4 Copyright (C) Nadezhda Ivanova 2010
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 * Component: ldb ACL modules
25 * Description: Some auxiliary functions used for access checking
27 * Author: Nadezhda Ivanova
30 #include "ldb_module.h"
31 #include "auth/auth.h"
32 #include "libcli/security/security.h"
33 #include "dsdb/samdb/samdb.h"
34 #include "librpc/gen_ndr/ndr_security.h"
35 #include "param/param.h"
36 #include "dsdb/samdb/ldb_modules/util.h"
38 struct security_token
*acl_user_token(struct ldb_module
*module
)
40 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
41 struct auth_session_info
*session_info
42 = (struct auth_session_info
*)ldb_get_opaque(ldb
, "sessionInfo");
46 return session_info
->security_token
;
49 /* performs an access check from inside the module stack
50 * given the dn of the object to be checked, the required access
51 * guid is either the guid of the extended right, or NULL
54 int dsdb_module_check_access_on_dn(struct ldb_module
*module
,
58 const struct GUID
*guid
,
59 struct ldb_request
*parent
)
62 struct ldb_result
*acl_res
;
63 static const char *acl_attrs
[] = {
64 "nTSecurityDescriptor",
68 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
69 struct auth_session_info
*session_info
70 = (struct auth_session_info
*)ldb_get_opaque(ldb
, "sessionInfo");
72 return ldb_operr(ldb
);
74 ret
= dsdb_module_search_dn(module
, mem_ctx
, &acl_res
, dn
,
76 DSDB_FLAG_NEXT_MODULE
|
78 DSDB_SEARCH_SHOW_RECYCLED
,
80 if (ret
!= LDB_SUCCESS
) {
81 ldb_asprintf_errstring(ldb_module_get_ctx(module
),
82 "access_check: failed to find object %s\n",
83 ldb_dn_get_linearized(dn
));
86 return dsdb_check_access_on_dn_internal(ldb
, acl_res
,
88 session_info
->security_token
,
94 int acl_check_access_on_attribute(struct ldb_module
*module
,
96 struct security_descriptor
*sd
,
97 struct dom_sid
*rp_sid
,
99 const struct dsdb_attribute
*attr
,
100 const struct dsdb_class
*objectclass
)
104 uint32_t access_granted
;
105 struct object_tree
*root
= NULL
;
106 struct object_tree
*new_node
= NULL
;
107 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
108 struct security_token
*token
= acl_user_token(module
);
110 if (!insert_in_object_tree(tmp_ctx
,
111 &objectclass
->schemaIDGUID
,
114 DEBUG(10, ("acl_search: cannot add to object tree class schemaIDGUID\n"));
118 if (!GUID_all_zero(&attr
->attributeSecurityGUID
)) {
119 if (!insert_in_object_tree(tmp_ctx
,
120 &attr
->attributeSecurityGUID
,
121 access_mask
, &new_node
,
123 DEBUG(10, ("acl_search: cannot add to object tree securityGUID\n"));
128 if (!insert_in_object_tree(tmp_ctx
,
130 access_mask
, &new_node
,
132 DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
136 status
= sec_access_check_ds(sd
, token
,
141 if (!NT_STATUS_IS_OK(status
)) {
142 ret
= LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
;
147 talloc_free(tmp_ctx
);
150 talloc_free(tmp_ctx
);
151 return ldb_operr(ldb_module_get_ctx(module
));
154 int acl_check_access_on_objectclass(struct ldb_module
*module
,
156 struct security_descriptor
*sd
,
157 struct dom_sid
*rp_sid
,
158 uint32_t access_mask
,
159 const struct dsdb_class
*objectclass
)
163 uint32_t access_granted
;
164 struct object_tree
*root
= NULL
;
165 struct object_tree
*new_node
= NULL
;
166 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
167 struct security_token
*token
= acl_user_token(module
);
169 if (!insert_in_object_tree(tmp_ctx
,
170 &objectclass
->schemaIDGUID
,
173 DEBUG(10, ("acl_search: cannot add to object tree class schemaIDGUID\n"));
177 status
= sec_access_check_ds(sd
, token
,
182 if (!NT_STATUS_IS_OK(status
)) {
183 ret
= LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
;
187 talloc_free(tmp_ctx
);
190 talloc_free(tmp_ctx
);
191 return ldb_operr(ldb_module_get_ctx(module
));
194 /* checks for validated writes */
195 int acl_check_extended_right(TALLOC_CTX
*mem_ctx
,
196 struct security_descriptor
*sd
,
197 struct security_token
*token
,
198 const char *ext_right
,
204 uint32_t access_granted
;
205 struct object_tree
*root
= NULL
;
206 struct object_tree
*new_node
= NULL
;
207 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
209 GUID_from_string(ext_right
, &right
);
211 if (!insert_in_object_tree(tmp_ctx
, &right
, right_type
,
213 DEBUG(10, ("acl_ext_right: cannot add to object tree\n"));
214 talloc_free(tmp_ctx
);
215 return LDB_ERR_OPERATIONS_ERROR
;
217 status
= sec_access_check_ds(sd
, token
,
223 if (!NT_STATUS_IS_OK(status
)) {
224 talloc_free(tmp_ctx
);
225 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
;
227 talloc_free(tmp_ctx
);
231 const char *acl_user_name(TALLOC_CTX
*mem_ctx
, struct ldb_module
*module
)
233 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
234 struct auth_session_info
*session_info
235 = (struct auth_session_info
*)ldb_get_opaque(ldb
, "sessionInfo");
237 return "UNKNOWN (NULL)";
240 return talloc_asprintf(mem_ctx
, "%s\\%s",
241 session_info
->info
->domain_name
,
242 session_info
->info
->account_name
);
245 uint32_t dsdb_request_sd_flags(struct ldb_request
*req
, bool *explicit)
247 struct ldb_control
*sd_control
;
248 uint32_t sd_flags
= 0;
254 sd_control
= ldb_request_get_control(req
, LDB_CONTROL_SD_FLAGS_OID
);
256 struct ldb_sd_flags_control
*sdctr
= (struct ldb_sd_flags_control
*)sd_control
->data
;
258 sd_flags
= sdctr
->secinfo_flags
;
264 /* mark it as handled */
265 sd_control
->critical
= 0;
268 /* we only care for the last 4 bits */
269 sd_flags
&= 0x0000000F;
272 * MS-ADTS 3.1.1.3.4.1.11 says that no bits
282 int dsdb_module_schedule_sd_propagation(struct ldb_module
*module
,
283 struct ldb_dn
*nc_root
,
287 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
288 struct dsdb_extended_sec_desc_propagation_op
*op
;
291 op
= talloc_zero(module
, struct dsdb_extended_sec_desc_propagation_op
);
296 op
->nc_root
= nc_root
;
298 op
->include_self
= include_self
;
300 ret
= dsdb_module_extended(module
, op
, NULL
,
301 DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID
,
303 DSDB_FLAG_TOP_MODULE
|
304 DSDB_FLAG_AS_SYSTEM
|