2 Unix SMB/CIFS implementation.
3 Samba utility functions. ADS stuff
4 Copyright (C) Alexey Kotovich 2002
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "libads/ldap_schema.h"
25 #define SEC_RIGHTS_FULL_CTRL 0xf01ff
29 static struct perm_mask_str
{
33 {SEC_RIGHTS_FULL_CTRL
, "[Full Control]"},
35 {SEC_ADS_LIST
, "[List Contents]"},
36 {SEC_ADS_LIST_OBJECT
, "[List Object]"},
38 {SEC_ADS_READ_PROP
, "[Read All Properties]"},
39 {SEC_STD_READ_CONTROL
, "[Read Permissions]"},
41 {SEC_ADS_SELF_WRITE
, "[All validate writes]"},
42 {SEC_ADS_WRITE_PROP
, "[Write All Properties]"},
44 {SEC_STD_WRITE_DAC
, "[Modify Permissions]"},
45 {SEC_STD_WRITE_OWNER
, "[Modify Owner]"},
47 {SEC_ADS_CREATE_CHILD
, "[Create All Child Objects]"},
49 {SEC_STD_DELETE
, "[Delete]"},
50 {SEC_ADS_DELETE_TREE
, "[Delete Subtree]"},
51 {SEC_ADS_DELETE_CHILD
, "[Delete All Child Objects]"},
53 {SEC_ADS_CONTROL_ACCESS
, "[Change Password]"},
54 {SEC_ADS_CONTROL_ACCESS
, "[Reset Password]"},
59 /* convert a security permissions into a string */
60 static void ads_disp_perms(uint32 type
)
65 printf("Permissions: ");
67 if (type
== SEC_RIGHTS_FULL_CTRL
) {
68 printf("%s\n", perms
[j
].str
);
72 for (i
= 0; i
< 32; i
++) {
73 if (type
& (1 << i
)) {
74 for (j
= 1; perms
[j
].str
; j
++) {
75 if (perms
[j
].mask
== (((unsigned) 1) << i
)) {
76 printf("\n\t%s (0x%08x)", perms
[j
].str
, perms
[j
].mask
);
83 /* remaining bits get added on as-is */
85 printf("[%08x]", type
);
90 static const char *ads_interprete_guid_from_object(ADS_STRUCT
*ads
,
92 const struct GUID
*guid
)
94 const char *ret
= NULL
;
96 if (!ads
|| !mem_ctx
) {
100 ret
= ads_get_attrname_by_guid(ads
, ads
->config
.schema_path
,
103 return talloc_asprintf(mem_ctx
, "LDAP attribute: \"%s\"", ret
);
106 ret
= ads_get_extended_right_name_by_guid(ads
, ads
->config
.config_path
,
110 return talloc_asprintf(mem_ctx
, "Extended right: \"%s\"", ret
);
116 static void ads_disp_sec_ace_object(ADS_STRUCT
*ads
,
118 struct security_ace_object
*object
)
120 if (object
->flags
& SEC_ACE_OBJECT_TYPE_PRESENT
) {
121 printf("Object type: SEC_ACE_OBJECT_TYPE_PRESENT\n");
122 printf("Object GUID: %s (%s)\n", GUID_string(mem_ctx
,
124 ads_interprete_guid_from_object(ads
, mem_ctx
,
125 &object
->type
.type
));
127 if (object
->flags
& SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
) {
128 printf("Object type: SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT\n");
129 printf("Object GUID: %s (%s)\n", GUID_string(mem_ctx
,
130 &object
->inherited_type
.inherited_type
),
131 ads_interprete_guid_from_object(ads
, mem_ctx
,
132 &object
->inherited_type
.inherited_type
));
137 static void ads_disp_ace(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
, struct security_ace
*sec_ace
)
139 const char *access_type
= "UNKNOWN";
141 if (!sec_ace_object(sec_ace
->type
)) {
142 printf("------- ACE (type: 0x%02x, flags: 0x%02x, size: 0x%02x, mask: 0x%x)\n",
146 sec_ace
->access_mask
);
148 printf("------- ACE (type: 0x%02x, flags: 0x%02x, size: 0x%02x, mask: 0x%x, object flags: 0x%x)\n",
152 sec_ace
->access_mask
,
153 sec_ace
->object
.object
.flags
);
156 if (sec_ace
->type
== SEC_ACE_TYPE_ACCESS_ALLOWED
) {
157 access_type
= "ALLOWED";
158 } else if (sec_ace
->type
== SEC_ACE_TYPE_ACCESS_DENIED
) {
159 access_type
= "DENIED";
160 } else if (sec_ace
->type
== SEC_ACE_TYPE_SYSTEM_AUDIT
) {
161 access_type
= "SYSTEM AUDIT";
162 } else if (sec_ace
->type
== SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT
) {
163 access_type
= "ALLOWED OBJECT";
164 } else if (sec_ace
->type
== SEC_ACE_TYPE_ACCESS_DENIED_OBJECT
) {
165 access_type
= "DENIED OBJECT";
166 } else if (sec_ace
->type
== SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT
) {
167 access_type
= "AUDIT OBJECT";
170 printf("access SID: %s\naccess type: %s\n",
171 sid_string_talloc(mem_ctx
, &sec_ace
->trustee
), access_type
);
173 if (sec_ace_object(sec_ace
->type
)) {
174 ads_disp_sec_ace_object(ads
, mem_ctx
, &sec_ace
->object
.object
);
177 ads_disp_perms(sec_ace
->access_mask
);
181 static void ads_disp_acl(struct security_acl
*sec_acl
, const char *type
)
184 printf("------- (%s) ACL not present\n", type
);
186 printf("------- (%s) ACL (revision: %d, size: %d, number of ACEs: %d)\n",
195 void ads_disp_sd(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
, struct security_descriptor
*sd
)
198 char *tmp_path
= NULL
;
204 if (ads
&& !ads
->config
.schema_path
) {
205 if (ADS_ERR_OK(ads_schema_path(ads
, mem_ctx
, &tmp_path
))) {
206 ads
->config
.schema_path
= SMB_STRDUP(tmp_path
);
210 if (ads
&& !ads
->config
.config_path
) {
211 if (ADS_ERR_OK(ads_config_path(ads
, mem_ctx
, &tmp_path
))) {
212 ads
->config
.config_path
= SMB_STRDUP(tmp_path
);
216 printf("-------------- Security Descriptor (revision: %d, type: 0x%02x)\n",
220 printf("owner SID: %s\n", sd
->owner_sid
?
221 sid_string_talloc(mem_ctx
, sd
->owner_sid
) : "(null)");
222 printf("group SID: %s\n", sd
->group_sid
?
223 sid_string_talloc(mem_ctx
, sd
->group_sid
) : "(null)");
225 ads_disp_acl(sd
->sacl
, "system");
227 for (i
= 0; i
< sd
->sacl
->num_aces
; i
++) {
228 ads_disp_ace(ads
, mem_ctx
, &sd
->sacl
->aces
[i
]);
232 ads_disp_acl(sd
->dacl
, "user");
234 for (i
= 0; i
< sd
->dacl
->num_aces
; i
++) {
235 ads_disp_ace(ads
, mem_ctx
, &sd
->dacl
->aces
[i
]);
239 printf("-------------- End Of Security Descriptor\n");