diff options
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/acl.c | 1305 | ||||
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/kludge_acl.c | 4 | ||||
| -rw-r--r-- | source4/dsdb/schema/schema_query.c | 14 | ||||
| -rw-r--r-- | source4/libcli/security/object_tree.c | 101 | ||||
| -rw-r--r-- | source4/libcli/security/security.h | 6 | ||||
| -rw-r--r-- | source4/scripting/python/samba/provision.py | 2 |
6 files changed, 419 insertions, 1013 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/acl.c b/source4/dsdb/samdb/ldb_modules/acl.c index 2f123145db..f96d4294c5 100644 --- a/source4/dsdb/samdb/ldb_modules/acl.c +++ b/source4/dsdb/samdb/ldb_modules/acl.c @@ -40,30 +40,6 @@ #include "librpc/gen_ndr/ndr_security.h" #include "param/param.h" -/* acl_search helper */ -struct acl_context { - - struct ldb_module *module; - struct ldb_request *req; - struct ldb_request *down_req; - - /*needed if we have to identify if this is SYSTEM_USER*/ - enum security_user_level user_type; - - uint32_t access_needed; - struct ldb_dn * dn_to_check; - - /* set to true when we need to process the request as a SYSTEM_USER, regardless - * of the user's actual rights - for example when we need to retrieve the - * ntSecurityDescriptor */ - bool ignore_security; - struct security_token *token; - /*needed to identify if we have requested these attributes*/ - bool nTSecurityDescriptor; - bool objectClass; - int sec_result; -}; - struct extended_access_check_attribute { const char *oa_name; const uint32_t requires_rights; @@ -73,199 +49,6 @@ struct acl_private{ bool perform_check; }; -static int acl_search_callback(struct ldb_request *req, struct ldb_reply *ares); - -/*FIXME: Perhaps this should go in the .idl file*/ -#define SEC_GENERIC_ACCESS_NEVER_GRANTED ( 0xFFFFFFFF ) - -/*Contains a part of the attributes - the ones that have predefined required rights*/ -static const struct extended_access_check_attribute extended_access_checks_table[] = -{ - { - .oa_name = "nTSecurityDescriptor", - .requires_rights = SEC_FLAG_SYSTEM_SECURITY & SEC_STD_READ_CONTROL, - }, - { - .oa_name = "pekList", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "currentValue", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "dBCSPwd", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "unicodePwd", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "ntPwdHistory", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "priorValue", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "supplementalCredentials", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "trustAuthIncoming", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "trustAuthOutgoing", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "ImPwdHistory", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "initialAuthIncoming", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "initialAuthOutgoing", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, - { - .oa_name = "msDS-ExecuteScriptPassword", - .requires_rights = SEC_GENERIC_ACCESS_NEVER_GRANTED, - }, -}; - -static NTSTATUS extended_access_check(const char *attribute_name, const int access_rights, uint32_t searchFlags) -{ - int i = 0; - if (access_rights == SEC_GENERIC_ACCESS_NEVER_GRANTED) { - return NT_STATUS_ACCESS_DENIED; - } - - /*Check if the attribute is in the table first*/ - for ( i = 0; extended_access_checks_table[i].oa_name; i++ ) { - if (ldb_attr_cmp(extended_access_checks_table[i].oa_name, attribute_name) == 0) { - if ((access_rights & extended_access_checks_table[i].requires_rights) == access_rights) { - return NT_STATUS_OK; - } else { - return NT_STATUS_ACCESS_DENIED; - } - } - } - - /*Check for attribute whose attributeSchema has 0x80 set in searchFlags*/ - if ((searchFlags & SEARCH_FLAG_CONFIDENTIAL) == SEARCH_FLAG_CONFIDENTIAL) { - if (((SEC_ADS_READ_PROP & SEC_ADS_CONTROL_ACCESS) & access_rights) == access_rights) { - return NT_STATUS_OK; - } else { - return NT_STATUS_ACCESS_DENIED; - } - } - - /*Check attributes with *special* behaviour*/ - if (ldb_attr_cmp("msDS-QuotaEffective", attribute_name) == 0 || ldb_attr_cmp("msDS-QuotaUsed", attribute_name) == 0){ - /*Rights required: - * - *(RIGHT_DS_READ_PROPERTY on the Quotas container or - *((the client is querying the quota for the security principal it is authenticated as) and - *(DS-Query-Self-Quota control access right on the Quotas container)) - */ - } - - if (ldb_attr_cmp("userPassword", attribute_name) == 0) { - /*When the dSHeuristics.fUserPwdSupport flag is false, the requester must be granted RIGHT_DS_READ_PROPERTY. - *When the dSHeuristics.fUserPwdSupport flag is true, access is never granted. - */ - } - - if (ldb_attr_cmp("sDRightsEffective", attribute_name) == 0) { - /*FIXME:3.1.1.4.5.4 in MS-ADTS*/ - } - - if (ldb_attr_cmp("allowedChildClassesEffective", attribute_name) == 0) { - /*FIXME:3.1.1.4.5.5 in MS-ADTS*/ - } - - if (ldb_attr_cmp("allowedAttributesEffective", attribute_name) == 0) { - /*FIXME:3.1.1.4.5.7 in MS-ADTS*/ - } - - if (ldb_attr_cmp("msDS-Approx-Immed-Subordinates", attribute_name) == 0) { - /*FIXME:3.1.1.4.5.15 in MS-ADTS*/ - } - - if (ldb_attr_cmp("msDS-QuotaEffective", attribute_name) == 0) { - /*FIXME:3.1.1.4.5.22 in MS-ADTS*/ - } - - if (ldb_attr_cmp("msDS-ReplAttributeMetaData", attribute_name) == 0 || ldb_attr_cmp("msDS-ReplAttributeMetaData", attribute_name) == 0) { - /*The security context of the requester must be granted the following rights on the replPropertyMetaData attribute: - *(RIGHT_DS_READ_PROPERTY)or (DS-Replication-Manage-Topology by ON!nTSecurityDescriptor) - */ - } - - if (ldb_attr_cmp("msDS-NCReplInboundNeighbors", attribute_name) == 0) { - /*The security context of the requester must be granted the following rights on repsFrom: - *(RIGHT_DS_READ_PROPERTY) or (DS-Replication-Manage-Topology) or (DS-Replication-Monitor-Topology) - */ - } - - if (ldb_attr_cmp("msDS-NCReplOutboundNeighbors", attribute_name) == 0) { - /*The security context of the requester must be granted the following rights on repsTo: - *(RIGHT_DS_READ_PROPERTY) or (DS-Replication-Manage-Topology) or (DS-Replication-Monitor-Topology) - */ - } - - if (ldb_attr_cmp("msDS-NCReplCursors", attribute_name) == 0) { - /*The security context of the requester must be granted the following rights on replUpToDateVector: (RIGHT_DS_READ_PROPERTY) - *or (DS-Replication-Manage-Topology) or (DS-Replication-Monitor-Topology) - */ - } - - if (ldb_attr_cmp("msDS-IsUserCachableAtRodc", attribute_name) == 0) { - /*The security context of the requester must be granted - *the DS-Replication-Secrets-Synchronize control access right on the root of the default NC. - */ - } - - return NT_STATUS_OK; -} - -/* Builds an object tree for