is_instancetype
;
122 uint32_t access_mask
;
123 attr
= dsdb_attribute_by_lDAPDisplayName(ac
->schema
,
124 msg
->elements
[i
].name
);
126 DEBUG(2, ("acl_read: cannot find attribute %s in schema\n",
127 msg
->elements
[i
].name
));
128 ret
= LDB_ERR_OPERATIONS_ERROR
;
131 is_sd
= ldb_attr_cmp("nTSecurityDescriptor",
132 msg
->elements
[i
].name
) == 0;
133 is_objectsid
= ldb_attr_cmp("objectSid",
134 msg
->elements
[i
].name
) == 0;
135 is_instancetype
= ldb_attr_cmp("instanceType",
136 msg
->elements
[i
].name
) == 0;
137 /* these attributes were added to perform access checks and must be removed */
138 if (is_objectsid
&& ac
->object_sid
) {
139 aclread_mark_inaccesslible(&msg
->elements
[i
]);
142 if (is_instancetype
&& ac
->instance_type
) {
143 aclread_mark_inaccesslible(&msg
->elements
[i
]);
146 if (is_sd
&& ac
->sd
) {
147 aclread_mark_inaccesslible(&msg
->elements
[i
]);
150 /* nTSecurityDescriptor is a special case */
152 access_mask
= SEC_FLAG_SYSTEM_SECURITY
|SEC_STD_READ_CONTROL
;
154 access_mask
= SEC_ADS_READ_PROP
;
157 ret
= acl_check_access_on_attribute(ac
->module
,
165 * Dirsync control needs the replpropertymetadata attribute
166 * so return it as it will be removed by the control
169 if (ret
== LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
) {
170 if (!ac
->indirsync
) {
172 * do not return this entry if attribute is
173 * part of the search filter
175 if (dsdb_attr_in_parse_tree(ac
->req
->op
.search
.tree
,
176 msg
->elements
[i
].name
)) {
177 talloc_free(tmp_ctx
);
180 aclread_mark_inaccesslible(&msg
->elements
[i
]);
183 * We are doing dirysnc answers
184 * and the object shouldn't be returned (normally)
185 * but we will return it without replPropertyMetaData
186 * so that the dirysync module will do what is needed
187 * (remove the object if it is not deleted, or return
188 * just the objectGUID if it's deleted).
190 if (dsdb_attr_in_parse_tree(ac
->req
->op
.search
.tree
,
191 msg
->elements
[i
].name
)) {
192 ldb_msg_remove_attr(msg
, "replPropertyMetaData");
195 aclread_mark_inaccesslible(&msg
->elements
[i
]);
198 } else if (ret
!= LDB_SUCCESS
) {
202 for (i
=0; i
< msg
->num_elements
; i
++) {
203 if (!aclread_is_inaccessible(&msg
->elements
[i
])) {
207 /*create a new message to return*/
208 ret_msg
= ldb_msg_new(ac
->req
);
209 ret_msg
->dn
= msg
->dn
;
210 talloc_steal(ret_msg
, msg
->dn
);
211 ret_msg
->num_elements
= num_of_attrs
;
212 if (num_of_attrs
> 0) {
213 ret_msg
->elements
= talloc_array(ret_msg
,
214 struct ldb_message_element
,
216 if (ret_msg
->elements
== NULL
) {
219 for (i
=0; i
< msg
->num_elements
; i
++) {
220 bool to_remove
= aclread_is_inaccessible(&msg
->elements
[i
]);
222 ret_msg
->elements
[k
] = msg
->elements
[i
];
223 talloc_steal(ret_msg
->elements
, msg
->elements
[i
].name
);
224 talloc_steal(ret_msg
->elements
, msg
->elements
[i
].values
);
229 ret_msg
->elements
= NULL
;
231 talloc_free(tmp_ctx
);
233 return ldb_module_send_entry(ac
->req
, ret_msg
, ares
->controls
);
234 case LDB_REPLY_REFERRAL
:
235 return ldb_module_send_referral(ac
->req
, ares
->referral
);
237 return ldb_module_done(ac
->req
, ares
->controls
,
238 ares
->response
, LDB_SUCCESS
);
243 talloc_free(tmp_ctx
);
244 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
248 static int aclread_search(struct ldb_module
*module
, struct ldb_request
*req
)
250 struct ldb_context
*ldb
;
252 struct aclread_context
*ac
;
253 struct ldb_request
*down_req
;
254 struct ldb_control
*as_system
= ldb_request_get_control(req
, LDB_CONTROL_AS_SYSTEM_OID
);
255 uint32_t flags
= ldb_req_get_custom_flags(req
);
256 struct ldb_result
*res
;
257 struct aclread_private
*p
;
258 bool is_untrusted
= ldb_req_is_untrusted(req
);
