source3/lib/util_seaccess.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Copyright (C) Luke Kenneth Casson Leighton 1996-2000.
   4    Copyright (C) Tim Potter 2000.
   5    Copyright (C) Re-written by Jeremy Allison 2000.
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 extern DOM_SID global_sid_Builtin;
  25 extern DOM_SID global_sid_World;
  26 extern NT_USER_TOKEN anonymous_token;
  27
  28 /*********************************************************************************
  29  Check an ACE against a SID.  We return the remaining needed permission
  30  bits not yet granted. Zero means permission allowed (no more needed bits).
  31 **********************************************************************************/
  32
  33 static uint32 check_ace(SEC_ACE *ace, const NT_USER_TOKEN *token, uint32 acc_desired,
  34                         NTSTATUS *status)
  35 {
  36         uint32 mask = ace->info.mask;
  37
  38         /*
  39          * Inherit only is ignored.
  40          */
  41
  42         if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
  43                 return acc_desired;
  44         }
  45
  46         /*
  47          * If this ACE has no SID in common with the token,
  48          * ignore it as it cannot be used to make an access
  49          * determination.
  50          */
  51
  52         if (!token_sid_in_ace( token, ace))
  53                 return acc_desired;
  54
  55         switch (ace->type) {
  56                 case SEC_ACE_TYPE_ACCESS_ALLOWED:
  57                         /*
  58                          * This is explicitly allowed.
  59                          * Remove the bits from the remaining
  60                          * access required. Return the remaining
  61                          * bits needed.
  62                          */
  63                         acc_desired &= ~mask;
  64                         break;
  65                 case SEC_ACE_TYPE_ACCESS_DENIED:
  66                         /*
  67                          * This is explicitly denied.
  68                          * If any bits match terminate here,
  69                          * we are denied.
  70                          */
  71                         if (acc_desired & mask) {
  72                                 *status = NT_STATUS_ACCESS_DENIED;
  73                                 return 0xFFFFFFFF;
  74                         }
  75                         break;
  76                 case SEC_ACE_TYPE_SYSTEM_ALARM:
  77                 case SEC_ACE_TYPE_SYSTEM_AUDIT:
  78                         *status = NT_STATUS_NOT_IMPLEMENTED;
  79                         return 0xFFFFFFFF;
  80                 default:
  81                         *status = NT_STATUS_INVALID_PARAMETER;
  82                         return 0xFFFFFFFF;
  83         }
  84
  85         return acc_desired;
  86 }
  87
  88 /*********************************************************************************
  89  Maximum access was requested. Calculate the max possible. Fail if it doesn't
  90  include other bits requested.
  91 **********************************************************************************/
  92
  93 static BOOL get_max_access( SEC_ACL *the_acl, const NT_USER_TOKEN *token, uint32 *granted,
  94                             uint32 desired,
  95                             NTSTATUS *status)
  96 {
  97         uint32 acc_denied = 0;
  98         uint32 acc_granted = 0;
  99         size_t i;
 100
 101         for ( i = 0 ; i < the_acl->num_aces; i++) {
 102                 SEC_ACE *ace = &the_acl->ace[i];
 103                 uint32 mask = ace->info.mask;
 104
 105                 if (!token_sid_in_ace( token, ace))
 106                         continue;
 107
 108                 switch (ace->type) {
 109                         case SEC_ACE_TYPE_ACCESS_ALLOWED:
 110                                 acc_granted |= (mask & ~acc_denied);
 111                                 break;
 112                         case SEC_ACE_TYPE_ACCESS_DENIED:
 113                                 acc_denied |= (mask & ~acc_granted);
 114                                 break;
 115                         case SEC_ACE_TYPE_SYSTEM_ALARM:
 116                         case SEC_ACE_TYPE_SYSTEM_AUDIT:
 117                                 *status = NT_STATUS_NOT_IMPLEMENTED;
 118                                 *granted = 0;
 119                                 return False;
 120                         default:
 121                                 *status = NT_STATUS_INVALID_PARAMETER;
 122                                 *granted = 0;
 123                                 return False;
 124                 }
 125         }
 126
 127         /*
 128          * If we were granted no access, or we desired bits that we
 129          * didn't get, then deny.
 130          */
 131
 132         if ((acc_granted == 0) || ((acc_granted & desired) != desired)) {
 133                 *status = NT_STATUS_ACCESS_DENIED;
 134                 *granted = 0;
 135                 return False;
 136         }
 137
 138         /*
 139          * Return the access we did get.
