source4/dsdb/samdb/ldb_modules/acl.c

   1 /*
   2   ldb database library
   3
   4   Copyright (C) Simo Sorce 2006-2008
   5   Copyright (C) Nadezhda Ivanova 2009
   6   Copyright (C) Anatoliy Atanasov  2009
   7
   8   This program is free software; you can redistribute it and/or modify
   9   it under the terms of the GNU General Public License as published by
  10   the Free Software Foundation; either version 3 of the License, or
  11   (at your option) any later version.
  12
  13   This program is distributed in the hope that it will be useful,
  14   but WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16   GNU General Public License for more details.
  17
  18   You should have received a copy of the GNU General Public License
  19   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23  *  Name: ldb
  24  *
  25  *  Component: ldb ACL module
  26  *
  27  *  Description: Module that performs authorisation access checks based on the
  28  *               account's security context and the DACL of the object being polled.
  29  *               Only DACL checks implemented at this point
  30  *
  31  *  Authors: Nadezhda Ivanova, Anatoliy Atanasov
  32  */
  33
  34 #include "includes.h"
  35 #include "ldb_module.h"
  36 #include "auth/auth.h"
  37 #include "libcli/security/security.h"
  38 #include "librpc/gen_ndr/ndr_security.h"
  39 #include "dsdb/samdb/samdb.h"
  40 #include "librpc/gen_ndr/ndr_security.h"
  41 #include "param/param.h"
  42
  43 struct extended_access_check_attribute {
  44         const char *oa_name;
  45         const uint32_t requires_rights;
  46 };
  47
  48 struct acl_private {
  49         bool acl_perform;
  50         const char **password_attrs;
  51 };
  52
  53 struct acl_context {
  54         struct ldb_module *module;
  55         struct ldb_request *req;
  56         enum security_user_level user_type;
  57         bool allowedAttributes;
  58         bool allowedAttributesEffective;
  59         bool allowedChildClasses;
  60         bool allowedChildClassesEffective;
  61         bool sDRightsEffective;
  62         const char * const *attrs;
  63 };
  64
  65 bool is_root_base_dn(struct ldb_context *ldb, struct ldb_dn *dn_to_check)
  66 {
  67         int result;
  68         struct ldb_dn *root_base_dn = ldb_get_root_basedn(ldb);
  69         result = ldb_dn_compare(root_base_dn,dn_to_check);
  70         return (result==0);
  71 }
  72
  73 static enum security_user_level what_is_user(struct ldb_module *module)
  74 {
  75         struct ldb_context *ldb = ldb_module_get_ctx(module);
  76         struct auth_session_info *session_info
  77                 = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
  78         return security_session_user_level(session_info);
  79 }
  80
  81 static struct security_token *acl_user_token(struct ldb_module *module)
  82 {
  83         struct ldb_context *ldb = ldb_module_get_ctx(module);
  84         struct auth_session_info *session_info
  85                 = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
  86         if(!session_info) {
  87                 return NULL;
  88         }
  89         return session_info->security_token;
  90 }
  91
  92 static int acl_module_init(struct ldb_module *module)
  93 {
  94         struct ldb_context *ldb;
  95         struct acl_private *data;
  96         int ret, i;
  97         TALLOC_CTX *mem_ctx = talloc_new(module);
  98         static const char *attrs[] = { "passwordAttribute", NULL };
  99         struct ldb_result *res;
 100         struct ldb_message *msg;
 101         struct ldb_message_element *password_attributes;
 102
 103         ldb = ldb_module_get_ctx(module);
 104
 105         ret = ldb_mod_register_control(module, LDB_CONTROL_SD_FLAGS_OID);
 106         if (ret != LDB_SUCCESS) {
 107                 ldb_debug(ldb, LDB_DEBUG_ERROR,
 108                           "acl_module_init: Unable to register control with rootdse!\n");
 109                 return LDB_ERR_OPERATIONS_ERROR;
 110         }
 111
 112         data = talloc(module, struct acl_private);
 113         if (data == NULL) {
 114                 ldb_oom(ldb);
 115                 return LDB_ERR_OPERATIONS_ERROR;
 116         }
 117
 118         data->password_attrs = NULL;
 119         data->acl_perform = lp_parm_bool(ldb_get_opaque(ldb, "loadparm"),
 120                                          NULL, "acl", "perform", false);
 121         ldb_module_set_private(module, data);
 122
 123         if (!mem_ctx) {
 124                 ldb_oom(ldb);
 125                 return LDB_ERR_OPERATIONS_ERROR;
 126         }
 127
 128         ret = ldb_search(ldb, mem_ctx, &res,
 129                          ldb_dn_new(mem_ctx, ldb, "@KLUDGEACL"),
 130                          LDB_SCOPE_BASE, attrs, NULL);
