diff options
Diffstat (limited to 'source4/dsdb/samdb/ldb_modules/acl.c')
-rw-r--r-- | source4/dsdb/samdb/ldb_modules/acl.c | 241 |
1 files changed, 162 insertions, 79 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/acl.c b/source4/dsdb/samdb/ldb_modules/acl.c index e823b1eada..d0e1c90746 100644 --- a/source4/dsdb/samdb/ldb_modules/acl.c +++ b/source4/dsdb/samdb/ldb_modules/acl.c @@ -259,8 +259,10 @@ static int acl_check_access_on_attribute(struct ldb_module *module, else { ret = LDB_SUCCESS; } + talloc_free(tmp_ctx); return ret; fail: + talloc_free(tmp_ctx); return LDB_ERR_OPERATIONS_ERROR; } @@ -655,49 +657,46 @@ static int acl_add(struct ldb_module *module, struct ldb_request *req) } /* checks for validated writes */ -static int acl_check_self_write(struct ldb_request *req, - struct security_descriptor *sd, - struct security_token *token, - const char *self_write, - struct dom_sid *sid) +static int acl_check_extended_right(TALLOC_CTX *mem_ctx, + struct security_descriptor *sd, + struct security_token *token, + const char *ext_right, + uint32_t right_type, + struct dom_sid *sid) { struct GUID right; NTSTATUS status; uint32_t access_granted; struct object_tree *root = NULL; struct object_tree *new_node = NULL; - TALLOC_CTX *tmp_ctx = talloc_new(req); + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); - GUID_from_string(self_write, &right); + GUID_from_string(ext_right, &right); - if (!insert_in_object_tree(tmp_ctx, &right, SEC_ADS_SELF_WRITE, + if (!insert_in_object_tree(tmp_ctx, &right, right_type, &root, &new_node)) { - DEBUG(10, ("acl_modify: cannot add to object tree\n")); + DEBUG(10, ("acl_ext_right: cannot add to object tree\n")); talloc_free(tmp_ctx); return LDB_ERR_OPERATIONS_ERROR; } status = sec_access_check_ds(sd, token, - SEC_ADS_SELF_WRITE, + right_type, &access_granted, root, sid); if (!NT_STATUS_IS_OK(status)) { - DEBUG(10, ("Object %s has no self membershipself write right\n", - ldb_dn_get_linearized(req->op.mod.message->dn))); - dsdb_acl_debug(sd, token, - req->op.mod.message->dn, - true, - 10); talloc_free(tmp_ctx); return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; } - + talloc_free(tmp_ctx); return LDB_SUCCESS; } + /* ckecks if modifications are allowed on "Member" attribute */ -static int acl_check_self_membership(struct ldb_module *module, +static int acl_check_self_membership(TALLOC_CTX *mem_ctx, + struct ldb_module *module, struct ldb_request *req, struct security_descriptor *sd, struct dom_sid *sid, @@ -706,13 +705,12 @@ static int acl_check_self_membership(struct ldb_module *module, { int ret; unsigned int i; - TALLOC_CTX *tmp_ctx = talloc_new(req); struct ldb_context *ldb = ldb_module_get_ctx(module); struct ldb_dn *user_dn; struct ldb_message_element *member_el; /* if we have wp, we can do whatever we like */ if (acl_check_access_on_attribute(module, - req, + mem_ctx, sd, sid, SEC_ADS_WRITE_PROP, @@ -720,7 +718,7 @@ static int acl_check_self_membership(struct ldb_module *module, return LDB_SUCCESS; } /* if we are adding/deleting ourselves, check for self membership */ - ret = dsdb_find_dn_by_sid(ldb, req, acl_user_token(module)->user_sid, &user_dn); + ret = dsdb_find_dn_by_sid(ldb, mem_ctx, acl_user_token(module)->user_sid, &user_dn); if (ret != LDB_SUCCESS) { return ret; } @@ -734,14 +732,86 @@ static int acl_check_self_membership(struct ldb_module *module, } for (i = 0; i < member_el->num_values; i++) { if (strcasecmp((const char *)member_el->values[i].data, - ldb_dn_get_extended_linearized(tmp_ctx, user_dn, 1)) != 0) { + ldb_dn_get_extended_linearized(mem_ctx, user_dn, 1)) != 0) { return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; } } + ret = acl_check_extended_right(mem_ctx, sd, acl_user_token(module), + GUID_DRS_SELF_MEMBERSHIP, + SEC_ADS_SELF_WRITE, + sid); + if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) { + dsdb_acl_debug(sd, acl_user_token(module), + req->op.mod.message->dn, + true, + 