From 949541cc6f42651344c14dc6f673e72a3e7db947 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Sat, 18 Sep 2010 11:06:02 +1000 Subject: libcli/security Move source3/lib/util_seaccess.c into the common code Signed-off-by: Andrew Tridgell --- source3/Makefile.in | 2 +- source3/include/proto.h | 8 -- source3/lib/util_seaccess.c | 251 -------------------------------------------- 3 files changed, 1 insertion(+), 260 deletions(-) delete mode 100644 source3/lib/util_seaccess.c (limited to 'source3') diff --git a/source3/Makefile.in b/source3/Makefile.in index 18335cf1c7..a73ce26a3a 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -470,7 +470,7 @@ LIB_OBJ = $(LIBSAMBAUTIL_OBJ) $(UTIL_OBJ) $(CRYPTO_OBJ) \ lib/module.o lib/events.o @LIBTEVENT_OBJ0@ \ lib/server_contexts.o \ lib/ldap_escape.o @CHARSET_STATIC@ \ - lib/secdesc.o lib/util_seaccess.o ../libcli/security/secace.o \ + lib/secdesc.o ../libcli/security/access_check.o ../libcli/security/secace.o \ ../libcli/security/sddl.o \ ../libcli/security/secacl.o @PTHREADPOOL_OBJ@ \ lib/fncall.o \ diff --git a/source3/include/proto.h b/source3/include/proto.h index 42ff86751a..81e1909521 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -1237,14 +1237,6 @@ bool push_reg_multi_sz(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, const char **a); bool pull_reg_sz(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, const char **s); bool pull_reg_multi_sz(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, const char ***a); -/* The following definitions come from lib/util_seaccess.c */ - -void se_map_generic(uint32 *access_mask, const struct generic_mapping *mapping); -void security_acl_map_generic(struct security_acl *sa, const struct generic_mapping *mapping); -void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping); -NTSTATUS se_access_check(const struct security_descriptor *sd, const struct security_token *token, - uint32 acc_desired, uint32 *acc_granted); - /* The following definitions come from lib/util_sec.c */ void sec_init(void); diff --git a/source3/lib/util_seaccess.c b/source3/lib/util_seaccess.c deleted file mode 100644 index 6500f926fd..0000000000 --- a/source3/lib/util_seaccess.c +++ /dev/null @@ -1,251 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - Copyright (C) Andrew Tridgell 2004 - Copyright (C) Gerald Carter 2005 - Copyright (C) Volker Lendecke 2007 - Copyright (C) Jeremy Allison 2008 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "includes.h" -#include "libcli/security/security.h" - -/* Map generic access rights to object specific rights. This technique is - used to give meaning to assigning read, write, execute and all access to - objects. Each type of object has its own mapping of generic to object - specific access rights. */ - -void se_map_generic(uint32 *access_mask, const struct generic_mapping *mapping) -{ - uint32 old_mask = *access_mask; - - if (*access_mask & GENERIC_READ_ACCESS) { - *access_mask &= ~GENERIC_READ_ACCESS; - *access_mask |= mapping->generic_read; - } - - if (*access_mask & GENERIC_WRITE_ACCESS) { - *access_mask &= ~GENERIC_WRITE_ACCESS; - *access_mask |= mapping->generic_write; - } - - if (*access_mask & GENERIC_EXECUTE_ACCESS) { - *access_mask &= ~GENERIC_EXECUTE_ACCESS; - *access_mask |= mapping->generic_execute; - } - - if (*access_mask & GENERIC_ALL_ACCESS) { - *access_mask &= ~GENERIC_ALL_ACCESS; - *access_mask |= mapping->generic_all; - } - - if (old_mask != *access_mask) { - DEBUG(10, ("se_map_generic(): mapped mask 0x%08x to 0x%08x\n", - old_mask, *access_mask)); - } -} - -/* Map generic access rights to object specific rights for all the ACE's - * in a security_acl. - */ - -void security_acl_map_generic(struct security_acl *sa, - const struct generic_mapping *mapping) -{ - unsigned int i; - - if (!sa) { - return; - } - - for (i = 0; i < sa->num_aces; i++) { - se_map_generic(&sa->aces[i].access_mask, mapping); - } -} - -/* Map standard access rights to object specific rights. This technique is - used to give meaning to assigning read, write, execute and all access to - objects. Each type of object has its own mapping of standard to object - specific access rights. */ - -void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping) -{ - uint32 old_mask = *access_mask; - - if (*access_mask & SEC_STD_READ_CONTROL) { - *access_mask &= ~SEC_STD_READ_CONTROL; - *access_mask |= mapping->std_read; - } - - if (*access_mask & (SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE)) { - *access_mask &= ~(SEC_STD_DELETE|SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER|SEC_STD_SYNCHRONIZE); - *access_mask |= mapping->std_all; - } - - if (old_mask != *access_mask) { - DEBUG(10, ("se_map_standard(): mapped mask 0x%08x to 0x%08x\n", - old_mask, *access_mask)); - } -} - -/* - perform a SEC_FLAG_MAXIMUM_ALLOWED access check -*/ -static uint32_t access_check_max_allowed(const struct security_descriptor *sd, - const struct security_token *token) -{ - uint32_t denied = 0, granted = 0; - unsigned i; - - if (security_token_has_sid(token, sd->owner_sid)) { - granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL | SEC_STD_DELETE; - } else if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) { - granted |= SEC_STD_DELETE; - } - - if (sd->dacl == NULL) { - return granted & ~denied; - } - - for (i = 0;idacl->num_aces; i++) { - struct security_ace *ace = &sd->dacl->aces[i]; - - if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) { - continue; - } - - if (!security_token_has_sid(token, &ace->trustee)) { - continue; - } - - switch (ace->type) { - case SEC_ACE_TYPE_ACCESS_ALLOWED: - granted |= ace->access_mask; - break; - case SEC_ACE_TYPE_ACCESS_DENIED: - case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: - denied |= ace->access_mask; - break; - default: /* Other ACE types not handled/supported */ - break; - } - } - - return granted & ~denied; -} - -/* - The main entry point for access checking. If returning ACCESS_DENIED - this function returns the denied bits in the uint32_t pointed - to by the access_granted pointer. -*/ -NTSTATUS se_access_check(const struct security_descriptor *sd, - const struct security_token *token, - uint32_t access_desired, - uint32_t *access_granted) -{ - uint32_t i; - uint32_t bits_remaining; - - *access_granted = access_desired; - bits_remaining = access_desired; - - /* handle the maximum allowed flag */ - if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) { - uint32_t orig_access_desired = access_desired; - - access_desired |= access_check_max_allowed(sd, token); - access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED; - *access_granted = access_desired; - bits_remaining = access_desired & ~SEC_STD_DELETE; - - DEBUG(10,("se_access_check: MAX desired = 0x%x, granted = 0x%x, remaining = 0x%x\n", - orig_access_desired, - *access_granted, - bits_remaining)); - } - - if (access_desired & SEC_FLAG_SYSTEM_SECURITY) { - if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) { - bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY; - } else { - return NT_STATUS_PRIVILEGE_NOT_HELD; - } - } - - /* a NULL dacl allows access */ - if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) { - *access_granted = access_desired; - return NT_STATUS_OK; - } - - /* the owner always gets SEC_STD_WRITE_DAC, SEC_STD_READ_CONTROL and SEC_STD_DELETE */ - if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE)) && - security_token_has_sid(token, sd->owner_sid)) { - bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE); - } - if ((bits_remaining & SEC_STD_DELETE) && - (security_token_has_privilege(token, SEC_PRIV_RESTORE))) { - bits_remaining &= ~SEC_STD_DELETE; - } - if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) && - security_token_has_privilege(token, SEC_PRIV_RESTORE)) { - bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE); - } - if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) && - security_token_has_privilege(token, SEC_PRIV_BACKUP)) { - bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP); - } - - if (sd->dacl == NULL) { - goto done; - } - - /* check each ace in turn. */ - for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) { - struct security_ace *ace = &sd->dacl->aces[i]; - - if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) { - continue; - } - - if (!security_token_has_sid(token, &ace->trustee)) { - continue; - } - - switch (ace->type) { - case SEC_ACE_TYPE_ACCESS_ALLOWED: - bits_remaining &= ~ace->access_mask; - break; - case SEC_ACE_TYPE_ACCESS_DENIED: - case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: - if (bits_remaining & ace->access_mask) { - return NT_STATUS_ACCESS_DENIED; - } - break; - default: /* Other ACE types not handled/supported */ - break; - } - } - -done: - if (bits_remaining != 0) { - *access_granted = bits_remaining; - return NT_STATUS_ACCESS_DENIED; - } - - return NT_STATUS_OK; -} -- cgit