diff options
Diffstat (limited to 'source/libgpo')
| -rw-r--r-- | source/libgpo/gpo_sec.c | 152 |
1 files changed, 151 insertions, 1 deletions
diff --git a/source/libgpo/gpo_sec.c b/source/libgpo/gpo_sec.c index 20366a9d204..fc7c5d24570 100644 --- a/source/libgpo/gpo_sec.c +++ b/source/libgpo/gpo_sec.c @@ -20,11 +20,161 @@ #include "includes.h" + /* When modifiying security filtering with gpmc.msc (on w2k3) the + * following ACE is created in the DACL: + +------- ACE (type: 0x05, flags: 0x02, size: 0x38, mask: 0x100, object flags: 0x1) +access SID: $SID +access type: ALLOWED OBJECT +Permissions: + [Apply Group Policy] (0x00000100) + +------- ACE (type: 0x00, flags: 0x02, size: 0x24, mask: 0x20014) +access SID: $SID +access type: ALLOWED +Permissions: + [List Contents] (0x00000004) + [Read All Properties] (0x00000010) + [Read Permissions] (0x00020000) + + * by default all "Authenticated Users" (S-1-5-11) have an ALLOW + * OBJECT ace with SEC_RIGHTS_APPLY_GROUP_POLICY mask */ + + +/**************************************************************** +****************************************************************/ + +static BOOL gpo_sd_check_agp_access_bits(uint32 access_mask) +{ + return (access_mask & SEC_RIGHTS_APPLY_GROUP_POLICY); +} + +/**************************************************************** +****************************************************************/ + +static BOOL gpo_sd_check_read_access_bits(uint32 access_mask) +{ + uint32 read_bits = SEC_RIGHTS_LIST_CONTENTS | + SEC_RIGHTS_READ_ALL_PROP | + SEC_RIGHTS_READ_PERMS; + + return (read_bits == (access_mask & read_bits)); +} + + +/**************************************************************** +****************************************************************/ + +static BOOL gpo_sd_check_trustee_in_sid_token(const DOM_SID *trustee, + const struct GPO_SID_TOKEN *token) +{ + int i; + + if (sid_equal(trustee, &token->object_sid)) { + return True; + } + + if (sid_equal(trustee, &token->primary_group_sid)) { + return True; + } + + for (i = 0; i < token->num_token_sids; i++) { + if (sid_equal(trustee, &token->token_sids[i])) { + return True; + } + } + + return False; +} + +/**************************************************************** +****************************************************************/ + +static NTSTATUS gpo_sd_check_ace_denied_object(const SEC_ACE *ace, + const struct GPO_SID_TOKEN *token) +{ + if (gpo_sd_check_agp_access_bits(ace->access_mask) && + gpo_sd_check_trustee_in_sid_token(&ace->trustee, token)) { + DEBUG(10,("gpo_sd_check_ace_denied_object: Access denied as of ace for %s\n", + sid_string_static(&ace->trustee))); + return NT_STATUS_ACCESS_DENIED; + } + + return STATUS_MORE_ENTRIES; +} + +/**************************************************************** +****************************************************************/ + +static NTSTATUS gpo_sd_check_ace_allowed_object(const SEC_ACE *ace, + const struct GPO_SID_TOKEN *token) +{ + if (gpo_sd_check_agp_access_bits(ace->access_mask) && + gpo_sd_check_trustee_in_sid_token(&ace->trustee, token)) { + DEBUG(10,("gpo_sd_check_ace_allowed_object: Access granted as of ace for %s\n", + sid_string_static(&ace->trustee))); + return NT_STATUS_OK; + } + + return STATUS_MORE_ENTRIES; +} + +/**************************************************************** +****************************************************************/ + +static NTSTATUS gpo_sd_check_ace(const SEC_ACE *ace, + const struct GPO_SID_TOKEN *token) +{ + switch (ace->type) { + case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: + return gpo_sd_check_ace_denied_object(ace, token); + case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT: + return gpo_sd_check_ace_allowed_object(ace, token); + default: + return STATUS_MORE_ENTRIES; + } +} + /**************************************************************** ****************************************************************/ NTSTATUS gpo_apply_security_filtering(const struct GROUP_POLICY_OBJECT *gpo, const struct GPO_SID_TOKEN *token) { - return NT_STATUS_OK; + SEC_DESC *sd = gpo->security_descriptor; + SEC_ACL *dacl = NULL; + NTSTATUS status = NT_STATUS_ACCESS_DENIED; + int i; + + if (!token) { + return NT_STATUS_INVALID_USER_BUFFER; + } + + if (!sd) { + return NT_STATUS_INVALID_SECURITY_DESCR; + } + + dacl = sd->dacl; + if (!dacl) { + return NT_STATUS_INVALID_SECURITY_DESCR; + } + + /* check all aces and only return NT_STATUS_OK (== Access granted) or + * NT_STATUS_ACCESS_DENIED ( == Access denied) - the default is to + * deny access */ + + for (i = 0; i < dacl->num_aces; i ++) { + + status = gpo_sd_check_ace(&dacl->aces[i], token); + + if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) { + return status; + } else if (NT_STATUS_IS_OK(status)) { + return status; + } + + continue; + } + + return NT_STATUS_ACCESS_DENIED; } |