1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
/*
Copyright (C) Nadezhda Ivanova 2009
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
* Name: create_descriptor
*
* Component: routines for calculating and creating security descriptors
* as described in MS-DTYP 2.5.2.2
*
* Description:
*
*
* Author: Nadezhda Ivanova
*/
#include "includes.h"
#include "libcli/security/security.h"
/* the mapping function for generic rights for DS.(GA,GR,GW,GX)
* The mapping function is passed as an argument to the
* descriptor calculating routine and depends on the security
* manager that calls the calculating routine.
* TODO: need similar mappings for the file system and
* registry security managers in order to make this code
* generic for all security managers
*/
uint32_t map_generic_rights_ds(uint32_t access_mask)
{
if (access_mask & SEC_GENERIC_ALL){
access_mask |= SEC_ADS_GENERIC_ALL;
access_mask = ~SEC_GENERIC_ALL;
}
if (access_mask & SEC_GENERIC_EXECUTE){
access_mask |= SEC_ADS_GENERIC_EXECUTE;
access_mask = ~SEC_GENERIC_EXECUTE;
}
if (access_mask & SEC_GENERIC_WRITE){
access_mask |= SEC_ADS_GENERIC_WRITE;
access_mask &= ~SEC_GENERIC_WRITE;
}
if (access_mask & SEC_GENERIC_READ){
access_mask |= SEC_ADS_GENERIC_READ;
access_mask &= ~SEC_GENERIC_READ;
}
return access_mask;
}
struct security_descriptor *create_security_descriptor(TALLOC_CTX *mem_ctx,
struct security_descriptor *parent_sd,
struct security_descriptor *creator_sd,
bool is_container,
struct GUID *object_list,
uint32_t inherit_flags,
struct security_token *token,
struct dom_sid *default_owner, /* valid only for DS, NULL for the other RSs */
struct dom_sid *default_group, /* valid only for DS, NULL for the other RSs */
uint32_t (*generic_map)(uint32_t access_mask))
{
struct security_descriptor *new_sd;
struct dom_sid *new_owner = NULL;
struct dom_sid *new_group = NULL;
new_sd = security_descriptor_initialise(mem_ctx);
if (!new_sd)
return NULL;
if (!creator_sd || !creator_sd->owner_sid){
if (inherit_flags & SEC_OWNER_FROM_PARENT)
new_owner = parent_sd->owner_sid;
else if (!default_owner)
new_owner = token->user_sid;
else
new_owner = default_owner;
}
else
new_owner = creator_sd->owner_sid;
if (!creator_sd || !creator_sd->group_sid){
if (inherit_flags & SEC_GROUP_FROM_PARENT && parent_sd)
new_group = parent_sd->group_sid;
else if (!default_group)
new_group = token->group_sid;
else new_group = default_group;
}
else
new_group = creator_sd->group_sid;
new_sd->owner_sid = talloc_memdup(new_sd, new_owner, sizeof(struct dom_sid));
new_sd->group_sid = talloc_memdup(new_sd, new_group, sizeof(struct dom_sid));
if (!new_sd->owner_sid || !new_sd->group_sid){
talloc_free(new_sd);
return NULL;
}
/* Todo remove */
if (creator_sd && creator_sd->type & SEC_DESC_DACL_PRESENT){
new_sd->dacl = security_acl_dup(new_sd, creator_sd->dacl);
new_sd->type |= SEC_DESC_DACL_PRESENT;
}
return new_sd;
}
|