object specific access checks */ -static struct object_tree * build_object_tree_form_attr_list(TALLOC_CTX *mem_ctx, /* Todo this context or separate? */ - struct ldb_context *ldb, - const char ** attr_names, - int num_attrs, - const char * object_class, - uint32_t init_access) -{ - const struct dsdb_schema *schema = dsdb_get_schema(ldb); - const struct GUID *oc_guid = class_schemaid_guid_by_lDAPDisplayName(schema, object_class); - struct object_tree *tree; - int i; - - if (!oc_guid) - return NULL; - - tree = insert_in_object_tree(mem_ctx, oc_guid, NULL, init_access, NULL); - if (attr_names){ - for (i=0; i < num_attrs; i++){ - const struct dsdb_attribute *attribute = dsdb_attribute_by_lDAPDisplayName(schema,attr_names[i]); - if (attribute) - insert_in_object_tree(mem_ctx, - &attribute->schemaIDGUID, - &attribute->attributeSecurityGUID, - init_access, - tree); - } - } - return tree; -} - bool is_root_base_dn(struct ldb_context *ldb, struct ldb_dn *dn_to_check) { int result; @@ -274,559 +57,306 @@ bool is_root_base_dn(struct ldb_context *ldb, struct ldb_dn *dn_to_check) return (result==0); } -static int acl_op_callback(struct ldb_request *req, struct ldb_reply *ares) -{ - struct acl_context *ac; - - ac = talloc_get_type(req->context, struct acl_context); - - if (!ares) { - return ldb_module_done(ac->req, NULL, NULL, - LDB_ERR_OPERATIONS_ERROR); - } - if (ares->error != LDB_SUCCESS) { - return ldb_module_done(ac->req, ares->controls, - ares->response, ares->error); - } - - if (ares->type != LDB_REPLY_DONE) { - talloc_free(ares); - return ldb_module_done(ac->req, NULL, NULL, - LDB_ERR_OPERATIONS_ERROR); - } - - return ldb_module_done(ac->req, ares->controls, - ares->response, ares->error); -} - - -static int acl_access_check_add(struct ldb_reply *ares, - struct acl_context *ac, - struct security_descriptor *sd) +static enum security_user_level what_is_user(struct ldb_module *module) { - uint32_t access_granted = 0; - NTSTATUS status; - struct ldb_dn *parent; - struct ldb_dn *grandparent; - struct object_tree *tree = NULL; - - parent = ldb_dn_get_parent(ac->req, ac->req->op.add.message->dn); - grandparent = ldb_dn_get_parent(ac->req, parent); - if (ldb_dn_compare(ares->message->dn, grandparent) == 0) - status = sec_access_check_ds(sd, ac->token, - SEC_ADS_LIST, - &access_granted, - NULL); - else if (ldb_dn_compare(ares->message->dn, parent) == 0){ - struct ldb_message_element *oc_el; - struct ldb_context *ldb = ldb_module_get_ctx(ac->module); - const struct dsdb_schema *schema = dsdb_get_schema(ldb); - int i; - - oc_el = ldb_msg_find_element(ares->message, "objectClass"); - if (!oc_el || oc_el->num_values == 0) - return LDB_SUCCESS; - for (i = 0; i < oc_el->num_values; i++){ - const struct GUID *guid = class_schemaid_guid_by_lDAPDisplayName(schema, - oc_el->values[i].data); - ac->sec_result = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; - tree = insert_in_object_tree(ac->req, guid, NULL, SEC_ADS_CREATE_CHILD, - tree); - status = sec_access_check_ds(sd, ac->token, SEC_ADS_CREATE_CHILD,&access_granted, tree); - if (NT_STATUS_IS_OK(status)) - ac->sec_result = LDB_SUCCESS; - } - } - else - return LDB_SUCCESS; - - return ac->sec_result; + struct ldb_context *ldb = ldb_module_get_ctx(module); + struct auth_session_info *session_info + = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo"); + return security_session_user_level(session_info); } -static int acl_access_check_modify(struct ldb_reply *ares, struct acl_context *ac, - struct security_descriptor *sd) +static struct security_token *acl_user_token(struct ldb_module *module) { - uint32_t access_granted = 0; - NTSTATUS status; - struct ldb_dn *parent; - struct object_tree *tree = NULL; - - parent = ldb_dn_get_parent(ac->req, ac->req->op.add.message->dn); - if (ldb_dn_compare(ares->message->dn, parent) == 0) - status = sec_access_check_ds(sd, ac->token, SEC_ADS_LIST,&access_granted, NULL); - else if (ldb_dn_compare(ares->message->dn, ac->req->op.add.message->dn) == 0){ - struct ldb_message_element *oc_el; - struct ldb_context *ldb = ldb_module_get_ctx(ac->module); - const struct dsdb_schema *schema = dsdb_get_schema(ldb); - int i; - struct GUID *guid; - oc_el = ldb_msg_find_element(ares->message, "objectClass"); - if (!oc_el || oc_el->num_values == 0) - return LDB_SUCCESS; - - guid = class_schemaid_guid_by_lDAPDisplayName(schema, - oc_el->values[oc_el->num_values-1].data); - tree = insert_in_object_tree(ac->req, guid, NULL, SEC_ADS_WRITE_PROP, - tree); - for (i=0; i < ac->req->op.mod.message->num_elements; i++){ - const struct dsdb_attribute *attr = dsdb_attribute_by_lDAPDisplayName(schema, - ac->req->op.mod.message->elements[i].name); - if (!attr) - return LDB_ERR_OPERATIONS_ERROR; /* What should we actually return here? */ - insert_in_object_tree(ac, &attr->schemaIDGUID, - &attr->attributeSecurityGUID, ac->access_needed, tree); - } - status = sec_access_check_ds(sd, ac->token, SEC_ADS_WRITE_PROP ,&access_granted, tree); - if (!NT_STATUS_IS_OK(status)) - ac->sec_result = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; + struct ldb_context *ldb = ldb_module_get_ctx(module); + struct auth_session_info *session_info + = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo"); + if(!session_info) { + return NULL; } - else - return LDB_SUCCESS; - return ac->sec_result; -} -/*TODO*/ -static int acl_access_check_rename(struct ldb_reply *ares, struct acl_context *ac, - struct security_descriptor *sd) -{ - return ac->sec_result; + return session_info->security_token; } -static int acl_access_check_delete(struct ldb_reply *ares, struct acl_context *ac, - struct security_descriptor *sd) +static int acl_module_init(struct ldb_module *module) { - uint32_t access_granted = 0; - NTSTATUS status; - struct ldb_dn *parent; - struct object_tree *tree = NULL; - - parent = ldb_dn_get_parent(ac->req, ac->req->op.del.dn); - if (ldb_dn_compare(ares->message->dn, parent) == 0){ - status = sec_access_check_ds(sd, ac->token, SEC_ADS_LIST,&access_granted, NULL); - if (!NT_STATUS_IS_OK(status)){ - ac->sec_result = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; - return ac->sec_result; - } - status = sec_access_check_ds(sd, ac->token, SEC_ADS_DELETE_CHILD,&access_granted, NULL); - if (NT_STATUS_IS_OK(status)){ - ac->sec_result = LDB_SUCCESS; - return ac->sec_result; - } - } - else if (ldb_dn_compare(ares->message->dn, ac->req->op.del.dn) == 0){ - status = sec_access_check_ds(sd, ac->token, SEC_STD_DELETE, &access_granted, NULL); - if (!NT_STATUS_IS_OK(status)) - ac->sec_result = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; - } - return ac->sec_result; -} + struct ldb_context *ldb; + struct acl_private *data; + int ret; -static int acl_access_check_search(struct ldb_reply *ares, struct acl_context *ac, - struct security_descriptor *sd) -{ - uint32_t access_granted; - NTSTATUS status; - struct ldb_dn *parent; + ldb = ldb_module_get_ctx(module); - if (ac->user_type == SECURITY_SYSTEM || ac->user_type == SECURITY_ANONYMOUS) { - return LDB_SUCCESS;/*FIXME: we have anonymous access*/ + ret = ldb_mod_register_control(module, LDB_CONTROL_SD_FLAGS_OID); + if (ret != LDB_SUCCESS) { + ldb_debug(ldb, LDB_DEBUG_ERROR, + "acl_module_init: Unable to register control with rootdse!