 131         if (ret != LDB_SUCCESS) {
 132                 goto done;
 133         }
 134         if (res->count == 0) {
 135                 goto done;
 136         }
 137
 138         if (res->count > 1) {
 139                 talloc_free(mem_ctx);
 140                 return LDB_ERR_CONSTRAINT_VIOLATION;
 141         }
 142
 143         msg = res->msgs[0];
 144
 145         password_attributes = ldb_msg_find_element(msg, "passwordAttribute");
 146         if (!password_attributes) {
 147                 goto done;
 148         }
 149         data->password_attrs = talloc_array(data, const char *, password_attributes->num_values + 1);
 150         if (!data->password_attrs) {
 151                 talloc_free(mem_ctx);
 152                 ldb_oom(ldb);
 153                 return LDB_ERR_OPERATIONS_ERROR;
 154         }
 155         for (i=0; i < password_attributes->num_values; i++) {
 156                 data->password_attrs[i] = (const char *)password_attributes->values[i].data;
 157                 talloc_steal(data->password_attrs, password_attributes->values[i].data);
 158         }
 159         data->password_attrs[i] = NULL;
 160
 161 done:
 162         talloc_free(mem_ctx);
 163         return ldb_next_init(module);
 164 }
 165
 166 static int get_sd_from_ldb_message(TALLOC_CTX *mem_ctx,
 167                                    struct ldb_message *acl_res,
 168                                    struct security_descriptor **sd)
 169 {
 170         struct ldb_message_element *sd_element;
 171         enum ndr_err_code ndr_err;
 172
 173         sd_element = ldb_msg_find_element(acl_res, "nTSecurityDescriptor");
 174         if (!sd_element) {
 175                 *sd = NULL;
 176                 return LDB_SUCCESS;
 177         }
 178         *sd = talloc(mem_ctx, struct security_descriptor);
 179         if(!*sd) {
 180                 return LDB_ERR_OPERATIONS_ERROR;
 181         }
 182         ndr_err = ndr_pull_struct_blob(&sd_element->values[0], *sd, NULL, *sd,
 183                                        (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
 184
 185         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 186                 return LDB_ERR_OPERATIONS_ERROR;
 187         }
 188
 189         return LDB_SUCCESS;
 190 }
 191
 192 static const struct GUID *get_oc_guid_from_message(struct ldb_module *module,
 193                                                    struct ldb_message *msg)
 194 {
 195         struct ldb_message_element *oc_el;
 196         struct ldb_context *ldb = ldb_module_get_ctx(module);
 197
 198         oc_el = ldb_msg_find_element(msg, "objectClass");
 199         if (!oc_el) {
 200                 return NULL;
 201         }
 202
 203         return class_schemaid_guid_by_lDAPDisplayName(dsdb_get_schema(ldb),
 204                                                       (char *)oc_el->values[oc_el->num_values-1].data);
 205 }
 206
 207 static void acl_debug(struct security_descriptor *sd,
 208                       struct security_token *token,
 209                       struct ldb_dn *dn,
 210                       bool denied,
 211                       int level)
 212 {
 213         if (denied) {
 214                 DEBUG(level, ("Access on %s denied", ldb_dn_get_linearized(dn)));
 215         } else {
 216                 DEBUG(level, ("Access on %s granted", ldb_dn_get_linearized(dn)));
 217         }
 218
 219         DEBUG(level,("Security context: %s\n",
 220                      ndr_print_struct_string(0,(ndr_print_fn_t)ndr_print_security_token,"", token)));
 221         DEBUG(level,("Security descriptor: %s\n",
 222                      ndr_print_struct_string(0,(ndr_print_fn_t)ndr_print_security_descriptor,"", sd)));
 223 }
 224
 225 static int check_access_on_dn(struct ldb_module *module,
 226                               TALLOC_CTX *mem_ctx,
 227                               struct ldb_dn *dn,
 228                               uint32_t access,
 229                               struct object_tree *tree)
 230 {
 231         int ret;
 232         struct ldb_context *ldb = ldb_module_get_ctx(module);
 233         struct ldb_result *acl_res;
 234         struct security_descriptor *sd = NULL;
 235         NTSTATUS status;
 236         uint32_t access_granted;
 237         static const char *acl_attrs[] = {
 238                 "nTSecurityDescriptor",
 239                 NULL
 240         };
 241
 242         ret = ldb_search(ldb, mem_ctx, &acl_res, dn, LDB_SCOPE_BASE, acl_attrs, NULL);
 243         /* we sould be able to find the parent */
 244         if (ret != LDB_SUCCESS) {
 245                 DEBUG(10,("acl: failed to find object %s\n", ldb_dn_get_linearized(dn)));
 246                 return ret;
 247         }
 248
