Line data Source code
1 : /*
2 : Copyright (C) Nadezhda Ivanova 2009
3 :
4 : This program is free software; you can redistribute it and/or modify
5 : it under the terms of the GNU General Public License as published by
6 : the Free Software Foundation; either version 3 of the License, or
7 : (at your option) any later version.
8 :
9 : This program is distributed in the hope that it will be useful,
10 : but WITHOUT ANY WARRANTY; without even the implied warranty of
11 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 : GNU General Public License for more details.
13 :
14 : You should have received a copy of the GNU General Public License
15 : along with this program. If not, see <http://www.gnu.org/licenses/>.
16 : */
17 :
18 : /*
19 : * Name: create_descriptor
20 : *
21 : * Component: routines for calculating and creating security descriptors
22 : * as described in MS-DTYP 2.5.3.x
23 : *
24 : * Description:
25 : *
26 : *
27 : * Author: Nadezhda Ivanova
28 : */
29 : #include "replace.h"
30 : #include "lib/util/debug.h"
31 : #include "libcli/security/security.h"
32 : #include "librpc/gen_ndr/ndr_security.h"
33 :
34 : /* Todos:
35 : * build the security token dacl as follows:
36 : * SYSTEM: GA, OWNER: GA, LOGIN_SID:GW|GE
37 : * Need session id information for the login SID. Probably
38 : * the best place for this is during token creation
39 : *
40 : * Implement SD Invariants
41 : * ACE sorting rules
42 : * LDAP_SERVER_SD_FLAGS_OID control
43 : * ADTS 7.1.3.3 needs to be clarified
44 : */
45 :
46 : /* the mapping function for generic rights for DS.(GA,GR,GW,GX)
47 : * The mapping function is passed as an argument to the
48 : * descriptor calculating routine and depends on the security
49 : * manager that calls the calculating routine.
50 : * TODO: need similar mappings for the file system and
51 : * registry security managers in order to make this code
52 : * generic for all security managers
53 : */
54 :
55 105311 : uint32_t map_generic_rights_ds(uint32_t access_mask)
56 : {
57 105311 : if (access_mask & SEC_GENERIC_ALL) {
58 769 : access_mask |= SEC_ADS_GENERIC_ALL;
59 769 : access_mask &= ~SEC_GENERIC_ALL;
60 : }
61 :
62 105311 : if (access_mask & SEC_GENERIC_EXECUTE) {
63 0 : access_mask |= SEC_ADS_GENERIC_EXECUTE;
64 0 : access_mask &= ~SEC_GENERIC_EXECUTE;
65 : }
66 :
67 105311 : if (access_mask & SEC_GENERIC_WRITE) {
68 0 : access_mask |= SEC_ADS_GENERIC_WRITE;
69 0 : access_mask &= ~SEC_GENERIC_WRITE;
70 : }
71 :
72 105311 : if (access_mask & SEC_GENERIC_READ) {
73 0 : access_mask |= SEC_ADS_GENERIC_READ;
74 0 : access_mask &= ~SEC_GENERIC_READ;
75 : }
76 :
77 105311 : return access_mask;
78 : }
79 :
80 : /* Not sure what this has to be,
81 : * and it does not seem to have any influence */
82 7027808 : static bool object_in_list(const struct GUID *object_list, const struct GUID *object)
83 : {
84 433469 : size_t i;
85 :
86 7027808 : if (object_list == NULL) {
87 0 : return true;
88 : }
89 :
90 7027808 : if (GUID_all_zero(object)) {
91 0 : return true;
92 : }
93 :
94 11935386 : for (i=0; ; i++) {
95 13336249 : if (GUID_all_zero(&object_list[i])) {
96 5887272 : return false;
97 : }
98 7027808 : if (!GUID_equal(&object_list[i], object)) {
99 6308441 : continue;
100 : }
101 :
102 707067 : return true;
103 : }
104 :
105 : return false;
106 : }
107 :
108 : /* returns true if the ACE gontains generic information
109 : * that needs to be processed additionally */
110 :
111 14727517 : static bool desc_ace_has_generic(const struct security_ace *ace)
112 : {
113 14727517 : if (ace->access_mask & SEC_GENERIC_ALL || ace->access_mask & SEC_GENERIC_READ ||
114 14726802 : ace->access_mask & SEC_GENERIC_WRITE || ace->access_mask & SEC_GENERIC_EXECUTE) {
115 628 : return true;
116 : }
117 29349143 : if (dom_sid_equal(&ace->trustee, &global_sid_Creator_Owner) ||
