source4/auth/system_session.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6    Copyright (C) Jeremy Allison 2000-2001
   7    Copyright (C) Rafal Szczesniak 2002
   8    Copyright (C) Stefan Metzmacher 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "libcli/security/security.h"
  26 #include "libcli/auth/libcli_auth.h"
  27 #include "auth/credentials/credentials.h"
  28 #include "param/param.h"
  29 #include "auth/auth.h" /* for auth_serversupplied_info */
  30 #include "auth/session.h"
  31 #include "auth/system_session_proto.h"
  32
  33 /**
  34  * Create the SID list for this user.
  35  *
  36  * @note Specialised version for system sessions that doesn't use the SAM.
  37  */
  38 static NTSTATUS create_token(TALLOC_CTX *mem_ctx,
  39                                struct dom_sid *user_sid,
  40                                struct dom_sid *group_sid,
  41                                int n_groupSIDs,
  42                                struct dom_sid **groupSIDs,
  43                                bool is_authenticated,
  44                                struct security_token **token)
  45 {
  46         struct security_token *ptoken;
  47         int i;
  48
  49         ptoken = security_token_initialise(mem_ctx);
  50         NT_STATUS_HAVE_NO_MEMORY(ptoken);
  51
  52         ptoken->sids = talloc_array(ptoken, struct dom_sid *, n_groupSIDs + 5);
  53         NT_STATUS_HAVE_NO_MEMORY(ptoken->sids);
  54
  55         ptoken->user_sid = talloc_reference(ptoken, user_sid);
  56         ptoken->group_sid = talloc_reference(ptoken, group_sid);
  57         ptoken->privilege_mask = 0;
  58
  59         ptoken->sids[0] = ptoken->user_sid;
  60         ptoken->sids[1] = ptoken->group_sid;
  61
  62         /*
  63          * Finally add the "standard" SIDs.
  64          * The only difference between guest and "anonymous"
  65          * is the addition of Authenticated_Users.
  66          */
  67         ptoken->sids[2] = dom_sid_parse_talloc(ptoken->sids, SID_WORLD);
  68         NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[2]);
  69         ptoken->sids[3] = dom_sid_parse_talloc(ptoken->sids, SID_NT_NETWORK);
  70         NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[3]);
  71         ptoken->num_sids = 4;
  72
  73         if (is_authenticated) {
  74                 ptoken->sids[4] = dom_sid_parse_talloc(ptoken->sids, SID_NT_AUTHENTICATED_USERS);
  75                 NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[4]);
  76                 ptoken->num_sids++;
  77         }
  78
  79         for (i = 0; i < n_groupSIDs; i++) {
  80                 size_t check_sid_idx;
  81                 for (check_sid_idx = 1;
  82                      check_sid_idx < ptoken->num_sids;
  83                      check_sid_idx++) {
  84                         if (dom_sid_equal(ptoken->sids[check_sid_idx], groupSIDs[i])) {
  85                                 break;
  86                         }
  87                 }
  88
  89                 if (check_sid_idx == ptoken->num_sids) {
  90                         ptoken->sids[ptoken->num_sids++] = talloc_reference(ptoken->sids, groupSIDs[i]);
  91                 }
  92         }
  93
  94         *token = ptoken;
  95
  96         /* Shortcuts to prevent recursion and avoid lookups */
  97         if (ptoken->user_sid == NULL) {
  98                 ptoken->privilege_mask = 0;
  99                 return NT_STATUS_OK;
 100         }
 101
 102         if (security_token_is_system(ptoken)) {
 103                 ptoken->privilege_mask = ~0;
 104                 return NT_STATUS_OK;
 105         }
 106
 107         if (security_token_is_anonymous(ptoken)) {
 108                 ptoken->privilege_mask = 0;
 109                 return NT_STATUS_OK;
 110         }
 111
 112         DEBUG(0, ("Created token was not system or anonymous token!"));
 113         *token = NULL;
 114         return NT_STATUS_INTERNAL_ERROR;
 115 }
 116
 117 static NTSTATUS generate_session_info(TALLOC_CTX *mem_ctx,
 118                                     struct auth_serversupplied_info *server_info,
 119                                     struct auth_session_info **_session_info)
 120 {
 121         struct auth_session_info *session_info;
 122         NTSTATUS nt_status;
 123
 124         session_info = talloc(mem_ctx, struct auth_session_info);
 125         NT_STATUS_HAVE_NO_MEMORY(session_info);
 126
 127         session_info->server_info = talloc_reference(session_info, server_info);
 128
 129         /* unless set otherwise, the session key is the user session
 130          * key from the auth subsystem */
 131         session_info->session_key = server_info->user_session_key;
 132
 133         nt_status = create_token(session_info,
 134                                           server_info->account_sid,
 135                                           server_info->primary_group_sid,
 136                                           server_info->n_domain_groups,
 137                                           server_info->domain_groups,
 138                                           server_info->authenticated,
 139                                           &session_info->security_token);
 140         NT_STATUS_NOT_OK_RETURN(nt_status);
 141
 142         session_info->credentials = NULL;
 143
 144         *_session_info = session_info;
 145         return NT_STATUS_OK;
