libgpo/gpo_sec.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Group Policy Object Support
   4  *  Copyright (C) Guenther Deschner 2007
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "libcli/security/security.h"
  22 #include "../libgpo/gpo.h"
  23 #include "auth.h"
  24 #include "../librpc/ndr/libndr.h"
  25
  26 /****************************************************************
  27 ****************************************************************/
  28
  29 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
  30 {
  31         struct GUID ext_right_apg_guid;
  32         NTSTATUS status;
  33
  34         if (!object) {
  35                 return false;
  36         }
  37
  38         status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
  39                                   &ext_right_apg_guid);
  40         if (!NT_STATUS_IS_OK(status)) {
  41                 return false;
  42         }
  43
  44         switch (object->flags) {
  45                 case SEC_ACE_OBJECT_TYPE_PRESENT:
  46                         if (GUID_equal(&object->type.type,
  47                                        &ext_right_apg_guid)) {
  48                                 return true;
  49                         }
  50                         /* FALL TROUGH */
  51                 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
  52                         if (GUID_equal(&object->inherited_type.inherited_type,
  53                                        &ext_right_apg_guid)) {
  54                                 return true;
  55                         }
  56                         /* FALL TROUGH */
  57                 default:
  58                         break;
  59         }
  60
  61         return false;
  62 }
  63
  64 /****************************************************************
  65 ****************************************************************/
  66
  67 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
  68 {
  69         if (!sec_ace_object(ace->type)) {
  70                 return false;
  71         }
  72
  73         return gpo_sd_check_agp_object_guid(&ace->object.object);
  74 }
  75
  76 /****************************************************************
  77 ****************************************************************/
  78
  79 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
  80 {
  81         return (access_mask & SEC_ADS_CONTROL_ACCESS);
  82 }
  83
  84 #if 0
  85 /****************************************************************
  86 ****************************************************************/
  87
  88 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
  89 {
  90         uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
  91                            SEC_RIGHTS_READ_ALL_PROP |
  92                            SEC_RIGHTS_READ_PERMS;
  93
  94         return (read_bits == (access_mask & read_bits));
  95 }
  96 #endif
  97
  98 /****************************************************************
  99 ****************************************************************/
 100
 101 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
 102                                                const struct security_token *token)
 103 {
 104         char *sid_str;
 105
 106         if (gpo_sd_check_agp_object(ace) &&
 107             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 108             security_token_has_sid(token, &ace->trustee)) {
 109                 sid_str = dom_sid_string(NULL, &ace->trustee);
 110                 DEBUG(10,("gpo_sd_check_ace_denied_object: "
 111                         "Access denied as of ace for %s\n",
 112                         sid_str));
 113                 talloc_free(sid_str);
 114                 return NT_STATUS_ACCESS_DENIED;
 115         }
 116
 117         return STATUS_MORE_ENTRIES;
 118 }
 119
 120 /****************************************************************
 121 ****************************************************************/
 122
 123 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
 124                                                 const struct security_token *token)
 125 {
 126         char *sid_str;
 127
 128         if (gpo_sd_check_agp_object(ace) &&
 129             gpo_sd_check_agp_access_bits(ace->access_mask) &&
 130             security_token_has_sid(token, &ace->trustee)) {
 131                 sid_str = dom_sid_string(NULL, &ace->trustee);
 132                 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
 133                         "Access granted as of ace for %s\n",
 134                         sid_str));
 135                 talloc_free(sid_str);
 136
 137                 return NT_STATUS_OK;
 138         }
 139
 140         return STATUS_MORE_ENTRIES;
 141 }
 142
 143 /****************************************************************
 144 ****************************************************************/
 145
 146 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
 147                                  const struct security_token *token)
 148 {
 149         switch (ace->type) {
 150                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 151                         return gpo_sd_check_ace_denied_object(ace, token);
 152                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 153                         return gpo_sd_check_ace_allowed_object(ace, token);
 154                 default:
 155                         return STATUS_MORE_ENTRIES;
 156         }
 157 }
 158
 159 /****************************************************************
 160 ****************************************************************/
 161
 162 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
 163                                       const struct security_token *token)
 164 {
 165         struct security_descriptor *sd = gpo->security_descriptor;
 166         struct security_acl *dacl = NULL;
 167         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 168         int i;
 169
 170         if (!token) {
 171                 return NT_STATUS_INVALID_USER_BUFFER;
 172         }
 173
 174         if (!sd) {
 175                 return NT_STATUS_INVALID_SECURITY_DESCR;
 176         }
 177
 178         dacl = sd->dacl;
 179         if (!dacl) {
 180                 return NT_STATUS_INVALID_SECURITY_DESCR;
 181         }
 182
 183         /* check all aces and only return NT_STATUS_OK (== Access granted) or
 184          * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
 185          * deny access */
 186
 187         for (i = 0; i < dacl->num_aces; i ++) {
 188
 189                 status = gpo_sd_check_ace(&dacl->aces[i], token);
 190
 191                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 192                         return status;
 193                 } else if (NT_STATUS_IS_OK(status)) {
 194                         return status;
 195                 }
 196
 197                 continue;
 198         }
 199
 200         return NT_STATUS_ACCESS_DENIED;
 201 }