\n"); + return LDB_ERR_OPERATIONS_ERROR; } - parent = ldb_dn_get_parent(ac->req, ac->dn_to_check); - ac->sec_result = LDB_SUCCESS; - if (ldb_dn_compare(ares->message->dn, parent) == 0) { - status = sec_access_check_ds(sd, ac->token, SEC_ADS_LIST,&access_granted, NULL); - if (!NT_STATUS_IS_OK(status)) { - ac->sec_result = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; - } - } + data = talloc(module, struct acl_private); + data->perform_check = lp_parm_bool(ldb_get_opaque(ldb, "loadparm"), + NULL, "acl", "perform", false); + ldb_module_set_private(module, data); - return ac->sec_result; + return ldb_next_init(module); } -static int acl_perform_access_check(struct ldb_request *req, struct ldb_reply *ares, - struct acl_context *ac) +static int get_sd_from_result(TALLOC_CTX *mem_ctx, + struct ldb_result *acl_res, + struct security_descriptor **sd) { - struct ldb_message_element *oc_el; - struct security_descriptor *sd; + struct ldb_message_element *sd_element; enum ndr_err_code ndr_err; - oc_el = ldb_msg_find_element(ares->message, "ntSecurityDescriptor"); - if (!oc_el || oc_el->num_values == 0) + sd_element = ldb_msg_find_element(acl_res->msgs[0], "ntSecurityDescriptor"); + if (!sd_element) { return LDB_SUCCESS; - - sd = talloc(ac, struct security_descriptor); - if(!sd) { - return ldb_module_done(ac->req, ares->controls, - ares->response, LDB_ERR_OPERATIONS_ERROR); } - ndr_err = ndr_pull_struct_blob(&oc_el->values[0], sd, NULL, sd, + *sd = talloc(mem_ctx, struct security_descriptor); + if(!*sd) { + return LDB_ERR_OPERATIONS_ERROR; + } + ndr_err = ndr_pull_struct_blob(&sd_element->values[0], *sd, NULL, *sd, (ndr_pull_flags_fn_t)ndr_pull_security_descriptor); - if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) - return ldb_module_done(ac->req, ares->controls, - ares->response, LDB_ERR_OPERATIONS_ERROR); - switch (ac->req->operation) { - case LDB_SEARCH: - return acl_access_check_search(ares, ac, sd); - case LDB_ADD: - return acl_access_check_add(ares, ac, sd); - case LDB_MODIFY: - return acl_access_check_modify(ares, ac, sd); - case LDB_DELETE: - return acl_access_check_delete(ares, ac, sd); - case LDB_RENAME: - return acl_access_check_rename(ares, ac, sd); - default: - return ldb_module_done(ac->req, ares->controls, - ares->response, LDB_ERR_OPERATIONS_ERROR); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + return LDB_ERR_OPERATIONS_ERROR; } + return LDB_SUCCESS; } -static int acl_forward_add(struct ldb_reply *ares, - struct acl_context *ac) +static const struct GUID *get_oc_guid_from_result(struct ldb_module *module, + struct ldb_result *acl_res) { - struct ldb_request *newreq; - struct ldb_context *ldb; - int ret; - - ldb = ldb_module_get_ctx(ac->module); - ret = ldb_build_add_req(&newreq,ldb, - ac, - ac->req->op.add.message, - ac->req->controls, - ac, - acl_op_callback, - ac->req); - if (ret != LDB_SUCCESS) - return ldb_module_done(ac->req, ares->controls, - ares->response, LDB_ERR_OPERATIONS_ERROR); - return ldb_next_request(ac->module, newreq); -} + struct ldb_message_element *oc_el; + struct ldb_context *ldb = ldb_module_get_ctx(module); -static int acl_forward_modify(struct ldb_reply *ares, - struct acl_context *ac) -{ - struct ldb_request *newreq; - struct ldb_context *ldb; - int ret; + oc_el = ldb_msg_find_element(acl_res->msgs[0], "objectClass"); + if (!oc_el) { + return NULL; + } - ldb = ldb_module_get_ctx(ac->module); - ret = ldb_build_mod_req(&newreq,ldb, - ac, - ac->req->op.mod.message, - ac->req->controls, - ac, - acl_op_callback, - ac->req); - if (ret != LDB_SUCCESS) - return ldb_module_done(ac->req, ares->controls, - ares->response, LDB_ERR_OPERATIONS_ERROR); - return ldb_next_request(ac->module, newreq); + return class_schemaid_guid_by_lDAPDisplayName(dsdb_get_schema(ldb), + (char *)oc_el->values[oc_el->num_values-1].data); } -static int acl_forward_delete(struct ldb_reply *ares, - struct acl_context *ac) +static void acl_debug(struct security_descriptor *sd, + struct security_token *token, + struct ldb_dn *dn, + bool denied, + int level) { - struct ldb_request *newreq; - struct ldb_context *ldb; - int ret; - - ldb = ldb_module_get_ctx(ac->module); - ret = ldb_build_del_req(&newreq, ldb, - ac, - ac->req->op.del.dn, - ac->req->controls, - ac, - acl_op_callback, - ac->req); - if (ret != LDB_SUCCESS) - return ldb_module_done(ac->req, ares->controls, - ares->response, LDB_ERR_OPERATIONS_ERROR); - return ldb_next_request(ac->module, newreq); -} + if (denied) { + DEBUG(level, ("Access on %s denied", ldb_dn_get_linearized(dn))); + } else { + DEBUG(level, ("Access on %s granted", ldb_dn_get_linearized(dn))); + } -static int acl_forward_rename(struct ldb_reply *ares, - struct acl_context *ac) -{ - return LDB_SUCCESS; + DEBUG(level,("Security context: %s\n", + ndr_print_struct_string(0,(ndr_print_fn_t)ndr_print_security_token,"", token))); + DEBUG(level,("Security descriptor: %s\n", + ndr_print_struct_string(0,(ndr_print_fn_t)ndr_print_security_descriptor,"", sd))); } -static int acl_forward_search(struct acl_context *ac) +static int check_access_on_dn(struct ldb_module *module, + TALLOC_CTX *mem_ctx, + struct ldb_dn *dn, + uint32_t access, + struct object_tree *tree) { int ret; - const char * const *attrs; - struct ldb_control *sd_control; - struct ldb_control **sd_saved_controls; - struct ldb_context *ldb; - struct ldb_request *newreq; - - ldb = ldb_module_get_ctx(ac->module); - attrs = ac->req->op.search.attrs; - if (attrs) { - ac->nTSecurityDescriptor = false; - ac->objectClass = false; - if (!ldb_attr_in_list(ac->req->op.search.attrs, "nTSecurityDescriptor")) { - attrs = ldb_attr_list_copy_add(ac, attrs, "nTSecurityDescriptor"); - ac->nTSecurityDescriptor = true; - } - if (!ldb_attr_in_list(ac->req->op.search.attrs, "objectClass")) { - attrs = ldb_attr_list_copy_add(ac, attrs, "objectClass"); - ac->objectClass = true; - } + struct ldb_context *ldb = ldb_module_get_ctx(module); + struct ldb_result *acl_res; + struct security_descriptor *sd = NULL; + NTSTATUS status; + uint32_t access_granted; + static const char *acl_attrs[] = { + "nTSecurityDescriptor", + NULL + }; + + ret = ldb_search(ldb, mem_ctx, &acl_res, dn, LDB_SCOPE_BASE, acl_attrs, NULL); + /* we