118 14622341 : dom_sid_equal(&ace->trustee, &global_sid_Creator_Group)) {
119 104461 : return true;
120 : }
121 13497449 : return false;
122 : }
123 :
124 : /* creates an ace in which the generic information is expanded */
125 :
126 105311 : static void desc_expand_generic(struct security_ace *new_ace,
127 : struct dom_sid *owner,
128 : struct dom_sid *group)
129 : {
130 105311 : new_ace->access_mask = map_generic_rights_ds(new_ace->access_mask);
131 105311 : if (dom_sid_equal(&new_ace->trustee, &global_sid_Creator_Owner)) {
132 104461 : new_ace->trustee = *owner;
133 : }
134 105311 : if (dom_sid_equal(&new_ace->trustee, &global_sid_Creator_Group)) {
135 0 : new_ace->trustee = *group;
136 : }
137 105311 : new_ace->flags = 0x0;
138 105311 : }
139 :
140 4318029 : static struct security_acl *calculate_inherited_from_parent(TALLOC_CTX *mem_ctx,
141 : struct security_acl *acl,
142 : bool is_container,
143 : struct dom_sid *owner,
144 : struct dom_sid *group,
145 : struct GUID *object_list)
146 : {
147 414742 : uint32_t i;
148 4318029 : struct security_acl *tmp_acl = NULL;
149 :
150 4318029 : if (!acl) {
151 637439 : return NULL;
152 : }
153 3573273 : tmp_acl = talloc_zero(mem_ctx, struct security_acl);
154 3573273 : if (!tmp_acl) {
155 0 : return NULL;
156 : }
157 :
158 44208708 : for (i=0; i < acl->num_aces; i++) {
159 40635435 : const struct security_ace *ace = &acl->aces[i];
160 40635435 : const struct GUID *inherited_object = NULL;
161 40635435 : const struct GUID *inherited_property = NULL;
162 40635435 : struct security_ace *tmp_ace = NULL;
163 40635435 : bool applies = false;
164 40635435 : bool inherited_only = false;
165 40635435 : bool expand_ace = false;
166 40635435 : bool expand_only = false;
167 :
168 40635435 : if (is_container && (ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
169 14122774 : applies = true;
170 25400728 : } else if (!is_container && (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
171 0 : applies = true;
172 : }
173 :
174 37532631 : if (!applies) {
175 : /*
176 : * If the ace doesn't apply to the
177 : * current node, we should only keep
178 : * it as SEC_ACE_FLAG_OBJECT_INHERIT
179 : * on a container. We'll add
180 : * SEC_ACE_FLAG_INHERITED_ACE
181 : * and SEC_ACE_FLAG_INHERIT_ONLY below.
182 : *
183 : * Otherwise we should completely ignore it.
184 : */
185 25400728 : if (!(ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
186 25400596 : continue;
187 : }
188 : }
189 :
190 15234839 : switch (ace->type) {
191 6357028 : case SEC_ACE_TYPE_ACCESS_ALLOWED:
192 : case SEC_ACE_TYPE_ACCESS_DENIED:
193 : case SEC_ACE_TYPE_SYSTEM_AUDIT:
194 : case SEC_ACE_TYPE_SYSTEM_ALARM:
195 : case SEC_ACE_TYPE_ALLOWED_COMPOUND:
196 6357028 : break;
197 :
198 8272348 : case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
199 : case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
200 : case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
201 : case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
202 : case SEC_ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT:
203 : case SEC_ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT:
204 : case SEC_ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT:
205 8272348 : if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
206 7274689 : inherited_property = &ace->object.object.type.type;
207 : }
208 8272348 : if (ace->object.object.flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT) {
209 7027808 : inherited_object = &ace->object.object.inherited_type.inherited_type;
210 : }
211 :
212 8199347 : if (inherited_object != NULL && !object_in_list(object_list, inherited_object)) {
213 : /*
214 : * An explicit object class schemaId is given,
215 : * but doesn't belong to the current object.
