libcli/security Move source3/lib/util_seaccess.c into the common code

Signed-off-by: Andrew Tridgell <tridge@samba.org>

3 files changed, 1 insertions, 260 deletions

diff --git a/source3/Makefile.in b/source3/Makefile.in
index 18335cf1c7..a73ce26a3a 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -470,7 +470,7 @@ LIB_OBJ = $(LIBSAMBAUTIL_OBJ) $(UTIL_OBJ) $(CRYPTO_OBJ) \
 	  lib/module.o lib/events.o @LIBTEVENT_OBJ0@ \
 	  lib/server_contexts.o \
 	  lib/ldap_escape.o @CHARSET_STATIC@ \
-	  lib/secdesc.o lib/util_seaccess.o ../libcli/security/secace.o \
+	  lib/secdesc.o ../libcli/security/access_check.o ../libcli/security/secace.o \
 	  ../libcli/security/sddl.o \
 	  ../libcli/security/secacl.o @PTHREADPOOL_OBJ@ \
 	  lib/fncall.o \
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 42ff86751a..81e1909521 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1237,14 +1237,6 @@ bool push_reg_multi_sz(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, const char **a);
 bool pull_reg_sz(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, const char **s);
 bool pull_reg_multi_sz(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, const char ***a);
 
-/* The following definitions come from lib/util_seaccess.c  */
-
-void se_map_generic(uint32 *access_mask, const struct generic_mapping *mapping);
-void security_acl_map_generic(struct security_acl *sa, const struct generic_mapping *mapping);
-void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping);
-NTSTATUS se_access_check(const struct security_descriptor *sd, const struct security_token *token,
-		     uint32 acc_desired, uint32 *acc_granted);
-
 /* The following definitions come from lib/util_sec.c  */
 
