libcli/security/display_sec.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions
   4    Copyright (C) Andrew Tridgell 1992-1999
   5    Copyright (C) Luke Kenneth Casson Leighton 1996 - 1999
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "librpc/gen_ndr/security.h"
  23 #include "libcli/security/secace.h"
  24 #include "libcli/security/dom_sid.h"
  25 #include "librpc/ndr/libndr.h"
  26
  27 /****************************************************************************
  28 convert a security permissions into a string
  29 ****************************************************************************/
  30
  31 char *get_sec_mask_str(TALLOC_CTX *ctx, uint32_t type)
  32 {
  33         char *typestr = talloc_strdup(ctx, "");
  34
  35         if (!typestr) {
  36                 return NULL;
  37         }
  38
  39         if (type & SEC_GENERIC_ALL) {
  40                 typestr = talloc_asprintf_append(typestr,
  41                                 "Generic all access ");
  42                 if (!typestr) {
  43                         return NULL;
  44                 }
  45         }
  46         if (type & SEC_GENERIC_EXECUTE) {
  47                 typestr = talloc_asprintf_append(typestr,
  48                                 "Generic execute access");
  49                 if (!typestr) {
  50                         return NULL;
  51                 }
  52         }
  53         if (type & SEC_GENERIC_WRITE) {
  54                 typestr = talloc_asprintf_append(typestr,
  55                                 "Generic write access ");
  56                 if (!typestr) {
  57                         return NULL;
  58                 }
  59         }
  60         if (type & SEC_GENERIC_READ) {
  61                 typestr = talloc_asprintf_append(typestr,
  62                                 "Generic read access ");
  63                 if (!typestr) {
  64                         return NULL;
  65                 }
  66         }
  67         if (type & SEC_FLAG_MAXIMUM_ALLOWED) {
  68                 typestr = talloc_asprintf_append(typestr,
  69                                 "MAXIMUM_ALLOWED_ACCESS ");
  70                 if (!typestr) {
  71                         return NULL;
  72                 }
  73         }
  74         if (type & SEC_FLAG_SYSTEM_SECURITY) {
  75                 typestr = talloc_asprintf_append(typestr,
  76                                 "SYSTEM_SECURITY_ACCESS ");
  77                 if (!typestr) {
  78                         return NULL;
  79                 }
  80         }
  81         if (type & SEC_STD_SYNCHRONIZE) {
  82                 typestr = talloc_asprintf_append(typestr,
  83                                 "SYNCHRONIZE_ACCESS ");
  84                 if (!typestr) {
  85                         return NULL;
  86                 }
  87         }
  88         if (type & SEC_STD_WRITE_OWNER) {
  89                 typestr = talloc_asprintf_append(typestr,
  90                                 "WRITE_OWNER_ACCESS ");
  91                 if (!typestr) {
  92                         return NULL;
  93                 }
  94         }
  95         if (type & SEC_STD_WRITE_DAC) {
  96                 typestr = talloc_asprintf_append(typestr,
  97                                 "WRITE_DAC_ACCESS ");
  98                 if (!typestr) {
  99                         return NULL;
 100                 }
 101         }
 102         if (type & SEC_STD_READ_CONTROL) {
 103                 typestr = talloc_asprintf_append(typestr,
 104                                 "READ_CONTROL_ACCESS ");
 105                 if (!typestr) {
 106                         return NULL;
 107                 }
 108         }
 109         if (type & SEC_STD_DELETE) {
 110                 typestr = talloc_asprintf_append(typestr,
 111                                 "DELETE_ACCESS ");
 112                 if (!typestr) {
 113                         return NULL;
 114                 }
 115         }
 116
 117         printf("\t\tSpecific bits: 0x%lx\n", (unsigned long)type&SEC_MASK_SPECIFIC);
 118
 119         return typestr;
 120 }
 121
 122 /****************************************************************************
 123  display sec_access structure
 124  ****************************************************************************/
 125 void display_sec_access(uint32_t *info)
 126 {
 127         char *mask_str = get_sec_mask_str(NULL, *info);
 128         printf("\t\tPermissions: 0x%x: %s\n", *info, mask_str ? mask_str : "");