 249         ret = get_sd_from_ldb_message(mem_ctx, acl_res->msgs[0], &sd);
 250         if (ret != LDB_SUCCESS) {
 251                 return LDB_ERR_OPERATIONS_ERROR;
 252         }
 253         /* Theoretically we pass the check if the object has no sd */
 254         if (!sd) {
 255                 return LDB_SUCCESS;
 256         }
 257         status = sec_access_check_ds(sd, acl_user_token(module),
 258                                      access,
 259                                      &access_granted,
 260                                      tree);
 261         if (!NT_STATUS_IS_OK(status)) {
 262                 acl_debug(sd,
 263                           acl_user_token(module),
 264                           dn,
 265                           true,
 266                           10);
 267                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 268         }
 269         return LDB_SUCCESS;
 270 }
 271
 272 static int acl_check_access_on_attribute(struct ldb_module *module,
 273                                          TALLOC_CTX *mem_ctx,
 274                                          struct security_descriptor *sd,
 275                                          uint32_t access,
 276                                          struct dsdb_attribute *attr)
 277 {
 278         int ret;
 279         struct ldb_context *ldb = ldb_module_get_ctx(module);
 280         NTSTATUS status;
 281         uint32_t access_granted;
 282         struct object_tree *root = NULL;
 283         struct object_tree *new_node = NULL;
 284         const struct dsdb_schema *schema = dsdb_get_schema(ldb);
 285         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 286         struct security_token *token = acl_user_token(module);
 287         if (attr) {
 288                 if (!GUID_all_zero(&attr->attributeSecurityGUID)) {
 289                         if (!insert_in_object_tree(tmp_ctx,
 290                                                    &attr->attributeSecurityGUID, access,
 291                                                    &root, &new_node)) {
 292                                 DEBUG(10, ("acl_search: cannot add to object tree securityGUID\n"));
 293                                 goto fail;
 294                         }
 295
 296                         if (!insert_in_object_tree(tmp_ctx,
 297                                                    &attr->schemaIDGUID, access, &new_node, &new_node)) {
 298                                 DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
 299                                 goto fail;
 300                         }
 301                 }
 302                 else {
 303                         if (!insert_in_object_tree(tmp_ctx,
 304                                                    &attr->schemaIDGUID, access, &root, &new_node)) {
 305                                 DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
 306                                 goto fail;
 307                         }
 308                 }
 309         }
 310         status = sec_access_check_ds(sd, token,
 311                                      access,
 312                                      &access_granted,
 313                                      root);
 314         if (!NT_STATUS_IS_OK(status)) {
 315                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 316         }
 317         else {
 318                 ret = LDB_SUCCESS;
 319         }
 320         return ret;
 321 fail:
 322         return LDB_ERR_OPERATIONS_ERROR;
 323 }
 324
 325 static int acl_check_access_on_class(struct ldb_module *module,
 326                                      TALLOC_CTX *mem_ctx,
 327                                      struct security_descriptor *sd,
 328                                      uint32_t access,
 329                                      const char *class_name)
 330 {
 331         int ret;
 332         struct ldb_context *ldb = ldb_module_get_ctx(module);
 333         NTSTATUS status;
 334         uint32_t access_granted;
 335         struct object_tree *root = NULL;
 336         struct object_tree *new_node = NULL;
 337         struct GUID *guid;
 338         const struct dsdb_schema *schema = dsdb_get_schema(ldb);
 339         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 340         struct security_token *token = acl_user_token(module);
 341         if (class_name) {
 342                 guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
 343                 if (!guid) {
 344                         DEBUG(10, ("acl_search: cannot find class %s\n",
 345                                    class_name));
 346                         goto fail;
 347                 }
 348                 if (!insert_in_object_tree(tmp_ctx,
 349                                            guid, access,
