source4/dsdb/samdb/samdb_privilege.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    manipulate privilege records in samdb
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/ldap/ldap_ndr.h"
  24 #include "dsdb/samdb/samdb.h"
  25 #include "auth/auth.h"
  26 #include "libcli/security/security.h"
  27 #include "../lib/util/util_ldb.h"
  28 #include "param/param.h"
  29 #include "ldb_wrap.h"
  30
  31 /* connect to the privilege database */
  32 struct ldb_context *privilege_connect(TALLOC_CTX *mem_ctx,
  33                                       struct loadparm_context *lp_ctx)
  34 {
  35         return ldb_wrap_connect(mem_ctx, NULL, lp_ctx, "privilege.ldb",
  36                                 NULL, NULL, 0);
  37 }
  38
  39 /*
  40   add privilege bits for one sid to a security_token
  41 */
  42 static NTSTATUS samdb_privilege_setup_sid(struct ldb_context *pdb, TALLOC_CTX *mem_ctx,
  43                                           struct security_token *token,
  44                                           const struct dom_sid *sid)
  45 {
  46         const char * const attrs[] = { "privilege", NULL };
  47         struct ldb_message **res = NULL;
  48         struct ldb_message_element *el;
  49         unsigned int i;
  50         int ret;
  51         char *sidstr;
  52
  53         sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
  54         NT_STATUS_HAVE_NO_MEMORY(sidstr);
  55
  56         ret = gendb_search(pdb, mem_ctx, NULL, &res, attrs, "objectSid=%s", sidstr);
  57         talloc_free(sidstr);
  58         if (ret != 1) {
  59                 /* not an error to not match */
  60                 return NT_STATUS_OK;
  61         }
  62
  63         el = ldb_msg_find_element(res[0], "privilege");
  64         if (el == NULL) {
  65                 return NT_STATUS_OK;
  66         }
  67
  68         for (i=0;i<el->num_values;i++) {
  69                 const char *priv_str = (const char *)el->values[i].data;
  70                 enum sec_privilege privilege = sec_privilege_id(priv_str);
  71                 if (privilege == SEC_PRIV_INVALID) {
  72                         uint32_t right_bit = sec_right_bit(priv_str);
  73                         security_token_set_right_bit(token, right_bit);
  74                         if (right_bit == 0) {
  75                                 DEBUG(1,("Unknown privilege '%s' in samdb\n",
  76                                          priv_str));
  77                         }
  78                         continue;
  79                 }
  80                 security_token_set_privilege(token, privilege);
  81         }
  82
  83         return NT_STATUS_OK;
  84 }
  85
  86 /*
  87   setup the privilege mask for this security token based on our
  88   local SAM
  89 */
  90 NTSTATUS samdb_privilege_setup(struct loadparm_context *lp_ctx, struct security_token *token)
  91 {
  92         struct ldb_context *pdb;
  93         TALLOC_CTX *mem_ctx;
  94         unsigned int i;
  95         NTSTATUS status;
  96
  97         /* Shortcuts to prevent recursion and avoid lookups */
  98         if (token->sids == NULL) {
  99                 token->privilege_mask = 0;
 100                 return NT_STATUS_OK;
 101         }
 102
 103         if (security_token_is_system(token)) {
 104                 token->privilege_mask = ~0;
 105                 return NT_STATUS_OK;
 106         }
 107
 108         if (security_token_is_anonymous(token)) {
 109                 token->privilege_mask = 0;
 110                 return NT_STATUS_OK;
 111         }
 112
 113         mem_ctx = talloc_new(token);
 114         pdb = privilege_connect(mem_ctx, lp_ctx);
 115         if (pdb == NULL) {
 116                 talloc_free(mem_ctx);
 117                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 118         }
 119
 120         token->privilege_mask = 0;
 121
 122         for (i=0;i<token->num_sids;i++) {
 123                 status = samdb_privilege_setup_sid(pdb, mem_ctx,
 124                                                    token, &token->sids[i]);
 125                 if (!NT_STATUS_IS_OK(status)) {
 126                         talloc_free(mem_ctx);
 127                         return status;
 128                 }
 129         }
 130
 131         talloc_free(mem_ctx);
 132
 133         return NT_STATUS_OK;
 134 }