sould be able to find the parent */ + if (ret != LDB_SUCCESS) { + DEBUG(10,("acl: failed to find object %s\n", ldb_dn_get_linearized(dn))); + return ret; } - ret = ldb_build_search_req_ex(&newreq,ldb, - ac, - ac->req->op.search.base, - ac->req->op.search.scope, - ac->req->op.search.tree, - attrs, - ac->req->controls, - ac, acl_search_callback, - ac->req); + + ret = get_sd_from_result(mem_ctx, acl_res, &sd); if (ret != LDB_SUCCESS) { - return LDB_ERR_OPERATIONS_ERROR; + return LDB_ERR_OPERATIONS_ERROR; } - /* check if there's an SD_FLAGS control */ - sd_control = ldb_request_get_control(newreq, LDB_CONTROL_SD_FLAGS_OID); - if (sd_control) { - /* save it locally and remove it from the list */ - /* we do not need to replace them later as we - * are keeping the original req intact */ - if (!save_controls(sd_control, newreq, &sd_saved_controls)) { - return LDB_ERR_OPERATIONS_ERROR; - } + /* Theoretically we pass the check if the object has no sd */ + if (!sd) { + return LDB_SUCCESS; } - return ldb_next_request(ac->module, newreq); -} - -static int acl_forward_request(struct ldb_reply *ares, - struct acl_context *ac) -{ - switch (ac->req->operation) { - case LDB_SEARCH: - return acl_forward_search(ac); - case LDB_ADD: - return acl_forward_add(ares,ac); - case LDB_MODIFY: - return acl_forward_modify(ares,ac); - case LDB_DELETE: - return acl_forward_delete(ares,ac); - case LDB_RENAME: - return acl_forward_rename(ares,ac); - default: - return ldb_module_done(ac->req, ares->controls, - ares->response, LDB_ERR_OPERATIONS_ERROR); + status = sec_access_check_ds(sd, acl_user_token(module), + access, + &access_granted, + tree); + if (!NT_STATUS_IS_OK(status)) { + acl_debug(sd, + acl_user_token(module), + dn, + true, + 10); + return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; } return LDB_SUCCESS; } -static int acl_visible_callback(struct ldb_request *req, struct ldb_reply *ares) +static int acl_add(struct ldb_module *module, struct ldb_request *req) { - struct acl_context *ac; - - ac = talloc_get_type(req->context, struct acl_context); + int ret; + struct ldb_dn *parent = ldb_dn_get_parent(req, req->op.add.message->dn); + struct ldb_context *ldb; + struct ldb_message_element *oc_el; + const struct GUID *guid; + struct object_tree *root = NULL; + struct object_tree *new_node = NULL; - if (!ares) { - return ldb_module_done(ac->req, NULL, NULL, - LDB_ERR_OPERATIONS_ERROR); + if (what_is_user(module) == SECURITY_SYSTEM) { + return ldb_next_request(module, req); } - if (ares->error != LDB_SUCCESS) { - return ldb_module_done(ac->req, ares->controls, - ares->response, ares->error); + if (ldb_dn_is_special(req->op.add.message->dn)) { + return ldb_next_request(module, req); } - - switch (ares->type) { - case LDB_REPLY_ENTRY: - return acl_perform_access_check(req, ares, ac); - case LDB_REPLY_REFERRAL: - return ldb_module_send_referral(ac->req, ares->referral); /* what to do here actually? */ - case LDB_REPLY_DONE: - if (ac->sec_result != LDB_SUCCESS) { - return ldb_module_done(ac->req, ares->controls, - ares->response, ac->sec_result); - } - return acl_forward_request(ares,ac); - default: - break; + ldb = ldb_module_get_ctx(module); + /* Creating an NC. There is probably something we should do here, + * but we will establish that later */ + if ((ldb_dn_compare(req->op.add.message->dn, (ldb_get_schema_basedn(ldb))) == 0) || + (ldb_dn_compare(req->op.add.message->dn, (ldb_get_config_basedn(ldb))) == 0) || + (ldb_dn_compare(req->op.add.message->dn, (ldb_get_root_basedn(ldb))) == 0)) { + return ldb_next_request(module, req); } - return LDB_SUCCESS; -} - -static enum security_user_level what_is_user(struct ldb_module *module) -{ - struct ldb_context *ldb = ldb_module_get_ctx(module); - struct auth_session_info *session_info - = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo"); - return security_session_user_level(session_info); -} -static struct security_token * user_token(struct ldb_module *module) -{ - struct ldb_context *ldb = ldb_module_get_ctx(module); - struct auth_session_info *session_info - = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo"); - if(!session_info) { - return NULL; + oc_el = ldb_msg_find_element(req->op.add.message, "objectClass"); + if (!oc_el || oc_el->num_values == 0) { + DEBUG(10,("acl:operation error %s\n", ldb_dn_get_linearized(req->op.add.message->dn))); + return ldb_module_done(req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR); } - return session_info->security_token; -} - -static int make_req_access_check(struct ldb_module *module, struct ldb_request *req, - struct acl_context *ac, const char *filter) -{ - struct ldb_context *ldb; - int ret; - const char **attrs = talloc_array(ac, const char *, 3); - struct ldb_parse_tree *tree = ldb_parse_tree(req, filter); + guid = class_schemaid_guid_by_lDAPDisplayName(dsdb_get_schema(ldb), + (char *)oc_el->values[oc_el->num_values-1].data); - attrs[0] = talloc_strdup(attrs, "ntSecurityDescriptor"); - attrs[1] = talloc_strdup(attrs, "objectClass"); - attrs[2] = NULL; - - ldb = ldb_module_get_ctx(module); - ret = ldb_build_search_req_ex(&ac->down_req, - ldb, ac, - ac->dn_to_check, - LDB_SCOPE_SUBTREE, - tree, - attrs, - NULL, - ac, acl_visible_callback, - req); - return ret; -} - -static const char *user_name(TALLOC_CTX *mem_ctx, struct ldb_module *module) -{ - struct ldb_context *ldb = ldb_module_get_ctx(module); - struct auth_session_info *session_info - = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo"); - if (!session_info) { - return "UNKNOWN (NULL)"; + if (!insert_in_object_tree(req, guid, SEC_ADS_CREATE_CHILD, &root, &new_node)) { + return LDB_ERR_OPERATIONS_ERROR; } - return talloc_asprintf(mem_ctx, "%s\\%s", - session_info->server_info->domain_name, - session_info->server_info->account_name); -} - -static int acl_module_init(struct ldb_module *module) -{ - struct ldb_context *ldb; - struct acl_private *data; - int ret; - - ldb = ldb_module_get_ctx(module); - - ret = ldb_mod_register_control(module, LDB_CONTROL_SD_FLAGS_OID); + ret = check_access_on_dn(module, req, parent, SEC_ADS_CREATE_CHILD, root); if (ret != LDB_SUCCESS) { - ldb_debug(ldb, LDB_DEBUG_ERROR, - "acl_module_init: Unable to register control with rootdse!