s3:lib/events: make use of tevent_common_loop_timer_delay()
[Samba/gebeck_regimport.git] / libgpo / gpo_sec.c
blobaf73697e56e8ae32523d05916693c3787264de0c
1 /*
2 * Unix SMB/CIFS implementation.
3 * Group Policy Object Support
4 * Copyright (C) Guenther Deschner 2007
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 #include "includes.h"
21 #include "libcli/security/security.h"
22 #include "../libgpo/gpo.h"
23 #include "auth.h"
24 #include "../librpc/ndr/libndr.h"
26 /****************************************************************
27 ****************************************************************/
29 static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
31 struct GUID ext_right_apg_guid;
32 NTSTATUS status;
34 if (!object) {
35 return false;
38 status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
39 &ext_right_apg_guid);
40 if (!NT_STATUS_IS_OK(status)) {
41 return false;
44 switch (object->flags) {
45 case SEC_ACE_OBJECT_TYPE_PRESENT:
46 if (GUID_equal(&object->type.type,
47 &ext_right_apg_guid)) {
48 return true;
50 /* FALL TROUGH */
51 case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
52 if (GUID_equal(&object->inherited_type.inherited_type,
53 &ext_right_apg_guid)) {
54 return true;
56 /* FALL TROUGH */
57 default:
58 break;
61 return false;
64 /****************************************************************
65 ****************************************************************/
67 static bool gpo_sd_check_agp_object(const struct security_ace *ace)
69 if (!sec_ace_object(ace->type)) {
70 return false;
73 return gpo_sd_check_agp_object_guid(&ace->object.object);
76 /****************************************************************
77 ****************************************************************/
79 static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
81 return (access_mask & SEC_ADS_CONTROL_ACCESS);
84 #if 0
85 /****************************************************************
86 ****************************************************************/
88 static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
90 uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
91 SEC_RIGHTS_READ_ALL_PROP |
92 SEC_RIGHTS_READ_PERMS;
94 return (read_bits == (access_mask & read_bits));
96 #endif
98 /****************************************************************
99 ****************************************************************/
101 static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
102 const struct security_token *token)
104 char *sid_str;
106 if (gpo_sd_check_agp_object(ace) &&
107 gpo_sd_check_agp_access_bits(ace->access_mask) &&
108 security_token_has_sid(token, &ace->trustee)) {
109 sid_str = dom_sid_string(NULL, &ace->trustee);
110 DEBUG(10,("gpo_sd_check_ace_denied_object: "
111 "Access denied as of ace for %s\n",
112 sid_str));
113 talloc_free(sid_str);
114 return NT_STATUS_ACCESS_DENIED;
117 return STATUS_MORE_ENTRIES;
120 /****************************************************************
121 ****************************************************************/
123 static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
124 const struct security_token *token)
126 char *sid_str;
128 if (gpo_sd_check_agp_object(ace) &&
129 gpo_sd_check_agp_access_bits(ace->access_mask) &&
130 security_token_has_sid(token, &ace->trustee)) {
131 sid_str = dom_sid_string(NULL, &ace->trustee);
132 DEBUG(10,("gpo_sd_check_ace_allowed_object: "
133 "Access granted as of ace for %s\n",
134 sid_str));
135 talloc_free(sid_str);
137 return NT_STATUS_OK;
140 return STATUS_MORE_ENTRIES;
143 /****************************************************************
144 ****************************************************************/
146 static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
147 const struct security_token *token)
149 switch (ace->type) {
150 case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
151 return gpo_sd_check_ace_denied_object(ace, token);
152 case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
153 return gpo_sd_check_ace_allowed_object(ace, token);
154 default:
155 return STATUS_MORE_ENTRIES;
159 /****************************************************************
160 ****************************************************************/
162 NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
163 const struct security_token *token)
165 struct security_descriptor *sd = gpo->security_descriptor;
166 struct security_acl *dacl = NULL;
167 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
168 int i;
170 if (!token) {
171 return NT_STATUS_INVALID_USER_BUFFER;
174 if (!sd) {
175 return NT_STATUS_INVALID_SECURITY_DESCR;
178 dacl = sd->dacl;
179 if (!dacl) {
180 return NT_STATUS_INVALID_SECURITY_DESCR;
183 /* check all aces and only return NT_STATUS_OK (== Access granted) or
184 * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
185 * deny access */
187 for (i = 0; i < dacl->num_aces; i ++) {
189 status = gpo_sd_check_ace(&dacl->aces[i], token);
191 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
192 return status;
193 } else if (NT_STATUS_IS_OK(status)) {
194 return status;
197 continue;
200 return NT_STATUS_ACCESS_DENIED;