libcli/security Move source3/lib/util_seaccess.c into the common code

Signed-off-by: Andrew Tridgell <tridge@samba.org>

5 files changed, 62 insertions, 15 deletions

diff --git a/source3/lib/util_seaccess.c b/libcli/security/access_check.c
index 6500f926fd..081efe8711 100644
--- a/source3/lib/util_seaccess.c
+++ b/libcli/security/access_check.c
@@ -5,6 +5,7 @@
    Copyright (C) Gerald Carter 2005
    Copyright (C) Volker Lendecke 2007
    Copyright (C) Jeremy Allison 2008
+   Copyright (C) Andrew Bartlett 2010
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -28,9 +29,9 @@
    objects.  Each type of object has its own mapping of generic to object
    specific access rights. */
 
-void se_map_generic(uint32 *access_mask, const struct generic_mapping *mapping)
+void se_map_generic(uint32_t *access_mask, const struct generic_mapping *mapping)
 {
-	uint32 old_mask = *access_mask;
+	uint32_t old_mask = *access_mask;
 
 	if (*access_mask & GENERIC_READ_ACCESS) {
 		*access_mask &= ~GENERIC_READ_ACCESS;
@@ -81,9 +82,9 @@ void security_acl_map_generic(struct security_acl *sa,
    objects.  Each type of object has its own mapping of standard to object
    specific access rights. */
 
-void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping)
+void se_map_standard(uint32_t *access_mask, const struct standard_mapping *mapping)
 {
-	uint32 old_mask = *access_mask;
+	uint32_t old_mask = *access_mask;
 
 	if (*access_mask & SEC_STD_READ_CONTROL) {
 		*access_mask &= ~SEC_STD_READ_CONTROL;
@@ -104,7 +105,7 @@ void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping
 /*
   perform a SEC_FLAG_MAXIMUM_ALLOWED access check
 */
-static uint32_t access_check_max_allowed(const struct security_descriptor *sd, 
+static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
 					const struct security_token *token)
 {
 	uint32_t denied = 0, granted = 0;
@@ -152,7 +153,7 @@ static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
   this function returns the denied bits in the uint32_t pointed
   to by the access_granted pointer.
 */
-NTSTATUS se_access_check(const struct security_descriptor *sd, 
+NTSTATUS se_access_check(const struct security_descriptor *sd,
 			  const struct security_token *token,
 			  uint32_t access_desired,
 			  uint32_t *access_granted)
diff --git a/libcli/security/access_check.h b/libcli/security/access_check.h
new file mode 100644
index 0000000000..548e5a1437
--- /dev/null
+++ b/libcli/security/access_check.h
@@ -0,0 +1,53 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Copyright (C) Andrew Tridgell 2004
+   Copyright (C) Gerald Carter 2005
+   Copyright (C) Volker Lendecke 2007
+   Copyright (C) Jeremy Allison 2008
+   Copyright (C) Andrew Bartlett 2010
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "libcli/security/security_token.h"
+
+/* Map generic access rights to object specific rights.  This technique is
+   used to give meaning to assigning read, write, execute and all access to
+   objects.  Each type of object has its own mapping of generic to object
+   specific access rights. */
+
+void se_map_generic(uint32_t *access_mask, const struct generic_mapping *mapping);
+
+/* Map generic access rights to object specific rights for all the ACE's
+ * in a security_acl.
+ */
+void security_acl_map_generic(struct security_acl *sa,
+			      const struct generic_mapping *mapping);
+
+/* Map standard access rights to object specific rights.  This technique is
+   used to give meaning to assigning read, write, execute and all access to
+   objects.  Each type of object has its own mapping of standard to object
+   specific access rights. */
+void se_map_standard(uint32_t *access_mask, const struct standard_mapping *mapping);
+
+/*
+  The main entry point for access checking. If returning ACCESS_DENIED
+  this function returns the denied bits in the uint32_t pointed
+  to by the access_granted pointer.
+*/
+NTSTATUS se_access_check(const struct security_descriptor *sd,
+			 const struct security_token *token,
+			 uint32_t access_desired,
+			 uint32_t *access_granted);
diff --git a/libcli/security/security.h b/libcli/security/security.h
index 8018bee893..63ddf45e80 100644
--- a/libcli/security/security.h
+++ b/libcli/security/security.h
@@ -40,6 +40,7 @@ struct object_tree {
 #include "libcli/security/security_token.h"
 #include "libcli/security/sddl.h"
 #include "libcli/security/privileges.h"
+#include "libcli/security/access_check.h"
 
 #if _SAMBA_BUILD_ >= 4
 #include "libcli/security/proto.h"
diff --git a/source3/Makefile.in b/source3/Makefile.in
index 18335cf1c7..a73ce26a3a 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -470,7 +470,7 @@ LIB_OBJ = $(LIBSAMBAUTIL_OBJ) $(UTIL_OBJ) $(CRYPTO_OBJ) \
 	  lib/module.o lib/events.o @LIBTEVENT_OBJ0@ \
 	  lib/server_contexts.o \
 	  lib/ldap_escape.o @CHARSET_STATIC@ \
-	  lib/secdesc.o lib/util_seaccess.o ../libcli/security/secace.o \
+	  lib/secdesc.o ../libcli/security/access_check.o ../libcli/security/secace.o \
 	  ../libcli/security/sddl.o \
 	  ../libcli/security/secacl.o @PTHREADPOOL_OBJ@ \
 	  lib/fncall.o \
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 42ff86751a..81e1909521 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1237,14 +1237,6 @@ bool push_reg_multi_sz(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, const char **a);
 bool pull_reg_sz(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, const char **s);
 bool pull_reg_multi_sz(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, const char ***a);
 
-/* The following definitions come from lib/util_seaccess.c  */
-
-void se_map_generic(uint32 *access_mask, const struct generic_mapping *mapping);
-void security_acl_map_generic(struct security_acl *sa, const struct generic_mapping *mapping);
-void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping);
-NTSTATUS se_access_check(const struct security_descriptor *sd, const struct security_token *token,
-		     uint32 acc_desired, uint32 *acc_granted);
-
 /* The following definitions come from lib/util_sec.c  */
 
 void sec_init(void);