 140          */
 141
 142         *granted = acc_granted;
 143         *status = NT_STATUS_OK;
 144         return True;
 145 }
 146
 147 /* Map generic access rights to object specific rights.  This technique is
 148    used to give meaning to assigning read, write, execute and all access to
 149    objects.  Each type of object has its own mapping of generic to object
 150    specific access rights. */
 151
 152 void se_map_generic(uint32 *access_mask, struct generic_mapping *mapping)
 153 {
 154         uint32 old_mask = *access_mask;
 155
 156         if (*access_mask & GENERIC_READ_ACCESS) {
 157                 *access_mask &= ~GENERIC_READ_ACCESS;
 158                 *access_mask |= mapping->generic_read;
 159         }
 160
 161         if (*access_mask & GENERIC_WRITE_ACCESS) {
 162                 *access_mask &= ~GENERIC_WRITE_ACCESS;
 163                 *access_mask |= mapping->generic_write;
 164         }
 165
 166         if (*access_mask & GENERIC_EXECUTE_ACCESS) {
 167                 *access_mask &= ~GENERIC_EXECUTE_ACCESS;
 168                 *access_mask |= mapping->generic_execute;
 169         }
 170
 171         if (*access_mask & GENERIC_ALL_ACCESS) {
 172                 *access_mask &= ~GENERIC_ALL_ACCESS;
 173                 *access_mask |= mapping->generic_all;
 174         }
 175
 176         if (old_mask != *access_mask) {
 177                 DEBUG(10, ("se_map_generic(): mapped mask 0x%08x to 0x%08x\n",
 178                            old_mask, *access_mask));
 179         }
 180 }
 181
 182 /* Map standard access rights to object specific rights.  This technique is
 183    used to give meaning to assigning read, write, execute and all access to
 184    objects.  Each type of object has its own mapping of standard to object
 185    specific access rights. */
 186
 187 void se_map_standard(uint32 *access_mask, struct standard_mapping *mapping)
 188 {
 189         uint32 old_mask = *access_mask;
 190
 191         if (*access_mask & READ_CONTROL_ACCESS) {
 192                 *access_mask &= ~READ_CONTROL_ACCESS;
 193                 *access_mask |= mapping->std_read;
 194         }
 195
 196         if (*access_mask & (DELETE_ACCESS|WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|SYNCHRONIZE_ACCESS)) {
 197                 *access_mask &= ~(DELETE_ACCESS|WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|SYNCHRONIZE_ACCESS);
 198                 *access_mask |= mapping->std_all;
 199         }
 200
 201         if (old_mask != *access_mask) {
 202                 DEBUG(10, ("se_map_standard(): mapped mask 0x%08x to 0x%08x\n",
 203                            old_mask, *access_mask));
 204         }
 205 }
 206
 207 /*****************************************************************************
 208  Check access rights of a user against a security descriptor.  Look at
 209  each ACE in the security descriptor until an access denied ACE denies
 210  any of the desired rights to the user or any of the users groups, or one
 211  or more ACEs explicitly grant all requested access rights.  See
 212  "Access-Checking" document in MSDN.
 213 *****************************************************************************/
 214
 215 BOOL se_access_check(const SEC_DESC *sd, const NT_USER_TOKEN *token,
 216                      uint32 acc_desired, uint32 *acc_granted,
 217                      NTSTATUS *status)
 218 {
 219         size_t i;
 220         SEC_ACL *the_acl;
 221         fstring sid_str;
 222         uint32 tmp_acc_desired = acc_desired;
 223
 224         if (!status || !acc_granted)
 225                 return False;
 226
 227         if (!token)
 228                 token = &anonymous_token;
 229
 230         *status = NT_STATUS_OK;
 231         *acc_granted = 0;
 232
 233         DEBUG(10,("se_access_check: requested access 0x%08x, for NT token with %u entries and first sid %s.\n",
 234                  (unsigned int)acc_desired, (unsigned int)token->num_sids,
 235                 sid_to_string(sid_str, &token->user_sids[0])));
 236
 237         /*
 238          * No security descriptor or security descriptor with no DACL
 239          * present allows all access.
