libcli/security/access_check.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Andrew Tridgell 2004
   5    Copyright (C) Gerald Carter 2005
   6    Copyright (C) Volker Lendecke 2007
   7    Copyright (C) Jeremy Allison 2008
   8    Copyright (C) Andrew Bartlett 2010
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "libcli/security/security.h"
  26
  27 /* Map generic access rights to object specific rights.  This technique is
  28    used to give meaning to assigning read, write, execute and all access to
  29    objects.  Each type of object has its own mapping of generic to object
  30    specific access rights. */
  31
  32 void se_map_generic(uint32_t *access_mask, const struct generic_mapping *mapping)
  33 {
  34         uint32_t old_mask = *access_mask;
  35
  36         if (*access_mask & GENERIC_READ_ACCESS) {
  37                 *access_mask &= ~GENERIC_READ_ACCESS;
  38                 *access_mask |= mapping->generic_read;
  39         }
  40
  41         if (*access_mask & GENERIC_WRITE_ACCESS) {
  42                 *access_mask &= ~GENERIC_WRITE_ACCESS;
  43                 *access_mask |= mapping->generic_write;
  44         }
  45
  46         if (*access_mask & GENERIC_EXECUTE_ACCESS) {
  47                 *access_mask &= ~GENERIC_EXECUTE_ACCESS;
  48                 *access_mask |= mapping->generic_execute;
  49         }
  50
  51         if (*access_mask & GENERIC_ALL_ACCESS) {
  52                 *access_mask &= ~GENERIC_ALL_ACCESS;
  53                 *access_mask |= mapping->generic_all;
  54         }
  55
  56         if (old_mask != *access_mask) {
  57                 DEBUG(10, ("se_map_generic(): mapped mask 0x%08x to 0x%08x\n",
  58                            old_mask, *access_mask));
  59         }
  60 }
  61
  62 /* Map generic access rights to object specific rights for all the ACE's
  63  * in a security_acl.
  64  */
  65
  66 void security_acl_map_generic(struct security_acl *sa,
  67                                 const struct generic_mapping *mapping)
  68 {
  69         unsigned int i;
  70
  71         if (!sa) {
  72                 return;
  73         }
  74
  75         for (i = 0; i < sa->num_aces; i++) {
  76                 se_map_generic(&sa->aces[i].access_mask, mapping);
  77         }
  78 }
  79
  80 /* Map standard access rights to object specific rights.  This technique is
  81    used to give meaning to assigning read, write, execute and all access to
  82    objects.  Each type of object has its own mapping of standard to object
  83    specific access rights. */
  84
  85 void se_map_standard(uint32_t *access_mask, const struct standard_mapping *mapping)
  86 {
  87         uint32_t old_mask = *access_mask;
  88
  89         if (*access_mask & SEC_STD_READ_CONTROL) {
  90                 *access_mask &= ~SEC_STD_READ_CONTROL;
  91                 *access_mask |= mapping->std_read;
  92         }
  93
  94         if (*access_mask & (SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE)) {
  95                 *access_mask &= ~(SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE);
  96                 *access_mask |= mapping->std_all;
  97         }
  98
  99         if (old_mask != *access_mask) {
 100                 DEBUG(10, ("se_map_standard(): mapped mask 0x%08x to 0x%08x\n",
 101                            old_mask, *access_mask));
 102         }
 103 }
 104
 105 /*
 106   perform a SEC_FLAG_MAXIMUM_ALLOWED access check
 107 */
 108 static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
 109                                         const struct security_token *token)
 110 {
 111         uint32_t denied = 0, granted = 0;
 112         unsigned i;
 113
 114         if (security_token_has_sid(token, sd->owner_sid)) {
 115                 granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL;
 116         }
 117
 118         if (sd->dacl == NULL) {
 119                 return granted & ~denied;
 120         }
 121
 122         for (i = 0;i<sd->dacl->num_aces; i++) {
 123                 struct security_ace *ace = &sd->dacl->aces[i];
 124
 125                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 126                         continue;
 127                 }
 128
 129                 if (!security_token_has_sid(token, &ace->trustee)) {
 130                         continue;
 131                 }
 132
 133                 switch (ace->type) {
 134                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 135                         granted |= ace->access_mask;
 136                         break;
 137                 case SEC_ACE_TYPE_ACCESS_DENIED:
 138                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 139                         denied |= ace->access_mask;
 140                         break;
 141                 default:        /* Other ACE types not handled/supported */
 142                         break;
 143                 }
 144         }
 145
 146         return granted & ~denied;
 147 }
 148
 149 /*
 150   The main entry point for access checking. If returning ACCESS_DENIED
 151   this function returns the denied bits in the uint32_t pointed
 152   to by the access_granted pointer.