 146 }
 147
 148
 149 /*
 150   prevent the static system session being freed
 151  */
 152 static int system_session_destructor(struct auth_session_info *info)
 153 {
 154         return -1;
 155 }
 156
 157 /* Create a security token for a session SYSTEM (the most
 158  * trusted/prvilaged account), including the local machine account as
 159  * the off-host credentials
 160  */
 161 _PUBLIC_ struct auth_session_info *system_session(struct loadparm_context *lp_ctx)
 162 {
 163         static struct auth_session_info *static_session;
 164         NTSTATUS nt_status;
 165
 166         if (static_session) {
 167                 return static_session;
 168         }
 169
 170         nt_status = auth_system_session_info(talloc_autofree_context(),
 171                                              lp_ctx,
 172                                              &static_session);
 173         if (!NT_STATUS_IS_OK(nt_status)) {
 174                 talloc_free(static_session);
 175                 static_session = NULL;
 176                 return NULL;
 177         }
 178         talloc_set_destructor(static_session, system_session_destructor);
 179         return static_session;
 180 }
 181
 182 static NTSTATUS _auth_system_session_info(TALLOC_CTX *parent_ctx,
 183                                           struct loadparm_context *lp_ctx,
 184                                           bool anonymous_credentials,
 185                                           struct auth_session_info **_session_info)
 186 {
 187         NTSTATUS nt_status;
 188         struct auth_serversupplied_info *server_info = NULL;
 189         struct auth_session_info *session_info = NULL;
 190         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 191
 192         nt_status = auth_system_server_info(mem_ctx, lp_netbios_name(lp_ctx),
 193                                             &server_info);
 194         if (!NT_STATUS_IS_OK(nt_status)) {
 195                 talloc_free(mem_ctx);
 196                 return nt_status;
 197         }
 198
 199         /* references the server_info into the session_info */
 200         nt_status = generate_session_info(parent_ctx, server_info, &session_info);
 201         talloc_free(mem_ctx);
 202
 203         NT_STATUS_NOT_OK_RETURN(nt_status);
 204
 205         session_info->credentials = cli_credentials_init(session_info);
 206         if (!session_info->credentials) {
 207                 return NT_STATUS_NO_MEMORY;
 208         }
 209
 210         cli_credentials_set_conf(session_info->credentials, lp_ctx);
 211
 212         if (anonymous_credentials) {
 213                 cli_credentials_set_anonymous(session_info->credentials);
 214         } else {
 215                 cli_credentials_set_machine_account_pending(session_info->credentials, lp_ctx);
 216         }
 217         *_session_info = session_info;
 218
 219         return NT_STATUS_OK;
 220 }
 221
 222 /*
 223   Create a system session, but with anonymous credentials (so we do not need to open secrets.ldb)
 224 */
 225 _PUBLIC_ struct auth_session_info *system_session_anon(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
 226 {
 227         NTSTATUS nt_status;
 228         struct auth_session_info *session_info = NULL;
 229         nt_status = _auth_system_session_info(mem_ctx, lp_ctx, false, &session_info);
 230         if (!NT_STATUS_IS_OK(nt_status)) {
 231                 return NULL;
 232         }
 233         return session_info;
 234 }
 235
 236
 237
 238 _PUBLIC_ NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx,
 239                                            struct loadparm_context *lp_ctx,
 240                                            struct auth_session_info **_session_info)
 241 {
 242         return _auth_system_session_info(parent_ctx,
 243                         lp_ctx,
 244                         lp_parm_bool(lp_ctx, NULL, "system", "anonymous", false),
 245                         _session_info);
 246 }
 247
 248 NTSTATUS auth_system_server_info(TALLOC_CTX *mem_ctx, const char *netbios_name,
 249                                  struct auth_serversupplied_info **_server_info)
 250 {
 251         struct auth_serversupplied_info *server_info;
 252
 253         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 254         NT_STATUS_HAVE_NO_MEMORY(server_info);
 255
 256         server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_SYSTEM);
 257         NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
 258
 259         /* is this correct? */
 260         server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_ADMINISTRATORS);
 261         NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
 262
 263         server_info->n_domain_groups = 0;
 264         server_info->domain_groups = NULL;
 265
 266         /* annoying, but the Anonymous really does have a session key,
 267            and it is all zeros! */
 268         server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
 269         NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 270
 271         server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
 272         NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 273
 274         data_blob_clear(&server_info->user_session_key);
 275         data_blob_clear(&server_info->lm_session_key);
 276
 277         server_info->account_name = talloc_strdup(server_info, "SYSTEM");
