#include "includes.h"
struct generic_mapping file_generic_mapping = {
FILE_GENERIC_READ,
FILE_GENERIC_WRITE,
FILE_GENERIC_EXECUTE,
FILE_GENERIC_ALL
};
size_t sec_desc_size(SEC_DESC *psd)
{
size_t offset;
if (!psd) return 0;
offset = SEC_DESC_HEADER_SIZE;
if (psd->owner_sid != NULL)
offset += sid_size(psd->owner_sid);
if (psd->group_sid != NULL)
offset += sid_size(psd->group_sid);
if (psd->sacl != NULL)
offset += psd->sacl->size;
if (psd->dacl != NULL)
offset += psd->dacl->size;
return offset;
}
BOOL sec_desc_equal(SEC_DESC *s1, SEC_DESC *s2)
{
if (!s1 && !s2) {
goto done;
}
if (!s1 || !s2) {
return False;
}
if (s1->revision != s2->revision) {
DEBUG(10, ("sec_desc_equal(): revision differs (%d != %d)\n",
s1->revision, s2->revision));
return False;
}
if (s1->type!= s2->type) {
DEBUG(10, ("sec_desc_equal(): type differs (%d != %d)\n",
s1->type, s2->type));
return False;
}
if (!sid_equal(s1->owner_sid, s2->owner_sid)) {
fstring str1, str2;
sid_to_string(str1, s1->owner_sid);
sid_to_string(str2, s2->owner_sid);
DEBUG(10, ("sec_desc_equal(): owner differs (%s != %s)\n",
str1, str2));
return False;
}
if (!sid_equal(s1->group_sid, s2->group_sid)) {
fstring str1, str2;
sid_to_string(str1, s1->group_sid);
sid_to_string(str2, s2->group_sid);
DEBUG(10, ("sec_desc_equal(): group differs (%s != %s)\n",
str1, str2));
return False;
}
if ((s1->dacl && !s2->dacl) || (!s1->dacl && s2->dacl) ||
(s1->sacl && !s2->sacl) || (!s1->sacl && s2->sacl)) {
DEBUG(10, ("sec_desc_equal(): dacl or sacl not present\n"));
return False;
}
if (!sec_acl_equal(s1->dacl, s2->dacl) ||
!sec_acl_equal(s1->sacl, s2->sacl)) {
DEBUG(10, ("sec_desc_equal(): dacl/sacl list not equal\n"));
return False;
}
done:
DEBUG(10, ("sec_desc_equal(): secdescs are identical\n"));
return True;
}
SEC_DESC_BUF *sec_desc_merge(TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb)
{
DOM_SID *owner_sid, *group_sid;
SEC_DESC_BUF *return_sdb;
SEC_ACL *dacl, *sacl;
SEC_DESC *psd = NULL;
uint16 secdesc_type;
size_t secdesc_size;
owner_sid = new_sdb->sec->owner_sid ? new_sdb->sec->owner_sid :
old_sdb->sec->owner_sid;
group_sid = new_sdb->sec->group_sid ? new_sdb->sec->group_sid :
old_sdb->sec->group_sid;
secdesc_type = new_sdb->sec->type;
sacl = NULL;
secdesc_type &= ~SEC_DESC_SACL_PRESENT;
if (secdesc_type & SEC_DESC_DACL_PRESENT) {
dacl = new_sdb->sec->dacl;
} else {
dacl = old_sdb->sec->dacl;
}
psd = make_sec_desc(ctx, new_sdb->sec->revision, secdesc_type,
owner_sid, group_sid, sacl, dacl, &secdesc_size);
return_sdb = make_sec_desc_buf(ctx, secdesc_size, psd);
return(return_sdb);
}
SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, uint16 type,
const DOM_SID *owner_sid, const DOM_SID *group_sid,
SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size)
{
SEC_DESC *dst;
uint32 offset = 0;
*sd_size = 0;
if(( dst = TALLOC_ZERO_P(ctx, SEC_DESC)) == NULL)
return NULL;
dst->revision = revision;
dst->type = type;
if (sacl)
dst->type |= SEC_DESC_SACL_PRESENT;
if (dacl)
dst->type |= SEC_DESC_DACL_PRESENT;
dst->off_owner_sid = 0;
dst->off_grp_sid = 0;
dst->off_sacl = 0;
dst->off_dacl = 0;
if(owner_sid && ((dst->owner_sid = sid_dup_talloc(ctx,owner_sid)) == NULL))
goto error_exit;
if(group_sid && ((dst->group_sid = sid_dup_talloc(ctx,group_sid)) == NULL))
goto error_exit;
if(sacl && ((dst->sacl = dup_sec_acl(ctx, sacl)) == NULL))
goto error_exit;
if(dacl && ((dst->dacl = dup_sec_acl(ctx, dacl)) == NULL))
goto error_exit;
offset = SEC_DESC_HEADER_SIZE;
if (dst->sacl != NULL) {
dst->off_sacl = offset;
offset += dst->sacl->size;
}
if (dst->dacl != NULL) {
dst->off_dacl = offset;
offset += dst->dacl->size;
}
if (dst->owner_sid != NULL) {
dst->off_owner_sid = offset;
offset += sid_size(dst->owner_sid);
}
if (dst->group_sid != NULL) {
dst->off_grp_sid = offset;
offset += sid_size(dst->group_sid);
}
*sd_size = (size_t)offset;
return dst;
error_exit:
*sd_size = 0;
return NULL;
}
SEC_DESC *dup_sec_desc(TALLOC_CTX *ctx, const SEC_DESC *src)
{
size_t dummy;
if(src == NULL)
return NULL;
return make_sec_desc( ctx, src->revision, src->type,
src->owner_sid, src->group_sid, src->sacl,
src->dacl, &dummy);
}
SEC_DESC *make_standard_sec_desc(TALLOC_CTX *ctx, const DOM_SID *owner_sid, const DOM_SID *group_sid,