259 const char * const *attrs
= NULL
;
260 uint32_t instanceType
;
261 static const char *acl_attrs
[] = {
266 ldb
= ldb_module_get_ctx(module
);
267 p
= talloc_get_type(ldb_module_get_private(module
), struct aclread_private
);
269 /* skip access checks if we are system or system control is supplied
270 * or this is not LDAP server request */
271 if (!p
|| !p
->enabled
||
272 dsdb_module_am_system(module
)
273 || as_system
|| !is_untrusted
) {
274 return ldb_next_request(module
, req
);
276 /* no checks on special dn */
277 if (ldb_dn_is_special(req
->op
.search
.base
)) {
278 return ldb_next_request(module
, req
);
281 /* check accessibility of base */
282 if (!ldb_dn_is_null(req
->op
.search
.base
)) {
283 ret
= dsdb_module_search_dn(module
, req
, &res
, req
->op
.search
.base
,
285 DSDB_FLAG_NEXT_MODULE
|
286 DSDB_SEARCH_SHOW_DELETED
, req
);
287 if (ret
!= LDB_SUCCESS
) {
288 return ldb_error(ldb
, ret
,
289 "acl_read: Error retrieving instanceType for base.");
291 instanceType
= ldb_msg_find_attr_as_uint(res
->msgs
[0],
293 if (instanceType
!= 0 && !(instanceType
& INSTANCE_TYPE_IS_NC_HEAD
))
295 /* the object has a parent, so we have to check for visibility */
296 struct ldb_dn
*parent_dn
= ldb_dn_get_parent(req
, req
->op
.search
.base
);
297 ret
= dsdb_module_check_access_on_dn(module
,
302 if (ret
== LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
) {
303 return ldb_module_done(req
, NULL
, NULL
, LDB_ERR_NO_SUCH_OBJECT
);
304 } else if (ret
!= LDB_SUCCESS
) {
305 return ldb_module_done(req
, NULL
, NULL
, ret
);
309 ac
= talloc_zero(req
, struct aclread_context
);
315 ac
->schema
= dsdb_get_schema(ldb
, req
);
316 if (flags
& DSDB_ACL_CHECKS_DIRSYNC_FLAG
) {
317 ac
->indirsync
= true;
319 ac
->indirsync
= false;
322 return ldb_operr(ldb
);
325 * In theory we should also check for the SD control but control verification is
326 * expensive so we'd better had the ntsecuritydescriptor to the list of
327 * searched attribute and then remove it !
329 ac
->sd
= !(ldb_attr_in_list(req
->op
.search
.attrs
, "nTSecurityDescriptor"));
330 if (req
->op
.search
.attrs
&& !ldb_attr_in_list(req
->op
.search
.attrs
, "*")) {
331 if (!ldb_attr_in_list(req
->op
.search
.attrs
, "instanceType")) {
332 ac
->instance_type
= true;
333 attrs
= ldb_attr_list_copy_add(ac
, req
->op
.search
.attrs
, "instanceType");
335 attrs
= req
->op
.search
.attrs
;
337 if (!ldb_attr_in_list(req
->op
.search
.attrs
, "objectSid")) {
338 ac
->object_sid
= true;
339 attrs
= ldb_attr_list_copy_add(ac
, attrs
, "objectSid");
344 /* avoid replacing all attributes with nTSecurityDescriptor
345 * if attribute list is empty */
347 attrs
= ldb_attr_list_copy_add(ac
, req
->op
.search
.attrs
, "*");
349 attrs
= ldb_attr_list_copy_add(ac
, attrs
, "nTSecurityDescriptor");
351 ac
->attrs
= req
->op
.search
.attrs
;
352 ret
= ldb_build_search_req_ex(&down_req
,
355 req
->op
.search
.scope
,
359 ac
, aclread_callback
,
362 if (ret
!= LDB_SUCCESS
) {
363 return LDB_ERR_OPERATIONS_ERROR
;
366 return ldb_next_request(module
, down_req
);
369 static int aclread_init(struct ldb_module
*module
)
371 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
372 struct aclread_private
*p
= talloc_zero(module
, struct aclread_private
);
374 return ldb_module_oom(module
);
376 p
->enabled
= lpcfg_parm_bool(ldb_get_opaque(ldb
, "loadparm"), NULL
, "acl", "search", false);
377 ldb_module_set_private(module
, p
);
378 return ldb_next_init(module
);
381 static const struct ldb_module_ops ldb_aclread_module_ops
= {
383 .search
= aclread_search
,
384 .init_context
= aclread_init
387 int ldb_aclread_module_init(const char *version
)
389 LDB_MODULE_CHECK_VERSION(version
);
390 return ldb_register_module(&ldb_aclread_module_ops
);