216 : */
217 6308441 : applies = false;
218 : }
219 :
220 7765878 : break;
221 :
222 0 : case SEC_ACE_TYPE_ACCESS_DENIED_CALLBACK:
223 : case SEC_ACE_TYPE_ACCESS_ALLOWED_CALLBACK:
224 : case SEC_ACE_TYPE_SYSTEM_AUDIT_CALLBACK:
225 0 : break;
226 0 : case SEC_ACE_TYPE_SYSTEM_RESOURCE_ATTRIBUTE:
227 0 : break;
228 0 : case SEC_ACE_TYPE_SYSTEM_ALARM_CALLBACK:
229 : case SEC_ACE_TYPE_SYSTEM_ALARM_CALLBACK_OBJECT:
230 : case SEC_ACE_TYPE_SYSTEM_MANDATORY_LABEL:
231 : case SEC_ACE_TYPE_SYSTEM_SCOPED_POLICY_ID:
232 : default:
233 0 : DBG_WARNING("ACE type %d is not handled\n", ace->type);
234 0 : TALLOC_FREE(tmp_acl);
235 0 : return NULL;
236 : }
237 :
238 15234839 : if (ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
239 294 : if (!applies) {
240 : /*
241 : * If the ACE doesn't apply to
242 : * the current object, we should
243 : * ignore it as it should not be
244 : * inherited any further
245 : */
246 159 : continue;
247 : }
248 : /*
249 : * We should only keep the expanded version
250 : * of the ACE on the current object.
251 : */
252 135 : expand_ace = true;
253 135 : expand_only = true;
254 15234545 : } else if (applies) {
255 : /*
256 : * We check if should also add
257 : * the expanded version of the ACE
258 : * in addition, in case we should
259 : * expand generic access bits or
260 : * special sids.
261 : *
262 : * In that case we need to
263 : * keep the original ACE with
264 : * SEC_ACE_FLAG_INHERIT_ONLY.
265 : */
266 8926131 : expand_ace = desc_ace_has_generic(ace);
267 8926131 : if (expand_ace) {
268 14383 : inherited_only = true;
269 : }
270 : } else {
271 : /*
272 : * If the ACE doesn't apply
273 : * to the current object,
274 : * we need to keep it with
275 : * SEC_ACE_FLAG_INHERIT_ONLY
276 : * in order to apply them to
277 : * grandchildren
278 : */
279 5887245 : inherited_only = true;
280 : }
281 :
282 15234680 : if (expand_ace) {
283 14518 : tmp_acl->aces = talloc_realloc(tmp_acl,
284 : tmp_acl->aces,
285 : struct security_ace,
286 : tmp_acl->num_aces+1);
287 14518 : if (tmp_acl->aces == NULL) {
288 0 : TALLOC_FREE(tmp_acl);
289 0 : return NULL;
290 : }
291 :
292 14518 : tmp_ace = &tmp_acl->aces[tmp_acl->num_aces];
293 14518 : tmp_acl->num_aces++;
294 :
295 14518 : *tmp_ace = *ace;
296 :
297 : /*
298 : * Expand generic access bits as well as special
299 : * sids.
300 : */
301 14518 : desc_expand_generic(tmp_ace, owner, group);
302 :
303 : /*
304 : * Expanded ACEs are marked as inherited,
305 : * but never inherited any further to
306 : * grandchildren.
307 : */
308 14518 : tmp_ace->flags |= SEC_ACE_FLAG_INHERITED_ACE;
309 14518 : tmp_ace->flags &= ~SEC_ACE_FLAG_CONTAINER_INHERIT;
310 14518 : tmp_ace->flags &= ~SEC_ACE_FLAG_OBJECT_INHERIT;
311 14518 : tmp_ace->flags &= ~SEC_ACE_FLAG_NO_PROPAGATE_INHERIT;
312 :
313 : /*
314 : * Expanded ACEs never have an explicit
315 : * object class schemaId, so clear it
316 : * if present.