SEC_ACL *dacl, size_t *sd_size)
{
return make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE,
owner_sid, group_sid, NULL, dacl, sd_size);
}
SEC_DESC_BUF *make_sec_desc_buf(TALLOC_CTX *ctx, size_t len, SEC_DESC *sec_desc)
{
SEC_DESC_BUF *dst;
if((dst = TALLOC_ZERO_P(ctx, SEC_DESC_BUF)) == NULL)
return NULL;
dst->max_len = (uint32)len;
dst->len = (uint32)len;
if(sec_desc && ((dst->sec = dup_sec_desc(ctx, sec_desc)) == NULL)) {
return NULL;
}
dst->ptr = 0x1;
return dst;
}
SEC_DESC_BUF *dup_sec_desc_buf(TALLOC_CTX *ctx, SEC_DESC_BUF *src)
{
if(src == NULL)
return NULL;
return make_sec_desc_buf( ctx, src->len, src->sec);
}
NTSTATUS sec_desc_add_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, uint32 mask, size_t *sd_size)
{
SEC_DESC *sd = 0;
SEC_ACL *dacl = 0;
SEC_ACE *ace = 0;
NTSTATUS status;
if (!ctx || !psd || !sid || !sd_size)
return NT_STATUS_INVALID_PARAMETER;
*sd_size = 0;
status = sec_ace_add_sid(ctx, &ace, psd[0]->dacl->aces, &psd[0]->dacl->num_aces, sid, mask);
if (!NT_STATUS_IS_OK(status))
return status;
if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace)))
return NT_STATUS_UNSUCCESSFUL;
if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid,
psd[0]->group_sid, psd[0]->sacl, dacl, sd_size)))
return NT_STATUS_UNSUCCESSFUL;
*psd = sd;
sd = 0;
return NT_STATUS_OK;
}
NTSTATUS sec_desc_mod_sid(SEC_DESC *sd, DOM_SID *sid, uint32 mask)
{
NTSTATUS status;
if (!sd || !sid)
return NT_STATUS_INVALID_PARAMETER;
status = sec_ace_mod_sid(sd->dacl->aces, sd->dacl->num_aces, sid, mask);
if (!NT_STATUS_IS_OK(status))
return status;
return NT_STATUS_OK;
}
NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, size_t *sd_size)
{
SEC_DESC *sd = 0;
SEC_ACL *dacl = 0;
SEC_ACE *ace = 0;
NTSTATUS status;
if (!ctx || !psd[0] || !sid || !sd_size)
return NT_STATUS_INVALID_PARAMETER;
*sd_size = 0;
status = sec_ace_del_sid(ctx, &ace, psd[0]->dacl->aces, &psd[0]->dacl->num_aces, sid);
if (!NT_STATUS_IS_OK(status))
return status;
if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace)))
return NT_STATUS_UNSUCCESSFUL;
if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid,
psd[0]->group_sid, psd[0]->sacl, dacl, sd_size)))
return NT_STATUS_UNSUCCESSFUL;
*psd = sd;
sd = 0;
return NT_STATUS_OK;
}
SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr,
BOOL child_container)
{
SEC_DESC_BUF *sdb;
SEC_DESC *sd;
SEC_ACL *new_dacl, *the_acl;
SEC_ACE *new_ace_list = NULL;
unsigned int new_ace_list_ndx = 0, i;
size_t size;
the_acl = parent_ctr->dacl;
if (the_acl->num_aces) {
if (!(new_ace_list = TALLOC_ARRAY(ctx, SEC_ACE, the_acl->num_aces)))
return NULL;
} else {
new_ace_list = NULL;
}
for (i = 0; i < the_acl->num_aces; i++) {
SEC_ACE *ace = &the_acl->aces[i];
SEC_ACE *new_ace = &new_ace_list[new_ace_list_ndx];
uint8 new_flags = 0;
BOOL inherit = False;
fstring sid_str;
if (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) {
if (!child_container) {
new_flags |= SEC_ACE_FLAG_OBJECT_INHERIT;
} else {
new_flags |= SEC_ACE_FLAG_INHERIT_ONLY;
}
inherit = True;
}
if (ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
if (!child_container) {
inherit = False;
} else {
new_flags |= SEC_ACE_FLAG_CONTAINER_INHERIT;
}
}
if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
}
if (ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
new_flags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT |
SEC_ACE_FLAG_CONTAINER_INHERIT);
}
if (!inherit)
continue;
init_sec_access(&new_ace->access_mask, ace->access_mask);
init_sec_ace(new_ace, &ace->trustee, ace->type,
new_ace->access_mask, new_flags);
sid_to_string(sid_str, &ace->trustee);
DEBUG(5, ("se_create_child_secdesc(): %s:%d/0x%02x/0x%08x "
" inherited as %s:%d/0x%02x/0x%08x\n", sid_str,
ace->type, ace->flags, ace->access_mask,
sid_str, new_ace->type, new_ace->flags,
new_ace->access_mask));
new_ace_list_ndx++;
}
new_dacl = make_sec_acl(ctx, ACL_REVISION, new_ace_list_ndx, new_ace_list);
sd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE,
parent_ctr->owner_sid,
parent_ctr->group_sid,
parent_ctr->sacl,
new_dacl, &size);
sdb = make_sec_desc_buf(ctx, size, sd);
return sdb;
}
void init_sec_access(SEC_ACCESS *t, uint32 mask)
{
*t = mask;
}