 129         talloc_free(mask_str);
 130 }
 131
 132 /****************************************************************************
 133  display sec_ace flags
 134  ****************************************************************************/
 135 void display_sec_ace_flags(uint8_t flags)
 136 {
 137         if (flags & SEC_ACE_FLAG_OBJECT_INHERIT)
 138                 printf("SEC_ACE_FLAG_OBJECT_INHERIT ");
 139         if (flags & SEC_ACE_FLAG_CONTAINER_INHERIT)
 140                 printf(" SEC_ACE_FLAG_CONTAINER_INHERIT ");
 141         if (flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)
 142                 printf("SEC_ACE_FLAG_NO_PROPAGATE_INHERIT ");
 143         if (flags & SEC_ACE_FLAG_INHERIT_ONLY)
 144                 printf("SEC_ACE_FLAG_INHERIT_ONLY ");
 145         if (flags & SEC_ACE_FLAG_INHERITED_ACE)
 146                 printf("SEC_ACE_FLAG_INHERITED_ACE ");
 147 /*      if (flags & SEC_ACE_FLAG_VALID_INHERIT)
 148                 printf("SEC_ACE_FLAG_VALID_INHERIT "); */
 149         if (flags & SEC_ACE_FLAG_SUCCESSFUL_ACCESS)
 150                 printf("SEC_ACE_FLAG_SUCCESSFUL_ACCESS ");
 151         if (flags & SEC_ACE_FLAG_FAILED_ACCESS)
 152                 printf("SEC_ACE_FLAG_FAILED_ACCESS ");
 153
 154         printf("\n");
 155 }
 156
 157 /****************************************************************************
 158  display sec_ace object
 159  ****************************************************************************/
 160 static void disp_sec_ace_object(struct security_ace_object *object)
 161 {
 162         char *str;
 163         if (object->flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
 164                 str = GUID_string(NULL, &object->type.type);
 165                 if (str == NULL) return;
 166                 printf("Object type: SEC_ACE_OBJECT_TYPE_PRESENT\n");
 167                 printf("Object GUID: %s\n", str);
 168                 talloc_free(str);
 169         }
 170         if (object->flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT) {
 171                 str = GUID_string(NULL, &object->inherited_type.inherited_type);
 172                 if (str == NULL) return;
 173                 printf("Object type: SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT\n");
 174                 printf("Object GUID: %s\n", str);
 175                 talloc_free(str);
 176         }
 177 }
 178
 179 /****************************************************************************
 180  display sec_ace structure
 181  ****************************************************************************/
 182 void display_sec_ace(struct security_ace *ace)
 183 {
 184         char *sid_str;
 185
 186         printf("\tACE\n\t\ttype: ");
 187         switch (ace->type) {
 188                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
 189                         printf("ACCESS ALLOWED");
 190                         break;
 191                 case SEC_ACE_TYPE_ACCESS_DENIED:
 192                         printf("ACCESS DENIED");
 193                         break;
 194                 case SEC_ACE_TYPE_SYSTEM_AUDIT:
 195                         printf("SYSTEM AUDIT");
 196                         break;
 197                 case SEC_ACE_TYPE_SYSTEM_ALARM:
 198                         printf("SYSTEM ALARM");
 199                         break;
 200                 case SEC_ACE_TYPE_ALLOWED_COMPOUND:
 201                         printf("SEC_ACE_TYPE_ALLOWED_COMPOUND");
 202                         break;
 203                 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
 204                         printf("SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT");
 205                         break;
 206                 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
 207                         printf("SEC_ACE_TYPE_ACCESS_DENIED_OBJECT");
 208                         break;
 209                 case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
 210                         printf("SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT");
 211                         break;
 212                 case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
 213                         printf("SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT");
 214                         break;
 215                 default:
 216                         printf("????");
 217                         break;
 218         }
 219