 278         NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 279
 280         server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
 281         NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
 282
 283         server_info->full_name = talloc_strdup(server_info, "System");
 284         NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
 285
 286         server_info->logon_script = talloc_strdup(server_info, "");
 287         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
 288
 289         server_info->profile_path = talloc_strdup(server_info, "");
 290         NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
 291
 292         server_info->home_directory = talloc_strdup(server_info, "");
 293         NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
 294
 295         server_info->home_drive = talloc_strdup(server_info, "");
 296         NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
 297
 298         server_info->logon_server = talloc_strdup(server_info, netbios_name);
 299         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
 300
 301         server_info->last_logon = 0;
 302         server_info->last_logoff = 0;
 303         server_info->acct_expiry = 0;
 304         server_info->last_password_change = 0;
 305         server_info->allow_password_change = 0;
 306         server_info->force_password_change = 0;
 307
 308         server_info->logon_count = 0;
 309         server_info->bad_password_count = 0;
 310
 311         server_info->acct_flags = ACB_NORMAL;
 312
 313         server_info->authenticated = true;
 314
 315         *_server_info = server_info;
 316
 317         return NT_STATUS_OK;
 318 }
 319
 320
 321 /* Create server info for the Administrator account. This should only be used
 322  * during provisioning when we need to impersonate Administrator but
 323  * the account has not been created yet */
 324
 325 static NTSTATUS create_admin_token(TALLOC_CTX *mem_ctx,
 326                                    struct dom_sid *user_sid,
 327                                    struct dom_sid *group_sid,
 328                                    int n_groupSIDs,
 329                                    struct dom_sid **groupSIDs,
 330                                    struct security_token **token)
 331 {
 332         struct security_token *ptoken;
 333         int i;
 334
 335         ptoken = security_token_initialise(mem_ctx);
 336         NT_STATUS_HAVE_NO_MEMORY(ptoken);
 337
 338         ptoken->sids = talloc_array(ptoken, struct dom_sid *, n_groupSIDs + 3);
 339         NT_STATUS_HAVE_NO_MEMORY(ptoken->sids);
 340
 341         ptoken->user_sid = talloc_reference(ptoken, user_sid);
 342         ptoken->group_sid = talloc_reference(ptoken, group_sid);
 343         ptoken->privilege_mask = 0;
 344
 345         ptoken->sids[0] = ptoken->user_sid;
 346         ptoken->sids[1] = ptoken->group_sid;
 347         ptoken->sids[2] = dom_sid_parse_talloc(ptoken->sids, SID_NT_AUTHENTICATED_USERS);
 348         NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[2]);
 349         ptoken->num_sids = 3;
 350
 351
 352         for (i = 0; i < n_groupSIDs; i++) {
 353                 size_t check_sid_idx;
 354                 for (check_sid_idx = 1;
 355                      check_sid_idx < ptoken->num_sids;
 356                      check_sid_idx++) {
 357                         if (dom_sid_equal(ptoken->sids[check_sid_idx], groupSIDs[i])) {
 358                                 break;
 359                         }
 360                 }
 361
 362                 if (check_sid_idx == ptoken->num_sids) {
 363                         ptoken->sids[ptoken->num_sids++] = talloc_reference(ptoken->sids, groupSIDs[i]);
 364                 }
 365         }
 366
 367         *token = ptoken;
 368         ptoken->privilege_mask = ~0;
 369         return NT_STATUS_OK;
 370 }
 371
 372 static NTSTATUS auth_domain_admin_server_info(TALLOC_CTX *mem_ctx,
 373                                               const char *netbios_name,
 374                                               const char *domain_name,
 375                                               struct dom_sid *domain_sid,
 376                                               struct auth_serversupplied_info **_server_info)
 377 {
 378         struct auth_serversupplied_info *server_info;
 379
 380         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 381         NT_STATUS_HAVE_NO_MEMORY(server_info);
 382
 383         server_info->account_sid = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_ADMINISTRATOR);
 384         NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
 385
 386         server_info->primary_group_sid = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_USERS);
 387         NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
 388
 389         server_info->n_domain_groups = 6;
 390         server_info->domain_groups = talloc_array(server_info, struct dom_sid *, server_info->n_domain_groups);
 391
 392         server_info->domain_groups[0] = dom_sid_parse_talloc(server_info, SID_BUILTIN_ADMINISTRATORS);
 393         server_info->domain_groups[1] = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_ADMINS);
 394         server_info->domain_groups[2] = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_USERS);
 395         server_info->domain_groups[3] = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_ENTERPRISE_ADMINS);