317 : */
318 14518 : if (inherited_object != NULL) {
319 10460 : tmp_ace->object.object.flags &= ~SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT;
320 : }
321 :
322 : /*
323 : * If the ACE had an explicit object class
324 : * schemaId, but no attribute/propertySet
325 : * we need to downgrade the _OBJECT variants
326 : * to the normal ones.
327 : */
328 14518 : if (inherited_property == NULL) {
329 4076 : switch (tmp_ace->type) {
330 3711 : case SEC_ACE_TYPE_ACCESS_ALLOWED:
331 : case SEC_ACE_TYPE_ACCESS_DENIED:
332 : case SEC_ACE_TYPE_SYSTEM_AUDIT:
333 : case SEC_ACE_TYPE_SYSTEM_ALARM:
334 : case SEC_ACE_TYPE_ALLOWED_COMPOUND:
335 3711 : break;
336 81 : case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
337 81 : tmp_ace->type = SEC_ACE_TYPE_ACCESS_ALLOWED;
338 81 : break;
339 0 : case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
340 0 : tmp_ace->type = SEC_ACE_TYPE_ACCESS_DENIED;
341 0 : break;
342 0 : case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
343 0 : tmp_ace->type = SEC_ACE_TYPE_SYSTEM_ALARM;
344 0 : break;
345 0 : case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
346 0 : tmp_ace->type = SEC_ACE_TYPE_SYSTEM_AUDIT;
347 0 : break;
348 0 : case SEC_ACE_TYPE_ACCESS_ALLOWED_CALLBACK_OBJECT:
349 0 : tmp_ace->type = SEC_ACE_TYPE_ACCESS_ALLOWED_CALLBACK;
350 0 : break;
351 0 : case SEC_ACE_TYPE_ACCESS_DENIED_CALLBACK_OBJECT:
352 0 : tmp_ace->type = SEC_ACE_TYPE_ACCESS_DENIED_CALLBACK;
353 0 : break;
354 0 : case SEC_ACE_TYPE_SYSTEM_AUDIT_CALLBACK_OBJECT:
355 0 : tmp_ace->type = SEC_ACE_TYPE_SYSTEM_AUDIT_CALLBACK;
356 0 : break;
357 0 : default:
358 : /*
359 : * SEC_ACE_TYPE_SYSTEM_ALARM_CALLBACK_OBJECT
360 : * is reserved.
361 : */
362 0 : break;
363 : }
364 : }
365 :
366 14518 : if (expand_only) {
367 135 : continue;
368 : }
369 : }
370 :
371 15234545 : tmp_acl->aces = talloc_realloc(tmp_acl,
372 : tmp_acl->aces,
373 : struct security_ace,
374 : tmp_acl->num_aces+1);
375 15234545 : if (tmp_acl->aces == NULL) {
376 0 : TALLOC_FREE(tmp_acl);
377 0 : return NULL;
378 : }
379 :
380 15234545 : tmp_ace = &tmp_acl->aces[tmp_acl->num_aces];
381 15234545 : tmp_acl->num_aces++;
382 :
383 15234545 : *tmp_ace = *ace;
384 15234545 : tmp_ace->flags |= SEC_ACE_FLAG_INHERITED_ACE;
385 :
386 15234545 : if (inherited_only) {
387 6322797 : tmp_ace->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
388 : } else {
389 8911748 : tmp_ace->flags &= ~SEC_ACE_FLAG_INHERIT_ONLY;
390 : }
391 :
392 15234545 : if (ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
393 0 : tmp_ace->flags &= ~SEC_ACE_FLAG_CONTAINER_INHERIT;
394 0 : tmp_ace->flags &= ~SEC_ACE_FLAG_OBJECT_INHERIT;
395 0 : tmp_ace->flags &= ~SEC_ACE_FLAG_NO_PROPAGATE_INHERIT;
396 : }
397 : }
398 3573273 : if (tmp_acl->num_aces == 0) {
399 28283 : TALLOC_FREE(tmp_acl);
400 28283 : return NULL;
401 : }
402 3544990 : if (acl) {
403 3544990 : tmp_acl->revision = acl->revision;
404 : }
405 3544990 : return tmp_acl;
406 : }
407 :
408 4358458 : static struct security_acl *process_user_acl(TALLOC_CTX *mem_ctx,