 153 */
 154 NTSTATUS se_access_check(const struct security_descriptor *sd,
 155                           const struct security_token *token,
 156                           uint32_t access_desired,
 157                           uint32_t *access_granted)
 158 {
 159         uint32_t i;
 160         uint32_t bits_remaining;
 161         uint32_t explicitly_denied_bits = 0;
 162         /*
 163          * Up until Windows Server 2008, owner always had these rights. Now
 164          * we have to use Owner Rights perms if they are on the file.
 165          *
 166          * In addition we have to accumulate these bits and apply them
 167          * correctly. See bug #8795
 168          */
 169         uint32_t owner_rights_allowed = 0;
 170         uint32_t owner_rights_denied = 0;
 171         bool owner_rights_default = true;
 172
 173         *access_granted = access_desired;
 174         bits_remaining = access_desired;
 175
 176         /* handle the maximum allowed flag */
 177         if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
 178                 uint32_t orig_access_desired = access_desired;
 179
 180                 access_desired |= access_check_max_allowed(sd, token);
 181                 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
 182                 *access_granted = access_desired;
 183                 bits_remaining = access_desired;
 184
 185                 DEBUG(10,("se_access_check: MAX desired = 0x%x, granted = 0x%x, remaining = 0x%x\n",
 186                         orig_access_desired,
 187                         *access_granted,
 188                         bits_remaining));
 189         }
 190
 191         /* a NULL dacl allows access */
 192         if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
 193                 *access_granted = access_desired;
 194                 return NT_STATUS_OK;
 195         }
 196
 197         if (sd->dacl == NULL) {
 198                 goto done;
 199         }
 200
 201         /* check each ace in turn. */
 202         for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
 203                 struct security_ace *ace = &sd->dacl->aces[i];
 204
 205                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 206                         continue;
 207                 }
 208
 209                 /*
 210                  * We need the Owner Rights permissions to ensure we
 211                  * give or deny the correct permissions to the owner. Replace
 212                  * owner_rights with the perms here if it is present.
 213                  *
 214                  * We don't care if we are not the owner because that is taken
 215                  * care of below when we check if our token has the owner SID.
 216                  *
 217                  */
 218                 if (dom_sid_equal(&ace->trustee, &global_sid_Owner_Rights)) {
 219                         if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
 220                                 owner_rights_allowed |= ace->access_mask;
 221                                 owner_rights_default = false;
 222                         } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
 223                                 owner_rights_denied |= ace->access_mask;
 224                                 owner_rights_default = false;
 225                         }
 226                         continue;
 227                 }
 228
 229                 if (!security_token_has_sid(token, &ace->trustee)) {
 230                         continue;
 231                 }
 232
 233                 switch (ace->type) {
 234                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 235                         bits_remaining &= ~ace->access_mask;
 236                         break;
 237                 case SEC_ACE_TYPE_ACCESS_DENIED:
 238                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 239                         explicitly_denied_bits |= (bits_remaining & ace->access_mask);
 240                         break;
 241                 default:        /* Other ACE types not handled/supported */
 242                         break;
 243                 }
 244         }
 245
 246         /* The owner always gets owner rights as defined above. */
 247         if (security_token_has_sid(token, sd->owner_sid)) {
 248                 if (owner_rights_default) {
 249                         /*
 250                          * Just remove them, no need to check if they are
 251                          * there.
