dsdb-acl: add acl_check_access_on_objectclass() helper
[Samba/gebeck_regimport.git] / source4 / dsdb / samdb / ldb_modules / acl_util.c
blobbbf8e660a6b194491099bfa2def048fb5fa07e1a
1 /*
2 ACL utility functions
4 Copyright (C) Nadezhda Ivanova 2010
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 * Name: acl_util
23 * Component: ldb ACL modules
25 * Description: Some auxiliary functions used for access checking
27 * Author: Nadezhda Ivanova
29 #include "includes.h"
30 #include "ldb_module.h"
31 #include "auth/auth.h"
32 #include "libcli/security/security.h"
33 #include "dsdb/samdb/samdb.h"
34 #include "librpc/gen_ndr/ndr_security.h"
35 #include "param/param.h"
36 #include "dsdb/samdb/ldb_modules/util.h"
38 struct security_token *acl_user_token(struct ldb_module *module)
40 struct ldb_context *ldb = ldb_module_get_ctx(module);
41 struct auth_session_info *session_info
42 = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
43 if(!session_info) {
44 return NULL;
46 return session_info->security_token;
49 /* performs an access check from inside the module stack
50 * given the dn of the object to be checked, the required access
51 * guid is either the guid of the extended right, or NULL
54 int dsdb_module_check_access_on_dn(struct ldb_module *module,
55 TALLOC_CTX *mem_ctx,
56 struct ldb_dn *dn,
57 uint32_t access_mask,
58 const struct GUID *guid,
59 struct ldb_request *parent)
61 int ret;
62 struct ldb_result *acl_res;
63 static const char *acl_attrs[] = {
64 "nTSecurityDescriptor",
65 "objectSid",
66 NULL
68 struct ldb_context *ldb = ldb_module_get_ctx(module);
69 struct auth_session_info *session_info
70 = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
71 if(!session_info) {
72 return ldb_operr(ldb);
74 ret = dsdb_module_search_dn(module, mem_ctx, &acl_res, dn,
75 acl_attrs,
76 DSDB_FLAG_NEXT_MODULE |
77 DSDB_FLAG_AS_SYSTEM |
78 DSDB_SEARCH_SHOW_RECYCLED,
79 parent);
80 if (ret != LDB_SUCCESS) {
81 ldb_asprintf_errstring(ldb_module_get_ctx(module),
82 "access_check: failed to find object %s\n",
83 ldb_dn_get_linearized(dn));
84 return ret;
86 return dsdb_check_access_on_dn_internal(ldb, acl_res,
87 mem_ctx,
88 session_info->security_token,
89 dn,
90 access_mask,
91 guid);
94 int acl_check_access_on_attribute(struct ldb_module *module,
95 TALLOC_CTX *mem_ctx,
96 struct security_descriptor *sd,
97 struct dom_sid *rp_sid,
98 uint32_t access_mask,
99 const struct dsdb_attribute *attr)
101 int ret;
102 NTSTATUS status;
103 uint32_t access_granted;
104 struct object_tree *root = NULL;
105 struct object_tree *new_node = NULL;
106 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
107 struct security_token *token = acl_user_token(module);
109 if (!GUID_all_zero(&attr->attributeSecurityGUID)) {
110 if (!insert_in_object_tree(tmp_ctx,
111 &attr->attributeSecurityGUID,
112 access_mask, &root,
113 &new_node)) {
114 DEBUG(10, ("acl_search: cannot add to object tree securityGUID\n"));
115 goto fail;
118 if (!insert_in_object_tree(tmp_ctx,
119 &attr->schemaIDGUID,
120 access_mask, &new_node,
121 &new_node)) {
122 DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
123 goto fail;
125 } else {
126 if (!insert_in_object_tree(tmp_ctx,
127 &attr->schemaIDGUID,
128 access_mask, &root,
129 &new_node)) {
130 DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
131 goto fail;
135 status = sec_access_check_ds(sd, token,
136 access_mask,
137 &access_granted,
138 root,
139 rp_sid);
140 if (!NT_STATUS_IS_OK(status)) {
141 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
143 else {
144 ret = LDB_SUCCESS;
146 talloc_free(tmp_ctx);
147 return ret;
148 fail:
149 talloc_free(tmp_ctx);
150 return ldb_operr(ldb_module_get_ctx(module));
153 int acl_check_access_on_objectclass(struct ldb_module *module,
154 TALLOC_CTX *mem_ctx,
