source: branches/samba-3.2.x/source/lib/privileges.c@ 536

Last change on this file since 536 was 133, checked in by Paul Smedley, 18 years ago

Update trunk to 3.2.0pre3
File size: 11.8 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Privileges handling functions
4 Copyright (C) Jean François Micouleau 1998-2001
5 Copyright (C) Simo Sorce 2002-2003
6 Copyright (C) Gerald (Jerry) Carter 2005
7 Copyright (C) Michael Adam 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23
24#include "includes.h"
25
26#define PRIVPREFIX "PRIV_"
27
28typedef struct {
29 size_t count;
30 DOM_SID *list;
31} SID_LIST;
32
33typedef struct {
34 TALLOC_CTX *mem_ctx;
35 SE_PRIV privilege;
36 SID_LIST sids;
37} PRIV_SID_LIST;
38
39
40static bool get_privileges( const DOM_SID *sid, SE_PRIV *mask )
41{
42 struct db_context *db = get_account_pol_db();
43 fstring tmp, keystr;
44 TDB_DATA data;
45
46 /* Fail if the admin has not enable privileges */
47
48 if ( !lp_enable_privileges() ) {
49 return False;
50 }
51
52 if ( db == NULL )
53 return False;
54
55 /* PRIV_<SID> (NULL terminated) as the key */
56
57 fstr_sprintf(keystr, "%s%s", PRIVPREFIX, sid_to_fstring(tmp, sid));
58
59 data = dbwrap_fetch_bystring( db, talloc_tos(), keystr );
60
61 if ( !data.dptr ) {
62 DEBUG(3, ("get_privileges: No privileges assigned to SID "
63 "[%s]\n", sid_string_dbg(sid)));
64 return False;
65 }
66
67 SMB_ASSERT( data.dsize == sizeof( SE_PRIV ) );
68
69 se_priv_copy( mask, (SE_PRIV*)data.dptr );
70 TALLOC_FREE(data.dptr);
71
72 return True;
73}
74
75/***************************************************************************
76 Store the privilege mask (set) for a given SID
77****************************************************************************/
78
79static bool set_privileges( const DOM_SID *sid, SE_PRIV *mask )
80{
81 struct db_context *db = get_account_pol_db();
82 fstring tmp, keystr;
83 TDB_DATA data;
84
85 if ( !lp_enable_privileges() )
86 return False;
87
88 if ( db == NULL )
89 return False;
90
91 if ( !sid || (sid->num_auths == 0) ) {
92 DEBUG(0,("set_privileges: Refusing to store empty SID!\n"));
93 return False;
94 }
95
96 /* PRIV_<SID> (NULL terminated) as the key */
97
98 fstr_sprintf(keystr, "%s%s", PRIVPREFIX, sid_to_fstring(tmp, sid));
99
100 /* no packing. static size structure, just write it out */
101
102 data.dptr = (uint8 *)mask;
103 data.dsize = sizeof(SE_PRIV);
104
105 return NT_STATUS_IS_OK(dbwrap_store_bystring(db, keystr, data,
106 TDB_REPLACE));
107}
108
109/*********************************************************************
110 get a list of all privileges for all sids in the list
111*********************************************************************/
112
113bool get_privileges_for_sids(SE_PRIV *privileges, DOM_SID *slist, int scount)
114{
115 SE_PRIV mask;
116 int i;
117 bool found = False;
118
119 se_priv_copy( privileges, &se_priv_none );
120
121 for ( i=0; i<scount; i++ ) {
122 /* don't add unless we actually have a privilege assigned */
123
124 if ( !get_privileges( &slist[i], &mask ) )
125 continue;
126
127 DEBUG(5,("get_privileges_for_sids: sid = %s\nPrivilege "
128 "set:\n", sid_string_dbg(&slist[i])));
129 dump_se_priv( DBGC_ALL, 5, &mask );
130
131 se_priv_add( privileges, &mask );
132 found = True;
133 }
134
135 return found;
136}
137
138
139/*********************************************************************
140 traversal functions for privilege_enumerate_accounts
141*********************************************************************/
142
143static int priv_traverse_fn(struct db_record *rec, void *state)
144{
145 PRIV_SID_LIST *priv = (PRIV_SID_LIST *)state;
146 int prefixlen = strlen(PRIVPREFIX);
147 DOM_SID sid;
148 fstring sid_string;
149
150 /* easy check first */
151
152 if (rec->value.dsize != sizeof(SE_PRIV) )
153 return 0;
154
155 /* check we have a PRIV_+SID entry */
156
157 if ( strncmp((char *)rec->key.dptr, PRIVPREFIX, prefixlen) != 0)
158 return 0;
159
160 /* check to see if we are looking for a particular privilege */
161
162 if ( !se_priv_equal(&priv->privilege, &se_priv_none) ) {
163 SE_PRIV mask;
164
165 se_priv_copy( &mask, (SE_PRIV*)rec->value.dptr );
166
167 /* if the SID does not have the specified privilege
168 then just return */
169
170 if ( !is_privilege_assigned( &mask, &priv->privilege) )
171 return 0;
172 }
173
174 fstrcpy( sid_string, (char *)&(rec->key.dptr[strlen(PRIVPREFIX)]) );
175
176 /* this is a last ditch safety check to preventing returning
177 and invalid SID (i've somehow run into this on development branches) */
178
179 if ( strcmp( "S-0-0", sid_string ) == 0 )
180 return 0;
181
182 if ( !string_to_sid(&sid, sid_string) ) {
183 DEBUG(0,("travsersal_fn_enum__acct: Could not convert SID [%s]\n",
184 sid_string));
185 return 0;
186 }
187
188 if (!NT_STATUS_IS_OK(add_sid_to_array(priv->mem_ctx, &sid,
189 &priv->sids.list,
190 &priv->sids.count)))
191 {
192 return 0;
193 }
194
195 return 0;
196}
197
198/*********************************************************************
199 Retreive list of privileged SIDs (for _lsa_enumerate_accounts()
200*********************************************************************/