 252                          */
 253                         bits_remaining &= ~(SEC_STD_WRITE_DAC |
 254                                                 SEC_STD_READ_CONTROL);
 255                 } else {
 256                         bits_remaining &= ~owner_rights_allowed;
 257                         bits_remaining |= owner_rights_denied;
 258                 }
 259         }
 260
 261         /* Explicitly denied bits always override */
 262         bits_remaining |= explicitly_denied_bits;
 263
 264         /*
 265          * We check privileges here because they override even DENY entries.
 266          */
 267
 268         /* Does the user have the privilege to gain SEC_PRIV_SECURITY? */
 269         if (bits_remaining & SEC_FLAG_SYSTEM_SECURITY) {
 270                 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
 271                         bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
 272                 } else {
 273                         return NT_STATUS_PRIVILEGE_NOT_HELD;
 274                 }
 275         }
 276
 277         if ((bits_remaining & SEC_STD_WRITE_OWNER) &&
 278              security_token_has_privilege(token, SEC_PRIV_TAKE_OWNERSHIP)) {
 279                 bits_remaining &= ~(SEC_STD_WRITE_OWNER);
 280         }
 281
 282 done:
 283         if (bits_remaining != 0) {
 284                 *access_granted = bits_remaining;
 285                 return NT_STATUS_ACCESS_DENIED;
 286         }
 287
 288         return NT_STATUS_OK;
 289 }
 290
 291 /*
 292   The main entry point for access checking FOR THE FILE SERVER ONLY !
 293   If returning ACCESS_DENIED this function returns the denied bits in
 294   the uint32_t pointed to by the access_granted pointer.
 295 */
 296 NTSTATUS se_file_access_check(const struct security_descriptor *sd,
 297                           const struct security_token *token,
 298                           bool priv_open_requested,
 299                           uint32_t access_desired,
 300                           uint32_t *access_granted)
 301 {
 302         uint32_t bits_remaining;
 303         NTSTATUS status;
 304
 305         if (!priv_open_requested) {
 306                 /* Fall back to generic se_access_check(). */
 307                 return se_access_check(sd,
 308                                 token,
 309                                 access_desired,
 310                                 access_granted);
 311         }
 312
 313         /*
 314          * We need to handle the maximum allowed flag
 315          * outside of se_access_check(), as we need to
 316          * add in the access allowed by the privileges
 317          * as well.
 318          */
 319
 320         if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
 321                 uint32_t orig_access_desired = access_desired;
 322
 323                 access_desired |= access_check_max_allowed(sd, token);
 324                 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
 325
 326                 if (security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
 327                         access_desired |= SEC_RIGHTS_PRIV_BACKUP;
 328                 }
 329
 330                 if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
 331                         access_desired |= SEC_RIGHTS_PRIV_RESTORE;
 332                 }
 333
 334                 DEBUG(10,("se_file_access_check: MAX desired = 0x%x "
 335                         "mapped to 0x%x\n",
 336                         orig_access_desired,
 337                         access_desired));
 338         }
 339
 340         status = se_access_check(sd,
 341                                 token,
 342                                 access_desired,
 343                                 access_granted);
 344
 345         if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 346                 return status;
 347         }
 348
 349         bits_remaining = *access_granted;
 350
 351         /* Check if we should override with privileges. */
 352         if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
 353             security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
 354                 bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
 355         }
 356         if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
 357             security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
 358                 bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
 359         }
 360         if (bits_remaining != 0) {
 361                 *access_granted = bits_remaining;
 362                 return NT_STATUS_ACCESS_DENIED;
 363         }
 364
 365         return NT_STATUS_OK;
 366 }
 367
 368 static const struct GUID *get_ace_object_type(struct security_ace *ace)
 369 {
 370         if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
 371                 return &ace->object.object.type.type;
 372         }
 373
 374         return NULL;
 375 }
 376
 377 /* modified access check for the purposes of DS security
 378  * Lots of code duplication, it will ve united in just one
 379  * function eventually */
 380
 381 NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
 382                              const struct security_token *token,
 383                              uint32_t access_desired,
 384                              uint32_t *access_granted,
 385                              struct object_tree *tree,
 386                              struct dom_sid *replace_sid)
 387 {
 388         uint32_t i;
 389         uint32_t bits_remaining;