 396         server_info->domain_groups[4] = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_POLICY_ADMINS);
 397         server_info->domain_groups[5] = dom_sid_add_rid(server_info, domain_sid, DOMAIN_RID_SCHEMA_ADMINS);
 398
 399         /* What should the session key be?*/
 400         server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
 401         NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 402
 403         server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
 404         NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 405
 406         data_blob_clear(&server_info->user_session_key);
 407         data_blob_clear(&server_info->lm_session_key);
 408
 409         server_info->account_name = talloc_strdup(server_info, "Administrator");
 410         NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 411
 412         server_info->domain_name = talloc_strdup(server_info, domain_name);
 413         NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
 414
 415         server_info->full_name = talloc_strdup(server_info, "Administrator");
 416         NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
 417
 418         server_info->logon_script = talloc_strdup(server_info, "");
 419         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
 420
 421         server_info->profile_path = talloc_strdup(server_info, "");
 422         NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
 423
 424         server_info->home_directory = talloc_strdup(server_info, "");
 425         NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
 426
 427         server_info->home_drive = talloc_strdup(server_info, "");
 428         NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
 429
 430         server_info->logon_server = talloc_strdup(server_info, netbios_name);
 431         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
 432
 433         server_info->last_logon = 0;
 434         server_info->last_logoff = 0;
 435         server_info->acct_expiry = 0;
 436         server_info->last_password_change = 0;
 437         server_info->allow_password_change = 0;
 438         server_info->force_password_change = 0;
 439
 440         server_info->logon_count = 0;
 441         server_info->bad_password_count = 0;
 442
 443         server_info->acct_flags = ACB_NORMAL;
 444
 445         server_info->authenticated = true;
 446
 447         *_server_info = server_info;
 448
 449         return NT_STATUS_OK;
 450 }
 451
 452 static NTSTATUS auth_domain_admin_session_info(TALLOC_CTX *parent_ctx,
 453                                                struct loadparm_context *lp_ctx,
 454                                                struct dom_sid *domain_sid,
 455                                                struct auth_session_info **_session_info)
 456 {
 457         NTSTATUS nt_status;
 458         struct auth_serversupplied_info *server_info = NULL;
 459         struct auth_session_info *session_info = NULL;
 460         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 461
 462         nt_status = auth_domain_admin_server_info(mem_ctx, lp_netbios_name(lp_ctx),
 463                                                   lp_workgroup(lp_ctx), domain_sid,
 464                                                   &server_info);
 465         if (!NT_STATUS_IS_OK(nt_status)) {
 466                 talloc_free(mem_ctx);
 467                 return nt_status;
 468         }
 469
 470         session_info = talloc(mem_ctx, struct auth_session_info);
 471         NT_STATUS_HAVE_NO_MEMORY(session_info);
 472
 473         session_info->server_info = talloc_reference(session_info, server_info);
 474
 475         /* unless set otherwise, the session key is the user session
 476          * key from the auth subsystem */
 477         session_info->session_key = server_info->user_session_key;
 478
 479         nt_status = create_admin_token(session_info,
 480                                        server_info->account_sid,
 481                                        server_info->primary_group_sid,
 482                                        server_info->n_domain_groups,
 483                                        server_info->domain_groups,
 484                                        &session_info->security_token);
 485         NT_STATUS_NOT_OK_RETURN(nt_status);
 486
 487         session_info->credentials = cli_credentials_init(session_info);
 488         if (!session_info->credentials) {
 489                 return NT_STATUS_NO_MEMORY;
 490         }
 491
 492         cli_credentials_set_conf(session_info->credentials, lp_ctx);
 493
 494         *_session_info = session_info;
 495
 496         return NT_STATUS_OK;
 497 }
 498
 499 _PUBLIC_ struct auth_session_info *admin_session(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, struct dom_sid *domain_sid)
 500 {
 501         NTSTATUS nt_status;
 502         struct auth_session_info *session_info = NULL;
 503         nt_status = auth_domain_admin_session_info(mem_ctx,
 504                                                    lp_ctx,
 505                                                    domain_sid,
 506                                                    &session_info);
 507         if (!NT_STATUS_IS_OK(nt_status)) {
 508                 return NULL;
 509         }
 510         return session_info;
 511 }