\n"); - return LDB_ERR_OPERATIONS_ERROR; + return ret; } - data = talloc(module, struct acl_private); - data->perform_check = lp_parm_bool(ldb_get_opaque(ldb, "loadparm"), - NULL, "acl", "perform", false); - ldb_module_set_private(module, data); - - return ldb_next_init(module); + return ldb_next_request(module, req); } -static int acl_add(struct ldb_module *module, struct ldb_request *req) +static int acl_modify(struct ldb_module *module, struct ldb_request *req) { int ret; - struct acl_context *ac; - struct ldb_dn * parent = ldb_dn_get_parent(req, req->op.add.message->dn); - char * filter; - struct ldb_context *ldb; - struct acl_private *data; - - ldb = ldb_module_get_ctx(module); - data = talloc_get_type(ldb_module_get_private(module), struct acl_private); - - if (!data->perform_check) + struct ldb_context *ldb = ldb_module_get_ctx(module); + const struct dsdb_schema *schema = dsdb_get_schema(ldb); + int i; + const struct GUID *guid; + uint32_t access_granted; + struct object_tree *root = NULL; + struct object_tree *new_node = NULL; + NTSTATUS status; + struct ldb_result *acl_res; + struct security_descriptor *sd; + TALLOC_CTX *tmp_ctx = talloc_new(req); + static const char *acl_attrs[] = { + "nTSecurityDescriptor", + "objectClass", + NULL + }; + + DEBUG(10, ("ldb:acl_modify: %s\n", req->op.mod.message->elements[0].name)); + if (what_is_user(module) == SECURITY_SYSTEM) { return ldb_next_request(module, req); - - ac = talloc(req, struct acl_context); - if (ac == NULL) { - return LDB_ERR_OPERATIONS_ERROR; } - - if (what_is_user(module) == SECURITY_SYSTEM) + if (ldb_dn_is_special(req->op.mod.message->dn)) { return ldb_next_request(module, req); - - ac->module = module; - ac->req = req; - ac->ignore_security = true; - ac->dn_to_check = ldb_dn_get_parent(req, parent); - ac->token = user_token(module); - ac->user_type = what_is_user(module); - ac->sec_result = LDB_SUCCESS; - if (!is_root_base_dn(ldb, req->op.add.message->dn) && parent && !is_root_base_dn(ldb, parent)){ - filter = talloc_asprintf(req,"(&(objectClass=*)(|(%s=%s)(%s=%s))))", - ldb_dn_get_component_name(parent,0), - ldb_dn_get_component_val(parent,0)->data, - ldb_dn_get_component_name(ac->dn_to_check,0), - ldb_dn_get_component_val(ac->dn_to_check,0)->data); - - ret = make_req_access_check(module, req, ac, filter); - if (ret != LDB_SUCCESS){ - return ret; - } - return ldb_next_request(module, ac->down_req); } - return ldb_next_request(module, req); -} + ret = ldb_search(ldb, req, &acl_res, req->op.mod.message->dn, + LDB_SCOPE_BASE, acl_attrs, NULL); -static int acl_modify(struct ldb_module *module, struct ldb_request *req) -{ - int ret; - struct acl_context *ac; - struct ldb_dn * parent = ldb_dn_get_parent(req, req->op.mod.message->dn); - char * filter; - struct ldb_context *ldb; - struct acl_private *data; + if (ret != LDB_SUCCESS) { + return ret; + } - ldb = ldb_module_get_ctx(module); - data = talloc_get_type(ldb_module_get_private(module), struct acl_private); + ret = get_sd_from_result(req, acl_res, &sd); + if (ret != LDB_SUCCESS) { + DEBUG(10, ("acl_modify: cannot get descriptor\n")); + return ret; + } + /* Theoretically we pass the check if the object has no sd */ + if (!sd) { + return LDB_SUCCESS; + } - if (!data->perform_check) - return ldb_next_request(module, req); + guid = get_oc_guid_from_result(module,acl_res); + if (!guid) { + DEBUG(10, ("acl_modify: cannot get guid\n")); + goto fail; + } - ac = talloc(req, struct acl_context); - if (ac == NULL) { - return LDB_ERR_OPERATIONS_ERROR; + if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP, + &root, &new_node)) { + DEBUG(10, ("acl_modify: cannot add to object tree\n")); + goto fail; } + for (i=0; i < req->op.mod.message->num_elements; i++){ + const struct dsdb_attribute *attr; + /* clearTextPassword is not in schema */ + if (strcmp("clearTextPassword", req->op.mod.message->elements[i].name) == 0) { + attr = dsdb_attribute_by_lDAPDisplayName(schema, "unicodePwd"); + } else { + attr = dsdb_attribute_by_lDAPDisplayName(schema, + req->op.mod.message->elements[i].name); + } -/* TODO Is this really right? */ -/* if (what_is_user(module) == SECURITY_SYSTEM) */ - return ldb_next_request(module, req); + if (!attr) { + DEBUG(10, ("acl_modify: cannot find attribute %s\n", + req->op.mod.message->elements[i].name)); + goto fail; + } + if (!insert_in_object_tree(tmp_ctx, + &attr->attributeSecurityGUID, SEC_ADS_WRITE_PROP, + &new_node, &new_node)) { + DEBUG(10, ("acl_modify: cannot add to object tree securityGUID\n")); + goto fail; + } - ac->module = module; - ac->req = req; - ac->ignore_security = true; - ac->dn_to_check = req->op.mod.message->dn; - ac->token = user_token(module); - ac->user_type = what_is_user(module); - ac->sec_result = LDB_SUCCESS; - if (!is_root_base_dn(ldb, req->op.mod.message->dn) && parent && !is_root_base_dn(ldb, parent)){ - filter = talloc_asprintf(req,"(&(objectClass=*)(|(%s=%s)(%s=%s))))", - ldb_dn_get_component_name(parent,0), - ldb_dn_get_component_val(parent,0)->data, - ldb_dn_get_component_name(req->op.mod.message->dn,0), - ldb_dn_get_component_val(req->op.mod.message->dn,0)->data); - - ret = make_req_access_check(module, req, ac, filter); - if (ret != LDB_SUCCESS){ - return ret; + if (!insert_in_object_tree(tmp_ctx, + &attr->schemaIDGUID, SEC_ADS_WRITE_PROP, &new_node, &new_node)) { + DEBUG(10, ("acl_modify: cannot add to object tree attributeGUID\n")); + goto fail; } - return ldb_next_request(module, ac->down_req); } + + status = sec_access_check_ds(sd, acl_user_token(module), + SEC_ADS_WRITE_PROP, + &access_granted, + root); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(10, ("Object %s nas no write property access\n", + ldb_dn_get_linearized(req->op.mod.message->dn))); + acl_debug(sd, + acl_user_token(module), + req->op.mod.message->dn, + true, + 10); + talloc_free(tmp_ctx); + return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; + } + + talloc_free(tmp_ctx); return ldb_next_request(module, req); +fail: + talloc_free(tmp_ctx); + return LDB_ERR_OPERATIONS_ERROR; } /* similar to the modify for the time being. @@ -834,319 +364,172 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req) static int acl_delete(struct ldb_module *module, struct ldb_request *req) { int ret; - struct acl_context *ac; - struct ldb_dn * parent = ldb_dn_get_parent(req, req->op.del.dn); - char * filter; + struct ldb_dn *parent = ldb_dn_get_parent(req, req->op.del.dn); struct ldb_context *ldb; - struct acl_private *data; - - ldb = ldb_module_get_ctx(module); - data = talloc_get_type(ldb_module_get_private(module), struct acl_private); - if (!data->perform_check) + DEBUG(10, ("ldb:acl_delete: %s\n", ldb_dn_get_linearized(req->op.del.dn))); + if (what_is_user(module) == SECURITY_SYSTEM) { return ldb_next_request(module, req); - - ac = talloc(req, struct acl_context); - if (ac == NULL) { - return LDB_ERR_OPERATIONS_ERROR; } - if (ac->user_type == SECURITY_SYSTEM) + if (ldb_dn_is_special(req->op.del.dn)) { return ldb_next_request(module, req); - - ac->module = module; - ac->req = req; - ac->ignore_security = true; - ac->dn_to_check = req->op.del.dn; - ac->token = user_token(module); - ac->user_type = what_is_user(module); - ac->sec_result = LDB_SUCCESS; - if (parent) { - filter = talloc_asprintf(req,"(&(objectClass=*)(|(%s=%s)(%s=%s))))", - ldb_dn_get_component_name(parent,0), - ldb_dn_get_component_val(parent,0)->data, - ldb_dn_get_component_name(req->op.del.dn,0), - ldb_dn_get_component_val(req->op.del.dn,0)->data); - ret = make_req_access_check(module, req, ac, filter); - - if (ret != LDB_SUCCESS){ - return ret; - } - return ldb_next_request(module, ac->down_req); } - - return ldb_next_request(module, req); -} - -static int acl_rename(struct ldb_module *module, struct ldb_request *req) -{ - struct ldb_dn *source_parent; - struct ldb_dn *dest_parent; - int ret; - struct acl_context *ac; - char * filter; - struct ldb_context *ldb; - struct acl_private *data; - ldb = ldb_module_get_ctx(module); - data = talloc_get_type(ldb_module_get_private(module), struct acl_private); - - if (!data->perform_check) + /* first check if we have delete object right */ + ret = check_access_on_dn(module, req, req->op.del.dn, SEC_STD_DELETE, NULL); + if (ret == LDB_SUCCESS) { return ldb_next_request(module, req); - - ac = talloc(req, struct acl_context); - if (ac == NULL) { - return LDB_ERR_OPERATIONS_ERROR; } - if (ac->user_type == SECURITY_SYSTEM) - return ldb_next_request(module, req); - - ac->module = module; - ac->req = req; - ac->ignore_security = true; - ac->token = user_token(module); - ac->user_type = what_is_user(module); - ac->sec_result = LDB_SUCCESS; - - /* We need to know if it is a simple rename or a move operation */ - source_parent = ldb_dn_get_parent(req, req->op.rename.olddn); - dest_parent = ldb_dn_get_parent(req, req->op.rename.newdn); - - if (ldb_dn_compare(source_parent, dest_parent) == 0){ - /*Not a move, just rename*/ - filter = talloc_asprintf(req,"(&(objectClass=*)(|(%s=%s)(%s=%s))))", - ldb_dn_get_component_name(dest_parent,0), - ldb_dn_get_component_val(dest_parent,0)->data, - ldb_dn_get_component_name(req->op.rename.olddn,0), - ldb_dn_get_component_val(req->op.rename.olddn,0)->data); + /* Nope, we don't have delete object. Lets check if we have delete child on the parent */ + /* No parent, so check fails */ + if ((ldb_dn_compare(req->op.del.dn, (ldb_get_schema_basedn(ldb))) == 0) || + (ldb_dn_compare(req->op.del.dn, (ldb_get_config_basedn(ldb))) == 0) || + (ldb_dn_compare(req->op.del.dn, (ldb_get_root_basedn(ldb))) == 0)) { + DEBUG(10,("acl:deleting an NC\n")); + return ldb_module_done(req, NULL, NULL, LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS); } - else{ - filter = talloc_asprintf(req,"(&(objectClass=*)(|(%s=%s)(%s=%s))))", - ldb_dn_get_component_name(dest_parent,0), - ldb_dn_get_component_val(dest_parent,0)->data, - ldb_dn_get_component_name(source_parent,0), - ldb_dn_get_component_val(source_parent,0)->data); - } - - ret = make_req_access_check(module, req, ac, filter); - if (ret != LDB_SUCCESS){ + ret = check_access_on_dn(module, req, parent, SEC_ADS_DELETE_CHILD, NULL); + if (ret != LDB_SUCCESS) { return ret; - } - return ldb_next_request(module, ac->down_req); + } + return ldb_next_request(module, req); } -static int acl_search_callback(struct ldb_request *req, struct ldb_reply *ares) +static int acl_rename(struct ldb_module *module, struct ldb_request *req) { + int ret; + struct ldb_dn *oldparent = ldb_dn_get_parent(req, req->op.rename.olddn); + struct ldb_dn *newparent = ldb_dn_get_parent(req, req->op.rename.newdn); struct ldb_context *ldb; - struct acl_context *ac; - struct security_descriptor *sd; - uint32_t searchFlags; - uint32_t access_mask; - struct object_tree *ot; - int i, ret; + struct security_descriptor *sd = NULL; + struct ldb_result *acl_res; + const struct GUID *guid; + struct object_tree *root = NULL; + struct object_tree *new_node = NULL; + TALLOC_CTX *tmp_ctx = talloc_new(req); NTSTATUS status; - struct ldb_message_element *element_security_descriptor; - struct ldb_message_element *element_object_class; - const struct dsdb_attribute *attr; - const struct dsdb_schema *schema; - struct GUID *oc_guid; - - ac = talloc_get_type(req->context, struct acl_context); - ldb = ldb_module_get_ctx(ac->module); - schema = dsdb_get_schema(ldb); - if (!ares) { - return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR); + uint32_t access_granted; + static const char *acl_attrs[] = { + "nTSecurityDescriptor", + "objectClass", + NULL + }; + + DEBUG(10, ("ldb:acl_rename: %s\n", ldb_dn_get_linearized(req->op.rename.olddn))); + if (what_is_user(module) == SECURITY_SYSTEM) { + return ldb_next_request(module, req); } - if (ares->error != LDB_SUCCESS) { - return ldb_module_done(ac->req, ares->controls, ares->response, ares->error); + if (ldb_dn_is_special(req->op.rename.olddn)) { + return ldb_next_request(module, req); } + ldb = ldb_module_get_ctx(module); - switch (ares->type) { - case LDB_REPLY_ENTRY: - switch (ac->user_type) { - case SECURITY_SYSTEM: - case SECURITY_ANONYMOUS:/*FIXME: should we let anonymous have system access*/ - break; - default: - /* Access checks - * - * 0. If we do not have nTSecurityDescriptor, we do not have an object in the response, - * so check the parent dn. - * 1. Call sec_access_check on empty tree - * 2. For each attribute call extended_access_check - * 3. For each attribute call build_object_tree_form_attr_list and then check with sec_access_check - * - */ - element_security_descriptor = ldb_msg_find_element(ares->message, "nTSecurityDescriptor"); - element_object_class = ldb_msg_find_element(ares->message, "objectClass"); - if (!element_security_descriptor || !element_object_class) - break; - - sd = talloc(ldb, struct security_descriptor); - if(!sd) { - return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR); - } - if(!NDR_ERR_CODE_IS_SUCCESS(ndr_pull_struct_blob(&element_security_descriptor->values[0], - ldb, - NULL, - sd, - (ndr_pull_flags_fn_t)ndr_pull_security_descriptor))) { - DEBUG(0, ("acl_search_callback: Error parsing security descriptor\n")); - return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR); - } - - oc_guid = class_schemaid_guid_by_lDAPDisplayName(schema, element_object_class->values[0].data); - for (i=0; i<ares->message->num_elements; i++) { - attr = dsdb_attribute_by_lDAPDisplayName(schema, ares->message->elements[i].name); - if (attr) { - searchFlags = attr->searchFlags; - } else { - searchFlags = 0x0; - } - - /*status = extended_access_check(ares->message->elements[i].name, access_mask, searchFlags); */ /* Todo FIXME */ - ac->access_needed = SEC_ADS_READ_PROP; - if (NT_STATUS_IS_OK(status)) { - ot = insert_in_object_tree(req, oc_guid, NULL, ac->access_needed, NULL); - - insert_in_object_tree(req, - &attr->schemaIDGUID, - &attr->attributeSecurityGUID, - ac->access_needed, - ot); - - status = sec_access_check_ds(sd, - ac->token, - ac->access_needed, - &access_mask, - ot); - - if (NT_STATUS_IS_OK(status)) { - continue; - } - } - ldb_msg_remove_attr(ares->message, ares->message->elements[i].name); - } - break; - } - if (ac->nTSecurityDescriptor) { - ldb_msg_remove_attr(ares->message, "nTSecurityDescriptor"); - } else if (ac->objectClass) { - ldb_msg_remove_attr(ares->message, "objectClass"); - } - - return ldb_module_send_entry(ac->req, ares->message, ares->controls); - case LDB_REPLY_REFERRAL: - return ldb_module_send_referral(ac->req, ares->referral); - - case LDB_REPLY_DONE: - return ldb_module_done(ac->req, ares->controls,ares->response, LDB_SUCCESS); + /* search to include deleted objects */ + ret = ldb_search(ldb, req, &acl_res, req->op.rename.olddn, + LDB_SCOPE_BASE, acl_attrs, NULL); + /* we sould be able to find the parent */ + if (ret != LDB_SUCCESS) { + DEBUG(10,("acl: failed to find object %s\n", + ldb_dn_get_linearized(req->op.rename.olddn))); + return ret; } - return LDB_SUCCESS; -} + guid = get_oc_guid_from_result(module,acl_res); + if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP, + &root, &new_node)) { + return LDB_ERR_OPERATIONS_ERROR; + }; -static int acl_search(struct ldb_module *module, struct ldb_request *req) -{ - int ret; - struct ldb_context *ldb; - struct acl_context *ac; - const char **attrs; - struct ldb_control *sd_control; - struct ldb_control **sd_saved_controls; - struct ldb_dn * parent; - struct acl_private *data; + guid = attribute_schemaid_guid_by_lDAPDisplayName(dsdb_get_schema(ldb), + "name"); + if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP, + &new_node, &new_node)) { + return LDB_ERR_OPERATIONS_ERROR; + }; - ldb = ldb_module_get_ctx(module); - data = talloc_get_type(ldb_module_get_private(module), struct acl_private); + ret = get_sd_from_result(req, acl_res, &sd); - if (!data || !data->perform_check) - return ldb_next_request(module, req); + if (ret != LDB_SUCCESS) { + return LDB_ERR_OPERATIONS_ERROR; + } + /* Theoretically we pass the check if the object has no sd */ + if (!sd) { + return LDB_SUCCESS; + } + status = sec_access_check_ds(sd, acl_user_token(module), + SEC_ADS_WRITE_PROP, + &access_granted, + root); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(10, ("Object %s nas no wp on name\n", + ldb_dn_get_linearized(req->op.rename.olddn))); + acl_debug(sd, + acl_user_token(module), + req->op.rename.olddn, + true, + 10); + return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; + } - if (what_is_user(module) == SECURITY_SYSTEM) + if (ldb_dn_compare(oldparent, newparent) == 0) { + /* regular rename, not move, nothing more to do */ return ldb_next_request(module, req); + } - ac = talloc_get_type(req->context, struct acl_context); - if ( ac == NULL ) { - ac = talloc(req, struct acl_context); - if (ac == NULL) { - ldb_oom(ldb); - return LDB_ERR_OPERATIONS_ERROR; - } - ac->module = module; - ac->req = req; - ac->ignore_security = false; - ac->user_type = what_is_user(module); - ac->token = user_token(module); - ac->dn_to_check = req->op.search.base; - ac->sec_result = LDB_SUCCESS; - - attrs = talloc_array(ac, const char*, 2); - attrs[0] = talloc_strdup(attrs, "nTSecurityDescriptor"); - attrs[1] = NULL; - parent = ldb_dn_get_parent(req, ac->dn_to_check); - if (!is_root_base_dn(ldb, req->op.search.base) && parent && !is_root_base_dn(ldb, parent)) { - /*we have parent so check for visibility*/ - ret = ldb_build_search_req(&ac->down_req, - ldb, ac, - parent, - LDB_SCOPE_BASE, - "(objectClass=*)", - attrs, - req->controls, - ac, acl_visible_callback, - req); - if (ret != LDB_SUCCESS) { - return ret; - } - return ldb_next_request(module, ac->down_req); - } else { - return acl_forward_search(ac); + /* What exactly to do in this case? It would fail anyway.. */ + if ((ldb_dn_compare(req->op.rename.newdn, (ldb_get_schema_basedn(ldb))) == 0) || + (ldb_dn_compare(req->op.rename.newdn, (ldb_get_config_basedn(ldb))) == 0) || + (ldb_dn_compare(req->op.rename.newdn, (ldb_get_root_basedn(ldb))) == 0)) { + DEBUG(10,("acl:moving as an NC\n")); + return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; } + /* new parent should have create child */ + talloc_free(tmp_ctx); + tmp_ctx = talloc_new(req); + root = NULL; + new_node = NULL; + guid = get_oc_guid_from_result(module,acl_res); + if (!guid) { + DEBUG(10,("acl:renamed object has no object class\n")); + return ldb_module_done(req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR); + } + if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_CREATE_CHILD, + &root, &new_node)) { + return LDB_ERR_OPERATIONS_ERROR; } + ret = check_access_on_dn(module, req, newparent, SEC_ADS_CREATE_CHILD, root); + if (ret != LDB_SUCCESS) { + DEBUG(10,("acl:access_denied renaming %s", ldb_dn_get_linearized(req->op.rename.olddn))); + return ret; + } + /* do we have delete object on the object? */ - return ldb_next_request(module, req); -} - -static int acl_extended(struct ldb_module *module, struct ldb_request *req) -{ - struct ldb_context *ldb = ldb_module_get_ctx(module); - enum security_user_level user_type; - struct acl_private *data; - - data = talloc_get_type(ldb_module_get_private(module), struct acl_private); - - if (!data->perform_check) - return ldb_next_request(module, req); + status = sec_access_check_ds(sd, acl_user_token(module), + SEC_STD_DELETE, + &access_granted, + NULL); - /* allow everybody to read the sequence number */ - if (strcmp(req->op.extended.oid, LDB_EXTENDED_SEQUENCE_NUMBER) == 0) { + if (NT_STATUS_IS_OK(status)) { return ldb_next_request(module, req); } - - user_type = what_is_user(module); - switch (user_type) { - case SECURITY_SYSTEM: - case SECURITY_ADMINISTRATOR: - return ldb_next_request(module, req); - default: - ldb_asprintf_errstring(ldb, - "acl_extended: attempted database modify not permitted." - "User %s is not SYSTEM or an Administrator", - user_name(req, module)); - return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; + /* what about delete child on the current parent */ + ret = check_access_on_dn(module, req, oldparent, SEC_ADS_DELETE_CHILD, NULL); + if (ret != LDB_SUCCESS) { + DEBUG(10,("acl:access_denied renaming %s", ldb_dn_get_linearized(req->op.rename.olddn))); + return ldb_module_done(req, NULL, NULL, ret); } + return ldb_next_request(module, req); } _PUBLIC_ const struct ldb_module_ops ldb_acl_module_ops = { .name = "acl", - .search = acl_search, .add = acl_add, .modify = acl_modify, .del = acl_delete, .rename = acl_rename, - .extended = acl_extended, .init_context = acl_module_init }; diff --git a/source4/dsdb/samdb/ldb_modules/kludge_acl.c b/source4/dsdb/samdb/ldb_modules/kludge_acl.c index 