 350                                            &root, &new_node)) {
 351                         DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
 352                         goto fail;
 353                 }
 354         }
 355         status = sec_access_check_ds(sd, token,
 356                                      access,
 357                                      &access_granted,
 358                                      root);
 359         if (!NT_STATUS_IS_OK(status)) {
 360                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 361         }
 362         else {
 363                 ret = LDB_SUCCESS;
 364         }
 365         return ret;
 366 fail:
 367         return LDB_ERR_OPERATIONS_ERROR;
 368 }
 369
 370 static int acl_allowedAttributes(struct ldb_module *module,
 371                                  struct ldb_message *sd_msg,
 372                                  struct ldb_message *msg,
 373                                  struct acl_context *ac)
 374 {
 375         struct ldb_message_element *oc_el;
 376         struct ldb_message_element *allowedAttributes;
 377         struct ldb_message_element *allowedAttributesEffective;
 378         struct ldb_context *ldb = ldb_module_get_ctx(module);
 379         const struct dsdb_schema *schema = dsdb_get_schema(ldb);
 380         TALLOC_CTX *mem_ctx;
 381         const char **attr_list;
 382         int i, ret;
 383
 384         /* If we don't have a schema yet, we can't do anything... */
 385         if (schema == NULL) {
 386                 return LDB_SUCCESS;
 387         }
 388
 389         /* Must remove any existing attribute */
 390         if (ac->allowedAttributes) {
 391                 ldb_msg_remove_attr(msg, "allowedAttributes");
 392         }
 393
 394         mem_ctx = talloc_new(msg);
 395         if (!mem_ctx) {
 396                 ldb_oom(ldb);
 397                 return LDB_ERR_OPERATIONS_ERROR;
 398         }
 399
 400         oc_el = ldb_msg_find_element(sd_msg, "objectClass");
 401         attr_list = dsdb_full_attribute_list(mem_ctx, schema, oc_el, DSDB_SCHEMA_ALL);
 402         if (!attr_list) {
 403                 ldb_asprintf_errstring(ldb, "acl: Failed to get list of attributes");
 404                 talloc_free(mem_ctx);
 405                 return LDB_ERR_OPERATIONS_ERROR;
 406         }
 407         if (ac->allowedAttributes) {
 408                 for (i=0; attr_list && attr_list[i]; i++) {
 409                         ldb_msg_add_string(msg, "allowedAttributes", attr_list[i]);
 410                 }
 411         }
 412         if (ac->allowedAttributesEffective) {
 413                 struct security_descriptor *sd;
 414                 ldb_msg_remove_attr(msg, "allowedAttributesEffective");
 415                 if (ac->user_type == SECURITY_SYSTEM) {
 416                         for (i=0; attr_list && attr_list[i]; i++) {
 417                                 ldb_msg_add_string(msg, "allowedAttributesEffective", attr_list[i]);
 418                         }
 419                         return LDB_SUCCESS;
 420                 }
 421
 422                 ret = get_sd_from_ldb_message(mem_ctx, sd_msg, &sd);
 423
 424                 if (ret != LDB_SUCCESS) {
 425                         return ret;
 426                 }
 427                 for (i=0; attr_list && attr_list[i]; i++) {
 428                         struct dsdb_attribute *attr = dsdb_attribute_by_lDAPDisplayName(schema,
 429                                                                                         attr_list[i]);
 430                         if (!attr) {
 431                                 return LDB_ERR_OPERATIONS_ERROR;
 432                         }
 433                         /* remove constructed attributes */
 434                         if (attr->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED) {
 435                                 continue;
 436                         }
 437                         ret = acl_check_access_on_attribute(module,
 438                                                             msg,
 439                                                             sd,
 440                                                             SEC_ADS_WRITE_PROP,
 441                                                             attr);
 442                         if (ret == LDB_SUCCESS) {
 443                                 ldb_msg_add_string(msg, "allowedAttributesEffective", attr_list[i]);
 444                         }
 445                 }
 446         }
 447         return LDB_SUCCESS;
 448 }
 449
 450 static int acl_childClasses(struct ldb_module *module,
 451                             struct ldb_message *sd_msg,
 452                             struct ldb_message *msg,
