diff options
Diffstat (limited to 'source4')
| -rw-r--r-- | source4/auth/auth_util.c | 132 | ||||
| -rw-r--r-- | source4/dsdb/samdb/samdb_privilege.c | 2 | ||||
| -rw-r--r-- | source4/include/smb.h | 9 | ||||
| -rw-r--r-- | source4/libcli/security/access_check.c | 2 | ||||
| -rw-r--r-- | source4/libcli/security/dom_sid.c | 2 | ||||
| -rw-r--r-- | source4/libcli/security/privilege.c | 2 | ||||
| -rw-r--r-- | source4/libcli/security/security.h | 36 | ||||
| -rw-r--r-- | source4/libcli/security/security_descriptor.c | 2 | ||||
| -rw-r--r-- | source4/libcli/security/security_token.c | 119 | ||||
| -rw-r--r-- | source4/ntvfs/unixuid/vfs_unixuid.c | 1 | ||||
| -rw-r--r-- | source4/utils/ntlm_auth.c | 1 |
11 files changed, 177 insertions, 131 deletions
diff --git a/source4/auth/auth_util.c b/source4/auth/auth_util.c index 9af4410a93..04c36143dd 100644 --- a/source4/auth/auth_util.c +++ b/source4/auth/auth_util.c @@ -24,7 +24,7 @@ #include "includes.h" #include "librpc/gen_ndr/ndr_samr.h" #include "librpc/gen_ndr/ndr_netlogon.h" -#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/security.h" #include "auth/auth.h" #undef DBGC_CLASS @@ -297,121 +297,7 @@ BOOL make_user_info_guest(TALLOC_CTX *mem_ctx, return NT_STATUS_IS_OK(nt_status) ? True : False; } -/**************************************************************************** - prints a struct security_token to debug output. -****************************************************************************/ -void debug_security_token(int dbg_class, int dbg_lev, const struct security_token *token) -{ - TALLOC_CTX *mem_ctx; - - size_t i; - - if (!token) { - DEBUGC(dbg_class, dbg_lev, ("Security token: (NULL)\n")); - return; - } - - mem_ctx = talloc_init("debug_security_token()"); - if (!mem_ctx) { - return; - } - - DEBUGC(dbg_class, dbg_lev, ("Security token of user %s\n", - dom_sid_string(mem_ctx, token->user_sid) )); - DEBUGADDC(dbg_class, dbg_lev, ("contains %lu SIDs\n", - (unsigned long)token->num_sids)); - for (i = 0; i < token->num_sids; i++) { - DEBUGADDC(dbg_class, dbg_lev, - ("SID[%3lu]: %s\n", (unsigned long)i, - dom_sid_string(mem_ctx, token->sids[i]))); - } - - talloc_destroy(mem_ctx); -} - -/**************************************************************************** - prints a struct auth_session_info security token to debug output. -****************************************************************************/ -void debug_session_info(int dbg_class, int dbg_lev, - const struct auth_session_info *session_info) -{ - if (!session_info) { - DEBUGC(dbg_class, dbg_lev, ("Session Info: (NULL)\n")); - return; - } - debug_security_token(dbg_class, dbg_lev, session_info->security_token); -} - -/**************************************************************************** - Create the SID list for this user. -****************************************************************************/ -NTSTATUS create_security_token(TALLOC_CTX *mem_ctx, - struct dom_sid *user_sid, struct dom_sid *group_sid, - int n_groupSIDs, struct dom_sid **groupSIDs, - BOOL is_guest, struct security_token **token) -{ - struct security_token *ptoken; - int i; - NTSTATUS status; - - ptoken = security_token_initialise(mem_ctx); - if (ptoken == NULL) { - return NT_STATUS_NO_MEMORY; - } - - ptoken->sids = talloc_array_p(ptoken, struct dom_sid *, n_groupSIDs + 5); - if (!ptoken->sids) { - return NT_STATUS_NO_MEMORY; - } - - ptoken->user_sid = user_sid; - ptoken->group_sid = group_sid; - ptoken->privilege_mask = 0; - - ptoken->sids[0] = user_sid; - ptoken->sids[1] = group_sid; - - /* - * Finally add the "standard" SIDs. - * The only difference between guest and "anonymous" (which we - * don't really support) is the addition of Authenticated_Users. - */ - ptoken->sids[2] = dom_sid_parse_talloc(mem_ctx, SID_WORLD); - ptoken->sids[3] = dom_sid_parse_talloc(mem_ctx, SID_NT_NETWORK); - ptoken->sids[4] = dom_sid_parse_talloc(mem_ctx, - is_guest?SID_BUILTIN_GUESTS: - SID_NT_AUTHENTICATED_USERS); - ptoken->num_sids = 5; - - for (i = 0; i < n_groupSIDs; i++) { - size_t check_sid_idx; - for (check_sid_idx = 1; - check_sid_idx < ptoken->num_sids; - check_sid_idx++) { - if (dom_sid_equal(ptoken->sids[check_sid_idx], groupSIDs[i])) { - break; - } - } - - if (check_sid_idx == ptoken->num_sids) { - ptoken->sids[ptoken->num_sids++] = groupSIDs[i]; - } - } - - /* setup the privilege mask for this token */ - status = samdb_privilege_setup(ptoken); - if (!NT_STATUS_IS_OK(status)) { - talloc_free(ptoken); - return status; - } - - debug_security_token(DBGC_AUTH, 10, ptoken); - - *token = ptoken; - - return NT_STATUS_OK; -} /*************************************************************************** Make a user_info struct @@ -640,7 +526,7 @@ NTSTATUS make_session_info(TALLOC_CTX *mem_ctx, /* we should search for local groups here */ - nt_status = create_security_token((*session_info), + nt_status = security_token_create((*session_info), server_info->user_sid, server_info->primary_group_sid, server_info->n_domain_groups, @@ -662,6 +548,20 @@ void free_session_info(struct auth_session_info **session_info) *session_info = NULL; } +/**************************************************************************** + prints a struct auth_session_info security token to debug output. +****************************************************************************/ +void auth_session_info_debug(int dbg_lev, + const struct auth_session_info *session_info) +{ + if (!session_info) { + DEBUGC(dbg_class, dbg_lev, ("Session Info: (NULL)\n")); + return; + } + + security_token_debug(dbg_lev, session_info->security_token); +} + /** * Squash an NT_STATUS in line with security requirements. * In an attempt to avoid giving the whole game away when users diff --git a/source4/dsdb/samdb/samdb_privilege.c b/source4/dsdb/samdb/samdb_privilege.c index 9fb20a84dc..2a57ff0d74 100644 --- a/source4/dsdb/samdb/samdb_privilege.c +++ b/source4/dsdb/samdb/samdb_privilege.c @@ -21,7 +21,7 @@ */ #include "includes.h" -#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/security.h" #include "lib/ldb/include/ldb.h" /* diff --git a/source4/include/smb.h b/source4/include/smb.h index 078e9b39c8..f2e29f571a 100644 --- a/source4/include/smb.h +++ b/source4/include/smb.h @@ -190,15 +190,6 @@ enum smb_signing_state {SMB_SIGNING_OFF, SMB_SIGNING_SUPPORTED, incorrect parameters - what does it mean? maybe created temporary file? */ #define NTCREATEX_ACTION_UNKNOWN 5 - -struct security_token { - struct dom_sid *user_sid; - struct dom_sid *group_sid; - uint32_t num_sids; - struct dom_sid **sids; - uint64_t privilege_mask; -}; - /* used to hold an arbitrary blob of data */ typedef struct data_blob { uint8_t *data; diff --git a/source4/libcli/security/access_check.c b/source4/libcli/security/access_check.c index c8a546682a..55749f085e 100644 --- a/source4/libcli/security/access_check.c +++ b/source4/libcli/security/access_check.c @@ -21,7 +21,7 @@ */ #include "includes.h" -#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/security.h" /* diff --git a/source4/libcli/security/dom_sid.c b/source4/libcli/security/dom_sid.c index 108e2f5500..368278708a 100644 --- a/source4/libcli/security/dom_sid.c +++ b/source4/libcli/security/dom_sid.c @@ -22,7 +22,7 @@ */ #include "includes.h" -#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/security.h" /***************************************************************** Compare the auth portion of two sids. diff --git a/source4/libcli/security/privilege.c b/source4/libcli/security/privilege.c index aa01dc2c65..ed98e9ce32 100644 --- a/source4/libcli/security/privilege.c +++ b/source4/libcli/security/privilege.c @@ -21,7 +21,7 @@ */ #include "includes.h" -#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/security.h" static const struct { diff --git a/source4/libcli/security/security.h b/source4/libcli/security/security.h new file mode 100644 index 0000000000..b11d10f6f6 --- /dev/null +++ b/source4/libcli/security/security.h @@ -0,0 +1,36 @@ +/* + Unix SMB/CIFS implementation. + + security utility functions + + Copyright (C) Andrew Tridgell 2004 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#ifndef _SAMBA_SECURITY_H +#define _SAMBA_SECURITY_H + +#include "librpc/gen_ndr/ndr_security.h" + +struct security_token { + struct dom_sid *user_sid; + struct dom_sid *group_sid; + uint32_t num_sids; + struct dom_sid **sids; + uint64_t privilege_mask; +}; + +#endif /* _SAMBA_SECURITY_H */ diff --git a/source4/libcli/security/security_descriptor.c b/source4/libcli/security/security_descriptor.c index ab81a2e5b9..509ec1f343 100644 --- a/source4/libcli/security/security_descriptor.c +++ b/source4/libcli/security/security_descriptor.c @@ -21,7 +21,7 @@ */ #include "includes.h" -#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/security.h" /* return a blank security descriptor (no owners, dacl or sacl) diff --git