155 struct security_descriptor *sd,
156 struct dom_sid *rp_sid,
157 uint32_t access_mask,
158 const struct dsdb_class *objectclass)
160 int ret;
161 NTSTATUS status;
162 uint32_t access_granted;
163 struct object_tree *root = NULL;
164 struct object_tree *new_node = NULL;
165 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
166 struct security_token *token = acl_user_token(module);
168 if (!insert_in_object_tree(tmp_ctx,
169 &objectclass->schemaIDGUID,
170 access_mask, &root,
171 &new_node)) {
172 DEBUG(10, ("acl_search: cannot add to object tree class schemaIDGUID\n"));
173 goto fail;
176 status = sec_access_check_ds(sd, token,
177 access_mask,
178 &access_granted,
179 root,
180 rp_sid);
181 if (!NT_STATUS_IS_OK(status)) {
182 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
183 } else {
184 ret = LDB_SUCCESS;
186 talloc_free(tmp_ctx);
187 return ret;
188 fail:
189 talloc_free(tmp_ctx);
190 return ldb_operr(ldb_module_get_ctx(module));
193 /* checks for validated writes */
194 int acl_check_extended_right(TALLOC_CTX *mem_ctx,
195 struct security_descriptor *sd,
196 struct security_token *token,
197 const char *ext_right,
198 uint32_t right_type,
199 struct dom_sid *sid)
201 struct GUID right;
202 NTSTATUS status;
203 uint32_t access_granted;
204 struct object_tree *root = NULL;
205 struct object_tree *new_node = NULL;
206 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
208 GUID_from_string(ext_right, &right);
210 if (!insert_in_object_tree(tmp_ctx, &right, right_type,
211 &root, &new_node)) {
212 DEBUG(10, ("acl_ext_right: cannot add to object tree\n"));
213 talloc_free(tmp_ctx);
214 return LDB_ERR_OPERATIONS_ERROR;
216 status = sec_access_check_ds(sd, token,
217 right_type,
218 &access_granted,
219 root,
220 sid);
222 if (!NT_STATUS_IS_OK(status)) {
223 talloc_free(tmp_ctx);
224 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
226 talloc_free(tmp_ctx);
227 return LDB_SUCCESS;
230 const char *acl_user_name(TALLOC_CTX *mem_ctx, struct ldb_module *module)
232 struct ldb_context *ldb = ldb_module_get_ctx(module);
233 struct auth_session_info *session_info
234 = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
235 if (!session_info) {
236 return "UNKNOWN (NULL)";
239 return talloc_asprintf(mem_ctx, "%s\\%s",
240 session_info->info->domain_name,
241 session_info->info->account_name);
244 uint32_t dsdb_request_sd_flags(struct ldb_request *req, bool *explicit)
246 struct ldb_control *sd_control;
247 uint32_t sd_flags = 0;
249 if (explicit) {
250 *explicit = false;
253 sd_control = ldb_request_get_control(req, LDB_CONTROL_SD_FLAGS_OID);
254 if (sd_control) {
255 struct ldb_sd_flags_control *sdctr = (struct ldb_sd_flags_control *)sd_control->data;
257 sd_flags = sdctr->secinfo_flags;
259 if (explicit) {
260 *explicit = true;
263 /* mark it as handled */
264 sd_control->critical = 0;
267 /* we only care for the last 4 bits */
268 sd_flags &= 0x0000000F;
271 * MS-ADTS 3.1.1.3.4.1.11 says that no bits
272 * equals all 4 bits
274 if (sd_flags == 0) {
275 sd_flags = 0xF;
278 return sd_flags;
281 int dsdb_module_schedule_sd_propagation(struct ldb_module *module,
282 struct ldb_dn *nc_root,
283 struct ldb_dn *dn,
284 bool include_self)
286 struct ldb_context *ldb = ldb_module_get_ctx(module);
287 struct dsdb_extended_sec_desc_propagation_op *op;
288 int ret;
290 op = talloc_zero(module, struct dsdb_extended_sec_desc_propagation_op);
291 if (op == NULL) {
292 return ldb_oom(ldb);
295 op->nc_root = nc_root;
296 op->dn = dn;
297 op->include_self = include_self;
299 ret = dsdb_module_extended(module, op, NULL,
300 DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID,
302 DSDB_FLAG_TOP_MODULE |
303 DSDB_FLAG_AS_SYSTEM |
304 DSDB_FLAG_TRUSTED,
305 NULL);
306 TALLOC_FREE(op);
307 return ret;