Line data Source code
1 : /*
2 : * Unix SMB/CIFS implementation.
3 : * Group Policy Object Support
4 : * Copyright (C) Guenther Deschner 2007
5 : *
6 : * This program is free software; you can redistribute it and/or modify
7 : * it under the terms of the GNU General Public License as published by
8 : * the Free Software Foundation; either version 3 of the License, or
9 : * (at your option) any later version.
10 : *
11 : * This program is distributed in the hope that it will be useful,
12 : * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 : * GNU General Public License for more details.
15 : *
16 : * You should have received a copy of the GNU General Public License
17 : * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 : */
19 :
20 : #include "includes.h"
21 : #include "libcli/security/security.h"
22 : #include "../libgpo/gpo.h"
23 : #include "auth.h"
24 : #include "../librpc/ndr/libndr.h"
25 :
26 : /****************************************************************
27 : ****************************************************************/
28 :
29 0 : static bool gpo_sd_check_agp_object_guid(const struct security_ace_object *object)
30 : {
31 : struct GUID ext_right_apg_guid;
32 : NTSTATUS status;
33 :
34 0 : if (!object) {
35 0 : return false;
36 : }
37 :
38 0 : status = GUID_from_string(ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY,
39 : &ext_right_apg_guid);
40 0 : if (!NT_STATUS_IS_OK(status)) {
41 0 : return false;
42 : }
43 :
44 0 : switch (object->flags) {
45 0 : case SEC_ACE_OBJECT_TYPE_PRESENT:
46 0 : if (GUID_equal(&object->type.type,
47 : &ext_right_apg_guid)) {
48 0 : return true;
49 : }
50 :
51 : FALL_THROUGH;
52 : case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
53 0 : if (GUID_equal(&object->inherited_type.inherited_type,
54 : &ext_right_apg_guid)) {
55 0 : return true;
56 : }
57 :
58 : FALL_THROUGH;
59 : default:
60 0 : break;
61 : }
62 :
63 0 : return false;
64 : }
65 :
66 : /****************************************************************
67 : ****************************************************************/
68 :
69 0 : static bool gpo_sd_check_agp_object(const struct security_ace *ace)
70 : {
71 0 : if (!sec_ace_object(ace->type)) {
72 0 : return false;
73 : }
74 :
75 0 : return gpo_sd_check_agp_object_guid(&ace->object.object);
76 : }
77 :
78 : /****************************************************************
79 : ****************************************************************/
80 :
81 0 : static bool gpo_sd_check_agp_access_bits(uint32_t access_mask)
82 : {
83 0 : return (access_mask & SEC_ADS_CONTROL_ACCESS);
84 : }
85 :
86 : #if 0
87 : /****************************************************************
88 : ****************************************************************/
89 :
90 : static bool gpo_sd_check_read_access_bits(uint32_t access_mask)
91 : {
92 : uint32_t read_bits = SEC_RIGHTS_LIST_CONTENTS |
93 : SEC_RIGHTS_READ_ALL_PROP |
94 : SEC_RIGHTS_READ_PERMS;
95 :
96 : return (read_bits == (access_mask & read_bits));
97 : }
98 : #endif
99 :
100 : /****************************************************************
101 : ****************************************************************/
102 :
103 0 : static NTSTATUS gpo_sd_check_ace_denied_object(const struct security_ace *ace,
104 : const struct security_token *token)
105 : {
106 0 : if (gpo_sd_check_agp_object(ace) &&
107 0 : gpo_sd_check_agp_access_bits(ace->access_mask) &&
108 0 : security_token_has_sid(token, &ace->trustee)) {
109 : struct dom_sid_buf sid_str;
110 0 : DEBUG(10,("gpo_sd_check_ace_denied_object: "
111 : "Access denied as of ace for %s\n",
112 : dom_sid_str_buf(&ace->trustee, &sid_str)));
113 0 : return NT_STATUS_ACCESS_DENIED;
114 : }
115 :
116 0 : return STATUS_MORE_ENTRIES;
117 : }
118 :
119 : /****************************************************************
120 : ****************************************************************/
121 :
122 0 : static NTSTATUS gpo_sd_check_ace_allowed_object(const struct security_ace *ace,
123 : const struct security_token *token)
124 : {
125 0 : if (gpo_sd_check_agp_object(ace) &&
126 0 : gpo_sd_check_agp_access_bits(ace->access_mask) &&
127 0 : security_token_has_sid(token, &ace->trustee)) {
128 : struct dom_sid_buf sid_str;
129 0 : DEBUG(10,("gpo_sd_check_ace_allowed_object: "
130 : "Access granted as of ace for %s\n",
131 : dom_sid_str_buf(&ace->trustee, &sid_str)));
132 0 : return NT_STATUS_OK;
133 : }
134 :
135 0 : return STATUS_MORE_ENTRIES;
136 : }
137 :
138 : /****************************************************************
139 : ****************************************************************/
140 :
141 0 : static NTSTATUS gpo_sd_check_ace(const struct security_ace *ace,
142 : const struct security_token *token)
143 : {
144 0 : switch (ace->type) {
145 0 : case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
146 0 : return gpo_sd_check_ace_denied_object(ace, token);
147 0 : case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
148 0 : return gpo_sd_check_ace_allowed_object(ace, token);
149 0 : default:
150 0 : return STATUS_MORE_ENTRIES;
151 : }
152 : }
153 :
154 : /****************************************************************
155 : ****************************************************************/
156 :
157 0 : NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo,
158 : const struct security_token *token)
159 0 : {
160 0 : struct security_descriptor *sd = gpo->security_descriptor;
161 0 : struct security_acl *dacl = NULL;
162 0 : NTSTATUS status = NT_STATUS_ACCESS_DENIED;
163 : int i;
164 :
165 0 : if (!token) {
166 0 : return NT_STATUS_INVALID_USER_BUFFER;
167 : }
168 :
169 0 : if (!sd) {
170 0 : return NT_STATUS_INVALID_SECURITY_DESCR;
171 : }
172 :
173 0 : dacl = sd->dacl;
174 0 : if (!dacl) {
175 0 : return NT_STATUS_INVALID_SECURITY_DESCR;
176 : }
177 :
178 : /* check all aces and only return NT_STATUS_OK (== Access granted) or
179 : * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to
180 : * deny access */
181 :
182 0 : for (i = 0; i < dacl->num_aces; i ++) {
183 :
184 0 : status = gpo_sd_check_ace(&dacl->aces[i], token);
185 :
186 0 : if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
187 0 : return status;
188 0 : } else if (NT_STATUS_IS_OK(status)) {
189 0 : return status;
190 : }
191 :
192 0 : continue;
193 : }
194 :
195 0 : return NT_STATUS_ACCESS_DENIED;
196 : }
|