10); + } + return ret; +} + +static int acl_check_password_rights(TALLOC_CTX *mem_ctx, + struct ldb_module *module, + struct ldb_request *req, + struct security_descriptor *sd, + struct dom_sid *sid, + const struct GUID *oc_guid) +{ + int ret = LDB_SUCCESS; + unsigned int del_attr_cnt = 0, add_attr_cnt = 0, rep_attr_cnt = 0; + struct ldb_message_element *el; + struct ldb_message *msg; + const char *passwordAttrs[] = { "userPassword", "unicodePwd", + "clearTextPassword", NULL }, **l; + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); + + msg = ldb_msg_copy_shallow(tmp_ctx, req->op.mod.message); + if (msg == NULL) { + return LDB_ERR_OPERATIONS_ERROR; + } + for (l = passwordAttrs; *l != NULL; l++) { + while ((el = ldb_msg_find_element(msg, *l)) != NULL) { + if (el->flags == LDB_FLAG_MOD_DELETE) { + ++del_attr_cnt; + } + if (el->flags == LDB_FLAG_MOD_ADD) { + ++add_attr_cnt; + } + if (el->flags == LDB_FLAG_MOD_REPLACE) { + ++rep_attr_cnt; + } + ldb_msg_remove_element(msg, el); + } + } + /* a single delete will be handled by password hash + later in the stack, so we let it though here */ + if (del_attr_cnt > 0 && add_attr_cnt == 0) { + talloc_free(tmp_ctx); + return LDB_SUCCESS; + } + if (rep_attr_cnt > 0 || (add_attr_cnt != del_attr_cnt)) { + ret = acl_check_extended_right(tmp_ctx, sd, acl_user_token(module), + GUID_DRS_FORCE_CHANGE_PASSWORD, + SEC_ADS_CONTROL_ACCESS, + sid); + } + else if (add_attr_cnt == 1 && del_attr_cnt == 1) { + ret = acl_check_extended_right(tmp_ctx, sd, acl_user_token(module), + GUID_DRS_USER_CHANGE_PASSWORD, + SEC_ADS_CONTROL_ACCESS, + sid); + /* Very strange, but we get constraint violation in this case */ + if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) { + ret = LDB_ERR_CONSTRAINT_VIOLATION; + } + } + if (ret != LDB_SUCCESS) { + dsdb_acl_debug(sd, acl_user_token(module), + req->op.mod.message->dn, + true, + 10); + } talloc_free(tmp_ctx); - return acl_check_self_write(req, sd, acl_user_token(module), - GUID_DRS_SELF_MEMBERSHIP, - sid); + return ret; } static int acl_modify(struct ldb_module *module, struct ldb_request *req) @@ -750,7 +820,6 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req) struct ldb_context *ldb = ldb_module_get_ctx(module); const struct dsdb_schema *schema; unsigned int i; - bool modify_sd = false; const struct GUID *guid; uint32_t access_granted; struct object_tree *root = NULL; @@ -783,27 +852,27 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req) if (ldb_dn_is_special(req->op.mod.message->dn)) { return ldb_next_request(module, req); } - ret = dsdb_module_search_dn(module, req, &acl_res, req->op.mod.message->dn, + ret = dsdb_module_search_dn(module, tmp_ctx, &acl_res, req->op.mod.message->dn, acl_attrs, 0); if (ret != LDB_SUCCESS) { - return ret; + goto fail; } - schema = dsdb_get_schema(ldb, acl_res); + schema = dsdb_get_schema(ldb, tmp_ctx); if (!schema) { - talloc_free(acl_res); - return LDB_ERR_OPERATIONS_ERROR; + ret = LDB_ERR_OPERATIONS_ERROR; + goto fail; } - ret = dsdb_get_sd_from_ldb_message(req, acl_res->msgs[0], &sd); + ret = dsdb_get_sd_from_ldb_message(tmp_ctx, acl_res->msgs[0], &sd); if (ret != LDB_SUCCESS) { DEBUG(10, ("acl_modify: cannot get descriptor\n")); - return ret; + goto fail; } /* Theoretically we pass the check if the object has no sd */ if (!sd) { - return LDB_SUCCESS; + goto success; } guid = get_oc_guid_from_message(module, schema, acl_res->msgs[0]); @@ -819,52 +888,84 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req) } for (i=0; i < req->op.mod.message->num_elements; i++){ const struct dsdb_attribute *attr; - /* clearTextPassword is not in schema */ - if (ldb_attr_cmp("clearTextPassword", req->op.mod.message->elements[i].name) == 0) { - attr = dsdb_attribute_by_lDAPDisplayName(schema, "unicodePwd"); - } else { - attr = dsdb_attribute_by_lDAPDisplayName(schema, + attr = dsdb_attribute_by_lDAPDisplayName(schema, req->op.mod.message->elements[i].name); - } - - /* This basic attribute existence check with the right errorcode - * is needed since this module is the first one which requests - * schema attribute informations. - * The complete attribute checking is done in the - * "objectclass_attrs" module behind this one. - */ - if (!attr) { - ldb_asprintf_errstring(ldb, "acl_modify: attribute '%s' on entry '%s' was not found in the schema!", - req->op.mod.message->elements[i].name, - ldb_dn_get_linearized(req->op.mod.message->dn)); - talloc_free(tmp_ctx); - return LDB_ERR_NO_SUCH_ATTRIBUTE; - } if (ldb_attr_cmp("nTSecurityDescriptor", req->op.mod.message->elements[i].name) == 0) { - modify_sd = true; + status = sec_access_check_ds(sd, acl_user_token(module), + SEC_STD_WRITE_DAC, + &access_granted, + NULL, + sid); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(10, ("Object %s has no write dacl access\n", + ldb_dn_get_linearized(req->op.mod.message->dn))); + dsdb_acl_debug(sd, + acl_user_token(module), + req->op.mod.message->dn, + true, + 10); + ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; + goto fail; + } } else if (ldb_attr_cmp("member", req->op.mod.message->elements[i].name) == 0) { - ret = acl_check_self_membership(module, + ret = acl_check_self_membership(tmp_ctx, + module, req, sd, sid, guid, attr); if (ret != LDB_SUCCESS) { - return ret; + goto fail; + } + } + else if (ldb_attr_cmp("dBCSPwd", req->op.mod.message->elements[i].name) == 0) { + /* this one is not affected by any rights, we should let it through + so that passwords_hash returns the correct error */ + continue; + } + else if (ldb_attr_cmp("unicodePwd", req->op.mod.message->elements[i].name) == 0 || + ldb_attr_cmp("userPassword", req->op.mod.message->elements[i].name) == 0 || + ldb_attr_cmp("clearTextPassword", req->op.mod.message->elements[i].name) == 0) { + ret = acl_check_password_rights(tmp_ctx, + module, + req, + sd, + sid, + guid); + if (ret != LDB_SUCCESS) { + goto fail; } } else { + + /* This basic attribute existence check with the right errorcode + * is needed since this module is the first one which requests + * schema attribute informations. + * The complete attribute checking is done in the + * "objectclass_attrs" module behind this one. + */ + if (!attr) { + ldb_asprintf_errstring(ldb, "acl_modify: attribute '%s' on entry '%s' was not found in the schema!", + req->op.mod.message->elements[i].name, + ldb_dn_get_linearized(req->op.mod.message->dn)); + ret = LDB_ERR_NO_SUCH_ATTRIBUTE; + goto fail; + } if (!insert_in_object_tree(tmp_ctx, &attr->attributeSecurityGUID, SEC_ADS_WRITE_PROP, &new_node, &new_node)) { DEBUG(10, ("acl_modify: cannot add to object tree securityGUID\n")); + ret = LDB_ERR_OPERATIONS_ERROR; goto fail; } if (!insert_in_object_tree(tmp_ctx, &attr->schemaIDGUID, SEC_ADS_WRITE_PROP, &new_node, &new_node)) { DEBUG(10, ("acl_modify: cannot add to object tree attributeGUID\n")); + ret = LDB_ERR_OPERATIONS_ERROR; goto fail; } } @@ -885,35 +986,17 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req) req->op.mod.message->dn, true, 10); - talloc_free(tmp_ctx); - return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; - } - } - if (modify_sd) { - status = sec_access_check_ds(sd, acl_user_token(module), - SEC_STD_WRITE_DAC, - &access_granted, - NULL, - sid); - - if (!NT_STATUS_IS_OK(status)) { - DEBUG(10, ("Object %s has no write dacl access\n", - ldb_dn_get_linearized(req->op.mod.message->dn))); - dsdb_acl_debug(sd, - acl_user_token(module), - req->op.mod.message->dn, - true, - 10); - talloc_free(tmp_ctx); - return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; + ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; + goto fail; } } +success: talloc_free(tmp_ctx); return ldb_next_request(module, req); fail: talloc_free(tmp_ctx); - return LDB_ERR_OPERATIONS_ERROR; + return ret; } /* similar to the modify for the time being. |