 220         printf(" (%d) flags: 0x%02x ", ace->type, ace->flags);
 221         display_sec_ace_flags(ace->flags);
 222         display_sec_access(&ace->access_mask);
 223         sid_str = dom_sid_string(NULL, &ace->trustee);
 224         printf("\t\tSID: %s\n\n", sid_str);
 225         talloc_free(sid_str);
 226
 227         if (sec_ace_object(ace->type)) {
 228                 disp_sec_ace_object(&ace->object.object);
 229         }
 230
 231 }
 232
 233 /****************************************************************************
 234  display sec_acl structure
 235  ****************************************************************************/
 236 void display_sec_acl(struct security_acl *sec_acl)
 237 {
 238         int i;
 239
 240         printf("\tACL\tNum ACEs:\t%d\trevision:\t%x\n",
 241                          sec_acl->num_aces, sec_acl->revision);
 242         printf("\t---\n");
 243
 244         if (sec_acl->size != 0 && sec_acl->num_aces != 0) {
 245                 for (i = 0; i < sec_acl->num_aces; i++) {
 246                         display_sec_ace(&sec_acl->aces[i]);
 247                 }
 248         }
 249 }
 250
 251 void display_acl_type(uint16_t type)
 252 {
 253         printf("type: 0x%04x: ", type);
 254
 255         if (type & SEC_DESC_OWNER_DEFAULTED)    /* 0x0001 */
 256                 printf("SEC_DESC_OWNER_DEFAULTED ");
 257         if (type & SEC_DESC_GROUP_DEFAULTED)    /* 0x0002 */
 258                 printf("SEC_DESC_GROUP_DEFAULTED ");
 259         if (type & SEC_DESC_DACL_PRESENT)       /* 0x0004 */
 260                 printf("SEC_DESC_DACL_PRESENT ");
 261         if (type & SEC_DESC_DACL_DEFAULTED)     /* 0x0008 */
 262                 printf("SEC_DESC_DACL_DEFAULTED ");
 263         if (type & SEC_DESC_SACL_PRESENT)       /* 0x0010 */
 264                 printf("SEC_DESC_SACL_PRESENT ");
 265         if (type & SEC_DESC_SACL_DEFAULTED)     /* 0x0020 */
 266                 printf("SEC_DESC_SACL_DEFAULTED ");
 267         if (type & SEC_DESC_DACL_TRUSTED)       /* 0x0040 */
 268                 printf("SEC_DESC_DACL_TRUSTED ");
 269         if (type & SEC_DESC_SERVER_SECURITY)    /* 0x0080 */
 270                 printf("SEC_DESC_SERVER_SECURITY ");
 271         if (type & SEC_DESC_DACL_AUTO_INHERIT_REQ) /* 0x0100 */
 272                 printf("SEC_DESC_DACL_AUTO_INHERIT_REQ ");
 273         if (type & SEC_DESC_SACL_AUTO_INHERIT_REQ) /* 0x0200 */
 274                 printf("SEC_DESC_SACL_AUTO_INHERIT_REQ ");
 275         if (type & SEC_DESC_DACL_AUTO_INHERITED) /* 0x0400 */
 276                 printf("SEC_DESC_DACL_AUTO_INHERITED ");
 277         if (type & SEC_DESC_SACL_AUTO_INHERITED) /* 0x0800 */
 278                 printf("SEC_DESC_SACL_AUTO_INHERITED ");
 279         if (type & SEC_DESC_DACL_PROTECTED)     /* 0x1000 */
 280                 printf("SEC_DESC_DACL_PROTECTED ");
 281         if (type & SEC_DESC_SACL_PROTECTED)     /* 0x2000 */
 282                 printf("SEC_DESC_SACL_PROTECTED ");
 283         if (type & SEC_DESC_RM_CONTROL_VALID)   /* 0x4000 */
 284                 printf("SEC_DESC_RM_CONTROL_VALID ");
 285         if (type & SEC_DESC_SELF_RELATIVE)      /* 0x8000 */
 286                 printf("SEC_DESC_SELF_RELATIVE ");
 287
 288         printf("\n");
 289 }
 290
 291 /****************************************************************************
 292  display sec_desc structure
 293  ****************************************************************************/
 294 void display_sec_desc(struct security_descriptor *sec)
 295 {
 296         char *sid_str;
 297
 298         if (!sec) {
 299                 printf("NULL\n");
 300                 return;
 301         }
 302
 303         printf("revision: %d\n", sec->revision);
 304         display_acl_type(sec->type);
 305
 306         if (sec->sacl) {
 307                 printf("SACL\n");
 308                 display_sec_acl(sec->sacl);
 309         }
 310
 311         if (sec->dacl) {
 312                 printf("DACL\n");
 313                 display_sec_acl(sec->dacl);
 314         }
 315
 316         if (sec->owner_sid) {
 317                 sid_str = dom_sid_string(NULL, sec->owner_sid);
 318                 printf("\tOwner SID:\t%s\n", sid_str);
 319                 talloc_free(sid_str);
 320         }
 321
 322         if (sec->group_sid) {
 323                 sid_str = dom_sid_string(NULL, sec->group_sid);
 324                 printf("\tGroup SID:\t%s\n", sid_str);
 325                 talloc_free(sid_str);
 326         }
 327 }