 390         struct object_tree *node;
 391         const struct GUID *type;
 392         struct dom_sid self_sid;
 393
 394         dom_sid_parse(SID_NT_SELF, &self_sid);
 395
 396         *access_granted = access_desired;
 397         bits_remaining = access_desired;
 398
 399         /* handle the maximum allowed flag */
 400         if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
 401                 access_desired |= access_check_max_allowed(sd, token);
 402                 access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
 403                 *access_granted = access_desired;
 404                 bits_remaining = access_desired;
 405         }
 406
 407         if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
 408                 if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
 409                         bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
 410                 } else {
 411                         return NT_STATUS_PRIVILEGE_NOT_HELD;
 412                 }
 413         }
 414
 415         /* the owner always gets SEC_STD_WRITE_DAC and SEC_STD_READ_CONTROL */
 416         if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL)) &&
 417             security_token_has_sid(token, sd->owner_sid)) {
 418                 bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL);
 419         }
 420
 421         /* TODO: remove this, as it is file server specific */
 422         if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
 423             security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
 424                 bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
 425         }
 426         if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
 427             security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
 428                 bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
 429         }
 430
 431         /* a NULL dacl allows access */
 432         if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
 433                 *access_granted = access_desired;
 434                 return NT_STATUS_OK;
 435         }
 436
 437         if (sd->dacl == NULL) {
 438                 goto done;
 439         }
 440
 441         /* check each ace in turn. */
 442         for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
 443                 struct dom_sid *trustee;
 444                 struct security_ace *ace = &sd->dacl->aces[i];
 445
 446                 if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
 447                         continue;
 448                 }
 449
 450                 if (dom_sid_equal(&ace->trustee, &self_sid) && replace_sid) {
 451                         trustee = replace_sid;
 452                 } else {
 453                         trustee = &ace->trustee;
 454                 }
 455
 456                 if (!security_token_has_sid(token, trustee)) {
 457                         continue;
 458                 }
 459
 460                 switch (ace->type) {
 461                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 462                         if (tree) {
 463                                 object_tree_modify_access(tree, ace->access_mask);
 464                         }
 465
 466                         bits_remaining &= ~ace->access_mask;
 467                         break;
 468                 case SEC_ACE_TYPE_ACCESS_DENIED:
 469                         if (bits_remaining & ace->access_mask) {
 470                                 return NT_STATUS_ACCESS_DENIED;
 471                         }
 472                         break;
 473                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 474                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 475                         /*
 476                          * check only in case we have provided a tree,
 477                          * the ACE has an object type and that type
 478                          * is in the tree
 479                          */
 480                         type = get_ace_object_type(ace);
 481
 482                         if (!tree) {
 483                                 continue;
 484                         }
 485
 486                         if (!type) {
 487                                 node = tree;
 488                         } else {
 489                                 if (!(node = get_object_tree_by_GUID(tree, type))) {
 490                                         continue;
 491                                 }
 492                         }
 493
 494                         if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
 495                                 object_tree_modify_access(node, ace->access_mask);
 496                                 if (node->remaining_access == 0) {
 497                                         return NT_STATUS_OK;
 498                                 }
 499                         } else {
 500                                 if (node->remaining_access & ace->access_mask){
 501                                         return NT_STATUS_ACCESS_DENIED;
 502                                 }
 503                         }
 504                         break;
 505                 default:        /* Other ACE types not handled/supported */
 506                         break;
 507                 }
 508         }
 509
 510 done:
 511         if (bits_remaining != 0) {
 512                 return NT_STATUS_ACCESS_DENIED;
 513         }
 514
 515         return NT_STATUS_OK;
 516 }