 240          */
 241
 242         /* ACL must have something in it */
 243
 244         if (!sd || (sd && (!(sd->type & SEC_DESC_DACL_PRESENT) || sd->dacl == NULL))) {
 245                 *status = NT_STATUS_OK;
 246                 *acc_granted = acc_desired;
 247                 DEBUG(5, ("se_access_check: no sd or blank DACL, access allowed\n"));
 248                 return True;
 249         }
 250
 251         /* The user sid is the first in the token */
 252         if (DEBUGLVL(3)) {
 253                 DEBUG(3, ("se_access_check: user sid is %s\n", sid_to_string(sid_str, &token->user_sids[PRIMARY_USER_SID_INDEX]) ));
 254
 255                 for (i = 1; i < token->num_sids; i++) {
 256                         DEBUGADD(3, ("se_access_check: also %s\n",
 257                                   sid_to_string(sid_str, &token->user_sids[i])));
 258                 }
 259         }
 260
 261         /* Is the token the owner of the SID ? */
 262
 263         if (sd->owner_sid) {
 264                 for (i = 0; i < token->num_sids; i++) {
 265                         if (sid_equal(&token->user_sids[i], sd->owner_sid)) {
 266                                 /*
 267                                  * The owner always has SEC_RIGHTS_WRITE_DAC & READ_CONTROL.
 268                                  */
 269                                 if (tmp_acc_desired & WRITE_DAC_ACCESS)
 270                                         tmp_acc_desired &= ~WRITE_DAC_ACCESS;
 271                                 if (tmp_acc_desired & READ_CONTROL_ACCESS)
 272                                         tmp_acc_desired &= ~READ_CONTROL_ACCESS;
 273                         }
 274                 }
 275         }
 276
 277         the_acl = sd->dacl;
 278
 279         if (tmp_acc_desired & MAXIMUM_ALLOWED_ACCESS) {
 280                 tmp_acc_desired &= ~MAXIMUM_ALLOWED_ACCESS;
 281                 return get_max_access( the_acl, token, acc_granted, tmp_acc_desired,
 282                                        status);
 283         }
 284
 285         for ( i = 0 ; i < the_acl->num_aces && tmp_acc_desired != 0; i++) {
 286                 SEC_ACE *ace = &the_acl->ace[i];
 287
 288                 DEBUGADD(10,("se_access_check: ACE %u: type %d, flags = 0x%02x, SID = %s mask = %x, current desired = %x\n",
 289                           (unsigned int)i, ace->type, ace->flags,
 290                           sid_to_string(sid_str, &ace->trustee),
 291                           (unsigned int) ace->info.mask,
 292                           (unsigned int)tmp_acc_desired ));
 293
 294                 tmp_acc_desired = check_ace( ace, token, tmp_acc_desired, status);
 295                 if (NT_STATUS_V(*status)) {
 296                         *acc_granted = 0;
 297                         DEBUG(5,("se_access_check: ACE %u denied with status %s.\n", (unsigned int)i, nt_errstr(*status)));
 298                         return False;
 299                 }
 300         }
 301
 302         /*
 303          * If there are no more desired permissions left then
 304          * access was allowed.
 305          */
 306
 307         if (tmp_acc_desired == 0) {
 308                 *acc_granted = acc_desired;
 309                 *status = NT_STATUS_OK;
 310                 DEBUG(5,("se_access_check: access (%x) granted.\n", (unsigned int)acc_desired ));
 311                 return True;
 312         }
 313
 314         *acc_granted = 0;
 315         *status = NT_STATUS_ACCESS_DENIED;
 316         DEBUG(5,("se_access_check: access (%x) denied.\n", (unsigned int)acc_desired ));
 317         return False;
 318 }
 319
 320
 321 /*******************************************************************
 322  samr_make_sam_obj_sd
 323  ********************************************************************/
 324
 325 NTSTATUS samr_make_sam_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
 326 {
 327         DOM_SID adm_sid;
 328         DOM_SID act_sid;
 329
 330         SEC_ACE ace[3];
 331         SEC_ACCESS mask;
 332
 333         SEC_ACL *psa = NULL;
 334
 335         sid_copy(&adm_sid, &global_sid_Builtin);
 336         sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
 337
 338         sid_copy(&act_sid, &global_sid_Builtin);
 339         sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
 340
 341         /*basic access for every one*/
 342         init_sec_access(&mask, GENERIC_RIGHTS_SAM_EXECUTE | GENERIC_RIGHTS_SAM_READ);
 343         init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 344
 345         /*full access for builtin aliases Administrators and Account Operators*/
 346         init_sec_access(&mask, GENERIC_RIGHTS_SAM_ALL_ACCESS);
 347         init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 348         init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 349
 350         if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
 351                 return NT_STATUS_NO_MEMORY;
 352
 353         if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
 354                 return NT_STATUS_NO_MEMORY;
 355
 356         return NT_STATUS_OK;
 357 }