409 : struct security_acl *acl,
410 : bool is_container,
411 : struct dom_sid *owner,
412 : struct dom_sid *group,
413 : struct GUID *object_list,
414 : bool is_protected)
415 : {
416 415518 : uint32_t i;
417 4358458 : TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
418 4358458 : struct security_acl *tmp_acl = talloc_zero(tmp_ctx, struct security_acl);
419 415518 : struct security_acl *new_acl;
420 :
421 4358458 : if (!acl)
422 860104 : return NULL;
423 :
424 3376728 : if (!tmp_acl)
425 0 : return NULL;
426 :
427 3376728 : tmp_acl->revision = acl->revision;
428 3376728 : DBG_DEBUG("acl revision %d\n", acl->revision);
429 :
430 16180430 : for (i=0; i < acl->num_aces; i++){
431 12803702 : struct security_ace *ace = &acl->aces[i];
432 : /* Remove ID flags from user-provided ACEs
433 : * if we break inheritance, ignore them otherwise */
434 12803702 : if (ace->flags & SEC_ACE_FLAG_INHERITED_ACE) {
435 6962973 : if (is_protected) {
436 9 : ace->flags &= ~SEC_ACE_FLAG_INHERITED_ACE;
437 : } else {
438 6962964 : continue;
439 : }
440 : }
441 :
442 5840738 : if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY &&
443 34324 : !(ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT ||
444 76 : ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT))
445 106 : continue;
446 :
447 5840632 : tmp_acl->aces = talloc_realloc(tmp_acl,
448 : tmp_acl->aces,
449 : struct security_ace,
450 : tmp_acl->num_aces+1);
451 5840632 : tmp_acl->aces[tmp_acl->num_aces] = *ace;
452 5840632 : tmp_acl->num_aces++;
453 5840632 : if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
454 39246 : continue;
455 : }
456 : /* if the ACE contains CO, CG, GA, GE, GR or GW, and is inheritable
457 : * it has to be expanded to two aces, the original as IO,
458 : * and another one where these are translated */
459 5801386 : if (desc_ace_has_generic(ace)) {
460 90793 : if (!(ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
461 89646 : desc_expand_generic(&tmp_acl->aces[tmp_acl->num_aces-1],
462 : owner,
463 : group);
464 : } else {
465 : /*The original ACE becomes read only */
466 1147 : tmp_acl->aces[tmp_acl->num_aces-1].flags |= SEC_ACE_FLAG_INHERIT_ONLY;
467 1147 : tmp_acl->aces = talloc_realloc(tmp_acl, tmp_acl->aces,
468 : struct security_ace,
469 : tmp_acl->num_aces+1);
470 : /* add a new ACE with expanded generic info */
471 1147 : tmp_acl->aces[tmp_acl->num_aces] = *ace;
472 1147 : desc_expand_generic(&tmp_acl->aces[tmp_acl->num_aces],
473 : owner,
474 : group);
475 1147 : tmp_acl->num_aces++;
476 : }
477 : }
478 : }
479 3376728 : new_acl = security_acl_dup(mem_ctx,tmp_acl);
480 :
481 3376728 : if (new_acl)
482 3376728 : new_acl->revision = acl->revision;
483 :
484 3376728 : talloc_free(tmp_ctx);
485 3376728 : return new_acl;
486 : }
487 :
488 6538389 : static void cr_descr_log_descriptor(struct security_descriptor *sd,
489 : const char *message,
490 : int level)
491 : {
492 6538389 : if (sd) {
493 6535955 : DEBUG(level,("%s: %s\n", message,
494 : ndr_print_struct_string(0,(ndr_print_fn_t)ndr_print_security_descriptor,