a/source4/libcli/security/security_token.c b/source4/libcli/security/security_token.c index a8ce989de7..7bd533dbee 100644 --- a/source4/libcli/security/security_token.c +++ b/source4/libcli/security/security_token.c @@ -21,7 +21,7 @@ */ #include "includes.h" -#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/security.h" /* return a blank security token @@ -43,3 +43,120 @@ struct security_token *security_token_initialise(TALLOC_CTX *mem_ctx) return st; } + +/**************************************************************************** + Create the SID list for this user. +****************************************************************************/ +NTSTATUS security_token_create(TALLOC_CTX *mem_ctx, + struct dom_sid *user_sid, struct dom_sid *group_sid, + int n_groupSIDs, struct dom_sid **groupSIDs, + BOOL is_guest, struct security_token **token) +{ + struct security_token *ptoken; + int i; + NTSTATUS status; + + ptoken = security_token_initialise(mem_ctx); + if (ptoken == NULL) { + return NT_STATUS_NO_MEMORY; + } + + ptoken->sids = talloc_array_p(ptoken, struct dom_sid *, n_groupSIDs + 5); + if (!ptoken->sids) { + return NT_STATUS_NO_MEMORY; + } + + ptoken->user_sid = user_sid; + ptoken->group_sid = group_sid; + ptoken->privilege_mask = 0; + + ptoken->sids[0] = user_sid; + ptoken->sids[1] = group_sid; + + /* + * Finally add the "standard" SIDs. + * The only difference between guest and "anonymous" (which we + * don't really support) is the addition of Authenticated_Users. + */ + ptoken->sids[2] = dom_sid_parse_talloc(mem_ctx, SID_WORLD); + ptoken->sids[3] = dom_sid_parse_talloc(mem_ctx, SID_NT_NETWORK); + ptoken->sids[4] = dom_sid_parse_talloc(mem_ctx, + is_guest?SID_BUILTIN_GUESTS: + SID_NT_AUTHENTICATED_USERS); + ptoken->num_sids = 5; + + for (i = 0; i < n_groupSIDs; i++) { + size_t check_sid_idx; + for (check_sid_idx = 1; + check_sid_idx < ptoken->num_sids; + check_sid_idx++) { + if (dom_sid_equal(ptoken->sids[check_sid_idx], groupSIDs[i])) { + break; + } + } + + if (check_sid_idx == ptoken->num_sids) { + ptoken->sids[ptoken->num_sids++] = groupSIDs[i]; + } + } + + /* setup the privilege mask for this token */ + status = samdb_privilege_setup(ptoken); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(ptoken); + return status; + } + + security_token_debug(10, ptoken); + + *token = ptoken; + + return NT_STATUS_OK; +} + +/**************************************************************************** + prints a struct security_token to debug output. +****************************************************************************/ +void security_token_debug(int dbg_lev, const struct security_token *token) +{ + TALLOC_CTX *mem_ctx; + int i; + uint_t privilege; + + if (!token) { + DEBUG(dbg_lev, ("Security token: (NULL)\n")); + return; + } + + mem_ctx = talloc_init("security_token_debug()"); + if (!mem_ctx) { + return; + } + + DEBUG(dbg_lev, ("Security token of user %s\n", + dom_sid_string(mem_ctx, token->user_sid) )); + DEBUGADD(dbg_lev, (" SIDs (%lu):\n", + (unsigned long)token->num_sids)); + for (i = 0; i < token->num_sids; i++) { + DEBUGADD(dbg_lev, (" SID[%3lu]: %s\n", (unsigned long)i, + dom_sid_string(mem_ctx, token->sids[i]))); + } + + DEBUGADD(dbg_lev, (" Privileges (0x%08X%08X):\n", + (uint32_t)((token->privilege_mask & 0xFFFFFFFF00000000LL) >> 32), + (uint32_t)(token->privilege_mask & 0x00000000FFFFFFFFLL))); + + if (token->privilege_mask) { + i = 0; + for (privilege = 0; privilege < 64; privilege++) { + uint64_t mask = sec_privilege_mask(privilege); + + if (token->privilege_mask & mask) { + DEBUGADD(dbg_lev, (" Privilege[%3lu]: %s\n", (unsigned long)i++, + sec_privilege_name(privilege))); + } + } + } + + talloc_destroy(mem_ctx); +} diff --git a/source4/ntvfs/unixuid/vfs_unixuid.c b/source4/ntvfs/unixuid/vfs_unixuid.c index 1c4572969f..f29ed51a49 100644 --- a/source4/ntvfs/unixuid/vfs_unixuid.c +++ b/source4/ntvfs/unixuid/vfs_unixuid.c @@ -23,6 +23,7 @@ #include "includes.h" #include "auth/auth.h" +#include "libcli/security/security.h" #include "smb_server/smb_server.h" struct unixuid_private { diff --git a/source4/utils/ntlm_auth.c b/source4/utils/ntlm_auth.c index f741999ac9..569e1e7cb8 100644 --- a/source4/utils/ntlm_auth.c +++ b/source4/utils/ntlm_auth.c @@ -27,6 +27,7 @@ #include "system/passwd.h" #include "lib/cmdline/popt_common.h" #include "auth/auth.h" +#include "libcli/security/security.h" #undef DBGC_CLASS #define DBGC_CLASS DBGC_WINBIND |