 void sec_init(void);
diff --git a/source3/lib/util_seaccess.c b/source3/lib/util_seaccess.c
deleted file mode 100644
index 6500f926fd..0000000000
--- a/source3/lib/util_seaccess.c
+++ /dev/null
@@ -1,251 +0,0 @@
-/*
-   Unix SMB/CIFS implementation.
-
-   Copyright (C) Andrew Tridgell 2004
-   Copyright (C) Gerald Carter 2005
-   Copyright (C) Volker Lendecke 2007
-   Copyright (C) Jeremy Allison 2008
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-#include "includes.h"
-#include "libcli/security/security.h"
-
-/* Map generic access rights to object specific rights.  This technique is
-   used to give meaning to assigning read, write, execute and all access to
-   objects.  Each type of object has its own mapping of generic to object
-   specific access rights. */
-
-void se_map_generic(uint32 *access_mask, const struct generic_mapping *mapping)
-{
-	uint32 old_mask = *access_mask;
-
-	if (*access_mask & GENERIC_READ_ACCESS) {
-		*access_mask &= ~GENERIC_READ_ACCESS;
-		*access_mask |= mapping->generic_read;
-	}
-
-	if (*access_mask & GENERIC_WRITE_ACCESS) {
-		*access_mask &= ~GENERIC_WRITE_ACCESS;
-		*access_mask |= mapping->generic_write;
-	}
-
-	if (*access_mask & GENERIC_EXECUTE_ACCESS) {
-		*access_mask &= ~GENERIC_EXECUTE_ACCESS;
-		*access_mask |= mapping->generic_execute;
-	}
-
-	if (*access_mask & GENERIC_ALL_ACCESS) {
-		*access_mask &= ~GENERIC_ALL_ACCESS;
-		*access_mask |= mapping->generic_all;
-	}
-
-	if (old_mask != *access_mask) {
-		DEBUG(10, ("se_map_generic(): mapped mask 0x%08x to 0x%08x\n",
-			   old_mask, *access_mask));
-	}
-}
-
-/* Map generic access rights to object specific rights for all the ACE's
- * in a security_acl.
- */
-
-void security_acl_map_generic(struct security_acl *sa,
-				const struct generic_mapping *mapping)
-{
-	unsigned int i;
-
-	if (!sa) {
-		return;
-	}
-
-	for (i = 0; i < sa->num_aces; i++) {
-		se_map_generic(&sa->aces[i].access_mask, mapping);
-	}
-}
-
-/* Map standard access rights to object specific rights.  This technique is
-   used to give meaning to assigning read, write, execute and all access to
-   objects.  Each type of object has its own mapping of standard to object
-   specific access rights. */
-
-void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping)
-{
-	uint32 old_mask = *access_mask;
-
-	if (*access_mask & SEC_STD_READ_CONTROL) {
-		*access_mask &= ~SEC_STD_READ_CONTROL;
-		*access_mask |= mapping->std_read;
-	}
-
-	if (*access_mask & (SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE)) {
-		*access_mask &= ~(SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE);
-		*access_mask |= mapping->std_all;
-	}
-
-	if (old_mask != *access_mask) {
-		DEBUG(10, ("se_map_standard(): mapped mask 0x%08x to 0x%08x\n",
-			   old_mask, *access_mask));
-	}
-}
-
-/*
-  perform a SEC_FLAG_MAXIMUM_ALLOWED access check
-*/
-static uint32_t access_check_max_allowed(const struct security_descriptor *sd, 
-					const struct security_token *token)
-{
-	uint32_t denied = 0, granted = 0;
-	unsigned i;
-
-	if (security_token_has_sid(token, sd->owner_sid)) {
-		granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL | SEC_STD_DELETE;
-	} else if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
-		granted |= SEC_STD_DELETE;
-	}
-
-	if (sd->dacl == NULL) {
-		return granted & ~denied;
-	}
-
-	for (i = 0;i<sd->dacl->num_aces; i++) {
-		struct security_ace *ace = &sd->dacl->aces[i];
-
-		if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
-			continue;
-		}
-
-		if (!security_token_has_sid(token, &ace->trustee)) {
-			continue;
-		}
-
-		switch (ace->type) {
-		case SEC_ACE_TYPE_ACCESS_ALLOWED:
-			granted |= ace->access_mask;
-			break;
-		case SEC_ACE_TYPE_ACCESS_DENIED:
-		case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
-			denied |= ace->access_mask;
-			break;
-		default:	/* Other ACE types not handled/supported */
-			break;
-		}
-	}
-
-	return granted & ~denied;
-}
-
-/*
-  The main entry point for access checking. If returning ACCESS_DENIED
-  this function returns the denied bits in the uint32_t pointed
-  to by the access_granted pointer.
-*/
-NTSTATUS se_access_check(const struct security_descriptor *sd, 
-			  const struct security_token *token,
-			  uint32_t access_desired,
-			  uint32_t *access_granted)
-{
-	uint32_t i;
-	uint32_t bits_remaining;
-
-	*access_granted = access_desired;
-	bits_remaining = access_desired;
-
-	/* handle the maximum allowed flag */
-	if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
-		uint32_t orig_access_desired = access_desired;
-
-		access_desired |= access_check_max_allowed(sd, token);
-		access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
-		*access_granted = access_desired;
-		bits_remaining = access_desired & ~SEC_STD_DELETE;
-
-		DEBUG(10,("se_access_check: MAX desired = 0x%x, granted = 0x%x, remaining = 0x%x\n",
-			orig_access_desired,
-			*access_granted,
-			bits_remaining));
-	}
-
-	if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
-		if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
-			bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
-		} else {
-			return NT_STATUS_PRIVILEGE_NOT_HELD;
-		}
-	}
-
-	/* a NULL dacl allows access */
-	if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
-		*access_granted = access_desired;
-		return NT_STATUS_OK;
-	}
-
-	/* the owner always gets SEC_STD_WRITE_DAC, SEC_STD_READ_CONTROL and SEC_STD_DELETE */
-	if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE)) &&
-	    security_token_has_sid(token, sd->owner_sid)) {
-		bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE);
-	}
-	if ((bits_remaining & SEC_STD_DELETE) &&
-	    (security_token_has_privilege(token, SEC_PRIV_RESTORE))) {
-		bits_remaining &= ~SEC_STD_DELETE;
-	}
-	if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
-	    security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
-		bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
-	}
-	if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
-	    security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
-		bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
-	}
-
-	if (sd->dacl == NULL) {
-		goto done;
-	}
-
-	/* check each ace in turn. */
-	for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
-		struct security_ace *ace = &sd->dacl->aces[i];
-
-		if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
-			continue;
-		}
-
-		if (!security_token_has_sid(token, &ace->trustee)) {
-			continue;
-		}
-
-		switch (ace->type) {
-		case SEC_ACE_TYPE_ACCESS_ALLOWED:
-			bits_remaining &= ~ace->access_mask;
-			break;
-		case SEC_ACE_TYPE_ACCESS_DENIED:
-		case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
-			if (bits_remaining & ace->access_mask) {
-				return NT_STATUS_ACCESS_DENIED;
-			}
-			break;
-		default:	/* Other ACE types not handled/supported */
-			break;
-		}
-	}
-
-done:
-	if (bits_remaining != 0) {
-		*access_granted = bits_remaining;
-		return NT_STATUS_ACCESS_DENIED;
-	}
-
-	return NT_STATUS_OK;
-}