495 : "", sd)));
496 : }
497 : else {
498 2434 : DEBUG(level,("%s: NULL\n", message));
499 : }
500 6538389 : }
501 :
502 : #if 0
503 : static void cr_descr_log_acl(struct security_acl *acl,
504 : const char *message,
505 : int level)
506 : {
507 : if (acl) {
508 : DEBUG(level,("%s: %s\n", message,
509 : ndr_print_struct_string(0,(ndr_print_fn_t)ndr_print_security_acl,
510 : "", acl)));
511 : }
512 : else {
513 : DEBUG(level,("%s: NULL\n", message));
514 : }
515 : }
516 : #endif
517 :
518 2179463 : static bool compute_acl(struct security_descriptor *parent_sd,
519 : struct security_descriptor *creator_sd,
520 : bool is_container,
521 : uint32_t inherit_flags,
522 : struct GUID *object_list,
523 : uint32_t (*generic_map)(uint32_t access_mask),
524 : struct security_token *token,
525 : struct security_descriptor *new_sd) /* INOUT argument */
526 : {
527 207781 : struct security_acl *user_dacl, *user_sacl, *inherited_dacl, *inherited_sacl;
528 2179463 : int level = 10;
529 :
530 2179463 : if (!parent_sd || !(inherit_flags & SEC_DACL_AUTO_INHERIT)) {
531 1926 : inherited_dacl = NULL;
532 2177263 : } else if (creator_sd && (creator_sd->type & SEC_DESC_DACL_PROTECTED)) {
533 21195 : inherited_dacl = NULL;
534 : } else {
535 2155818 : inherited_dacl = calculate_inherited_from_parent(new_sd,
536 : parent_sd->dacl,
537 : is_container,
538 : new_sd->owner_sid,
539 : new_sd->group_sid,
540 : object_list);
541 : }
542 :
543 :
544 2179463 : if (!parent_sd || !(inherit_flags & SEC_SACL_AUTO_INHERIT)) {
545 1926 : inherited_sacl = NULL;
546 2177263 : } else if (creator_sd && (creator_sd->type & SEC_DESC_SACL_PROTECTED)) {
547 15030 : inherited_sacl = NULL;
548 : } else {
549 2162211 : inherited_sacl = calculate_inherited_from_parent(new_sd,
550 : parent_sd->sacl,
551 : is_container,
552 : new_sd->owner_sid,
553 : new_sd->group_sid,
554 : object_list);
555 : }
556 :
557 2179463 : if (!creator_sd || (inherit_flags & SEC_DEFAULT_DESCRIPTOR)) {
558 212 : user_dacl = NULL;
559 212 : user_sacl = NULL;
560 : } else {
561 2386988 : user_dacl = process_user_acl(new_sd,
562 : creator_sd->dacl,
563 : is_container,
564 : new_sd->owner_sid,
565 : new_sd->group_sid,
566 : object_list,
567 2179229 : creator_sd->type & SEC_DESC_DACL_PROTECTED);
568 2179229 : user_sacl = process_user_acl(new_sd,
569 : creator_sd->sacl,
570 : is_container,
571 : new_sd->owner_sid,
572 : new_sd->group_sid,
573 : object_list,
574 2179229 : creator_sd->type & SEC_DESC_SACL_PROTECTED);
575 : }
576 2179463 : cr_descr_log_descriptor(parent_sd, __location__"parent_sd", level);
577 2179463 : cr_descr_log_descriptor(creator_sd,__location__ "creator_sd", level);
578 :
579 2179463 : new_sd->dacl = security_acl_concatenate(new_sd, user_dacl, inherited_dacl);
580 2179463 : if (new_sd->dacl) {
581 2179208 : new_sd->type |= SEC_DESC_DACL_PRESENT;
582 : }
583 2179463 : if (inherited_dacl) {
584 2132351 : new_sd->type |= SEC_DESC_DACL_AUTO_INHERITED;
585 : }
586 :
587 2179463 : new_sd->sacl = security_acl_concatenate(new_sd, user_sacl, inherited_sacl);