79309e82bf..0cec95b1c2 100644 --- a/source4/dsdb/samdb/ldb_modules/kludge_acl.c +++ b/source4/dsdb/samdb/ldb_modules/kludge_acl.c @@ -527,10 +527,10 @@ done: _PUBLIC_ const struct ldb_module_ops ldb_kludge_acl_module_ops = { .name = "kludge_acl", .search = kludge_acl_search, - .add = kludge_acl_change, +/* .add = kludge_acl_change, .modify = kludge_acl_change, .del = kludge_acl_change, - .rename = kludge_acl_change, + .rename = kludge_acl_change, */ .extended = kludge_acl_extended, .init_context = kludge_acl_init }; diff --git a/source4/dsdb/schema/schema_query.c b/source4/dsdb/schema/schema_query.c index a2d9792a24..3d46cfb3b1 100644 --- a/source4/dsdb/schema/schema_query.c +++ b/source4/dsdb/schema/schema_query.c @@ -419,8 +419,8 @@ const char **dsdb_full_attribute_list(TALLOC_CTX *mem_ctx, /* Return the schemaIDGUID of a class */ -const struct GUID * class_schemaid_guid_by_lDAPDisplayName(const struct dsdb_schema *schema, - const char *name) +const struct GUID *class_schemaid_guid_by_lDAPDisplayName(const struct dsdb_schema *schema, + const char *name) { const struct dsdb_class *object_class = dsdb_class_by_lDAPDisplayName(schema, name); if (!object_class) @@ -428,3 +428,13 @@ const struct GUID * class_schemaid_guid_by_lDAPDisplayName(const struct dsdb_sch return &object_class->schemaIDGUID; } + +const struct GUID *attribute_schemaid_guid_by_lDAPDisplayName(const struct dsdb_schema *schema, + const char *name) +{ + const struct dsdb_attribute *attr = dsdb_attribute_by_lDAPDisplayName(schema, name); + if (!attr) + return NULL; + + return &attr->schemaIDGUID; +} diff --git a/source4/libcli/security/object_tree.c b/source4/libcli/security/object_tree.c index 85b407913c..7c7d644543 100644 --- a/source4/libcli/security/object_tree.c +++ b/source4/libcli/security/object_tree.c @@ -30,7 +30,6 @@ */ #include "includes.h" #include "libcli/security/security.h" -#include "lib/util/dlinklist.h" #include "librpc/ndr/libndr.h" /* Adds a new node to the object tree. If attributeSecurityGUID is not zero and @@ -38,69 +37,85 @@ * In all other cases as a child of the root */ -struct object_tree * insert_in_object_tree(TALLOC_CTX *mem_ctx, - const struct GUID *schemaGUIDID, - const struct GUID *attributeSecurityGUID, - uint32_t init_access, - struct object_tree *root) +bool insert_in_object_tree(TALLOC_CTX *mem_ctx, + const struct GUID *guid, + uint32_t init_access, + struct object_tree **root, + struct object_tree **new_node) { - struct object_tree * parent = NULL; - struct object_tree * new_node; - - new_node = talloc(mem_ctx, struct object_tree); - if (!new_node) - return NULL; - memset(new_node, 0, sizeof(struct object_tree)); - new_node->remaining_access = init_access; - - if (!root){ - memcpy(&new_node->guid, schemaGUIDID, sizeof(struct GUID)); - return new_node; + if (!guid || GUID_all_zero(guid)){ + return true; } - if (attributeSecurityGUID && !GUID_all_zero(attributeSecurityGUID)){ - parent = get_object_tree_by_GUID(root, attributeSecurityGUID); - memcpy(&new_node->guid, attributeSecurityGUID, sizeof(struct GUID)); + if (!*root){ + *root = talloc_zero(mem_ctx, struct object_tree); + if (!*root) { + return false; + } + (*root)->guid = *guid; + *new_node = *root; + return true; } - else - memcpy(&new_node->guid, schemaGUIDID, sizeof(struct GUID)); - if (!parent) - parent = root; - - new_node->remaining_access = init_access; - DLIST_ADD(parent, new_node); - return new_node; + if (!(*root)->children) { + (*root)->children = talloc_array(mem_ctx, struct object_tree, 1); + (*root)->children[0].guid = *guid; + (*root)->children[0].num_of_children = 0; + (*root)->children[0].children = NULL; + (*root)->num_of_children++; + (*root)->children[0].remaining_access = init_access; + *new_node = &((*root)->children[0]); + return true; + } + else { + int i; + for (i = 0; i < (*root)->num_of_children; i++) { + if (GUID_equal(&((*root)->children[i].guid), guid)) { + *new_node = &((*root)->children[i]); + return true; + } + } + (*root)->children = talloc_realloc(mem_ctx, (*root)->children, struct object_tree, + (*root)->num_of_children +1); + (*root)->children[(*root)->num_of_children].guid = *guid; + (*root)->children[(*root)->num_of_children].remaining_access = init_access; + *new_node = &((*root)->children[(*root)->num_of_children]); + (*root)->num_of_children++; + return true; + } + return true; } /* search by GUID */ -struct object_tree * get_object_tree_by_GUID(struct object_tree *root, +struct object_tree *get_object_tree_by_GUID(struct object_tree *root, const struct GUID *guid) { - struct object_tree *p; struct object_tree *result = NULL; + int i; - if (!root || GUID_equal(&root->guid, guid)) + if (!root || GUID_equal(&root->guid, guid)) { result = root; - else{ - for (p = root->children; p != NULL; p = p->next) - if ((result = get_object_tree_by_GUID(p, guid))) + return result; + } + else if (root->num_of_children > 0) { + for (i = 0; i < root->num_of_children; i++) { + if ((result = get_object_tree_by_GUID(&root->children[i], guid))) break; + } } - return result; } /* Change the granted access per each ACE */ void object_tree_modify_access(struct object_tree *root, - uint32_t access_mask) + uint32_t access) { - struct object_tree *p; - if (root){ - root->remaining_access &= ~access_mask; + root->remaining_access &= ~access; + if (root->num_of_children > 0) { + int i; + for (i = 0; i < root->num_of_children; i++) { + object_tree_modify_access(&root->children[i], access); + } } - - for (p = root->children; p != NULL; p = p->next) - object_tree_modify_access(p, access_mask); } diff --git a/source4/libcli/security/security.h b/source4/libcli/security/security.h index 18f6c820d1..bdf473bcf1 100644 --- a/source4/libcli/security/security.h +++ b/source4/libcli/security/security.h @@ -32,10 +32,8 @@ struct auth_session_info; struct object_tree { uint32_t remaining_access; struct GUID guid; - /* linked list of children */ - struct object_tree * children; - struct object_tree * prev; - struct object_tree * next; + int num_of_children; + struct object_tree *children; }; /* Moved the dom_sid functions to the top level dir with manual proto header */ diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py index 188c5909f6..ffafa2c223 100644 --- a/source4/scripting/python/samba/provision.py +++ b/source4/scripting/python/samba/provision.py @@ -593,7 +593,6 @@ def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, modules_list = ["resolve_oids", "rootdse", "lazy_commit", - "acl", "paged_results", "ranged_results", "anr", @@ -604,6 +603,7 @@ def setup_samdb_partitions(samdb_path, setup_path, message, lp, session_info, "rdn_name", "objectclass", "descriptor", + "acl", "samldb", "password_hash", "operational", |