2 Unix SMB/CIFS implementation.
4 security access checking routines
6 Copyright (C) Nadezhda Ivanova 2009
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 * Description: Contains data handler functions for
24 * the object tree that must be constructed to perform access checks.
25 * The object tree is an unbalanced tree of depth 3, indexed by
26 * object type guid. Perhaps a different data structure
27 * should be concidered later to improve performance
29 * Author: Nadezhda Ivanova
32 #include "libcli/security/security.h"
33 #include "librpc/ndr/libndr.h"
35 /* Adds a new node to the object tree. If attributeSecurityGUID is not zero and
36 * has already been added to the tree, the new node is added as a child of that node
37 * In all other cases as a child of the root
40 bool insert_in_object_tree(TALLOC_CTX
*mem_ctx
,
41 const struct GUID
*guid
,
43 struct object_tree
*root
,
44 struct object_tree
**new_node_out
)
46 struct object_tree
*new_node
;
48 if (!guid
|| GUID_all_zero(guid
)){
53 root
= talloc_zero(mem_ctx
, struct object_tree
);
61 for (i
= 0; i
< root
->num_of_children
; i
++) {
62 if (GUID_equal(&root
->children
[i
].guid
, guid
)) {
63 new_node
= &root
->children
[i
];
64 *new_node_out
= new_node
;
69 root
->children
= talloc_realloc(mem_ctx
, root
->children
,
71 root
->num_of_children
+ 1);
72 if (!root
->children
) {
75 new_node
= &root
->children
[root
->num_of_children
];
76 root
->num_of_children
++;
79 new_node
->children
= NULL
;
80 new_node
->guid
= *guid
;
81 new_node
->remaining_access
= init_access
;
82 new_node
->num_of_children
= 0;
84 *new_node_out
= new_node
;
89 struct object_tree
*get_object_tree_by_GUID(struct object_tree
*root
,
90 const struct GUID
*guid
)
92 struct object_tree
*result
= NULL
;
95 if (!root
|| GUID_equal(&root
->guid
, guid
)) {
99 else if (root
->num_of_children
> 0) {
100 for (i
= 0; i
< root
->num_of_children
; i
++) {
101 if ((result
= get_object_tree_by_GUID(&root
->children
[i
], guid
)))
108 /* Change the granted access per each ACE */
110 void object_tree_modify_access(struct object_tree
*root
,
111 uint32_t access_mask
)
113 root
->remaining_access
&= ~access_mask
;
114 if (root
->num_of_children
> 0) {
116 for (i
= 0; i
< root
->num_of_children
; i
++) {
117 object_tree_modify_access(&root
->children
[i
], access_mask
);