588 2179463 : if (new_sd->sacl) {
589 1415335 : new_sd->type |= SEC_DESC_SACL_PRESENT;
590 : }
591 2179463 : if (inherited_sacl) {
592 1412639 : new_sd->type |= SEC_DESC_SACL_AUTO_INHERITED;
593 : }
594 : /* This is a hack to handle the fact that
595 : * apprantly any AI flag provided by the user is preserved */
596 2179463 : if (creator_sd)
597 2179229 : new_sd->type |= creator_sd->type;
598 2179463 : cr_descr_log_descriptor(new_sd, __location__"final sd", level);
599 2179463 : return true;
600 : }
601 :
602 2179463 : struct security_descriptor *create_security_descriptor(TALLOC_CTX *mem_ctx,
603 : struct security_descriptor *parent_sd,
604 : struct security_descriptor *creator_sd,
605 : bool is_container,
606 : struct GUID *object_list,
607 : uint32_t inherit_flags,
608 : struct security_token *token,
609 : struct dom_sid *default_owner, /* valid only for DS, NULL for the other RSs */
610 : struct dom_sid *default_group, /* valid only for DS, NULL for the other RSs */
611 : uint32_t (*generic_map)(uint32_t access_mask))
612 : {
613 207781 : struct security_descriptor *new_sd;
614 2179463 : struct dom_sid *new_owner = NULL;
615 2179463 : struct dom_sid *new_group = NULL;
616 :
617 2179463 : new_sd = security_descriptor_initialise(mem_ctx);
618 2179463 : if (!new_sd) {
619 0 : return NULL;
620 : }
621 :
622 2179463 : if (!creator_sd || !creator_sd->owner_sid) {
623 1089860 : if ((inherit_flags & SEC_OWNER_FROM_PARENT) && parent_sd) {
624 0 : new_owner = parent_sd->owner_sid;
625 1089860 : } else if (!default_owner) {
626 19912 : new_owner = &token->sids[PRIMARY_USER_SID_INDEX];
627 : } else {
628 1069948 : new_owner = default_owner;
629 1069948 : new_sd->type |= SEC_DESC_OWNER_DEFAULTED;
630 : }
631 : } else {
632 1048722 : new_owner = creator_sd->owner_sid;
633 : }
634 :
635 2179463 : if (!creator_sd || !creator_sd->group_sid){
636 1090451 : if ((inherit_flags & SEC_GROUP_FROM_PARENT) && parent_sd) {
637 0 : new_group = parent_sd->group_sid;
638 1090451 : } else if (!default_group && token->num_sids > PRIMARY_GROUP_SID_INDEX) {
639 18569 : new_group = &token->sids[PRIMARY_GROUP_SID_INDEX];
640 1071882 : } else if (!default_group) {
641 : /* This will happen only for anonymous, which has no other groups */
642 1361 : new_group = &token->sids[PRIMARY_USER_SID_INDEX];
643 : } else {
644 1070521 : new_group = default_group;
645 1070521 : new_sd->type |= SEC_DESC_GROUP_DEFAULTED;
646 : }
647 : } else {
648 1048153 : new_group = creator_sd->group_sid;
649 : }
650 :
651 2179463 : new_sd->owner_sid = talloc_memdup(new_sd, new_owner, sizeof(struct dom_sid));
652 2179463 : new_sd->group_sid = talloc_memdup(new_sd, new_group, sizeof(struct dom_sid));
653 2179463 : if (!new_sd->owner_sid || !new_sd->group_sid){
654 0 : talloc_free(new_sd);
655 0 : return NULL;
656 : }
657 :
658 2179463 : if (!compute_acl(parent_sd, creator_sd,
659 : is_container, inherit_flags, object_list,
660 : generic_map,token,new_sd)){
661 0 : talloc_free(new_sd);
662 0 : return NULL;
663 : }
664 :
665 1971682 : return new_sd;
666 : }
|