 453                             const char *attrName)
 454 {
 455         struct ldb_message_element *oc_el;
 456         struct ldb_message_element *allowedClasses;
 457         struct ldb_context *ldb = ldb_module_get_ctx(module);
 458         const struct dsdb_schema *schema = dsdb_get_schema(ldb);
 459         const struct dsdb_class *sclass;
 460         int i, j, ret;
 461
 462         /* If we don't have a schema yet, we can't do anything... */
 463         if (schema == NULL) {
 464                 return LDB_SUCCESS;
 465         }
 466
 467         /* Must remove any existing attribute, or else confusion reins */
 468         ldb_msg_remove_attr(msg, attrName);
 469         ret = ldb_msg_add_empty(msg, attrName, 0, &allowedClasses);
 470         if (ret != LDB_SUCCESS) {
 471                 return ret;
 472         }
 473
 474         oc_el = ldb_msg_find_element(sd_msg, "objectClass");
 475
 476         for (i=0; oc_el && i < oc_el->num_values; i++) {
 477                 sclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &oc_el->values[i]);
 478                 if (!sclass) {
 479                         /* We don't know this class?  what is going on? */
 480                         continue;
 481                 }
 482
 483                 for (j=0; sclass->possibleInferiors && sclass->possibleInferiors[j]; j++) {
 484                         ldb_msg_add_string(msg, attrName, sclass->possibleInferiors[j]);
 485                 }
 486         }
 487         if (allowedClasses->num_values > 1) {
 488                 qsort(allowedClasses->values,
 489                       allowedClasses->num_values,
 490                       sizeof(*allowedClasses->values),
 491                       (comparison_fn_t)data_blob_cmp);
 492
 493                 for (i=1 ; i < allowedClasses->num_values; i++) {
 494                         struct ldb_val *val1 = &allowedClasses->values[i-1];
 495                         struct ldb_val *val2 = &allowedClasses->values[i];
 496                         if (data_blob_cmp(val1, val2) == 0) {
 497                                 memmove(val1, val2, (allowedClasses->num_values - i) * sizeof(struct ldb_val));
 498                                 allowedClasses->num_values--;
 499                                 i--;
 500                         }
 501                 }
 502         }
 503
 504         return LDB_SUCCESS;
 505 }
 506
 507 static int acl_childClassesEffective(struct ldb_module *module,
 508                                      struct ldb_message *sd_msg,
 509                                      struct ldb_message *msg,
 510                                      struct acl_context *ac)
 511 {
 512         struct ldb_message_element *oc_el;
 513         struct ldb_message_element *allowedClasses = NULL;
 514         struct ldb_context *ldb = ldb_module_get_ctx(module);
 515         const struct dsdb_schema *schema = dsdb_get_schema(ldb);
 516         const struct dsdb_class *sclass;
 517         struct security_descriptor *sd;
 518         int i, j, ret;
 519
 520         if (ac->user_type == SECURITY_SYSTEM) {
 521                 return acl_childClasses(module, sd_msg, msg, "allowedChildClassesEffective");
 522         }
 523
 524         /* If we don't have a schema yet, we can't do anything... */
 525         if (schema == NULL) {
 526                 return LDB_SUCCESS;
 527         }
 528
 529         /* Must remove any existing attribute, or else confusion reins */
 530         ldb_msg_remove_attr(msg, "allowedChildClassesEffective");
 531
 532         oc_el = ldb_msg_find_element(sd_msg, "objectClass");
 533         ret = get_sd_from_ldb_message(msg, sd_msg, &sd);
 534         if (ret != LDB_SUCCESS) {
 535                 return ret;
 536         }
 537
 538         for (i=0; oc_el && i < oc_el->num_values; i++) {
 539                 sclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &oc_el->values[i]);
 540                 if (!sclass) {
 541                         /* We don't know this class?  what is going on? */
 542                         continue;
 543                 }
 544
 545                 for (j=0; sclass->possibleInferiors && sclass->possibleInferiors[j]; j++) {
 546                         ret = acl_check_access_on_class(module,
 547                                                         msg,
 548                                                         sd,
 549                                                         SEC_ADS_CREATE_CHILD,
 550                                                         sclass->possibleInferiors[j]);
 551                         if (ret == LDB_SUCCESS) {
 552                                 ldb_msg_add_string(msg, "allowedChildClassesEffective",
 553                                                    sclass->possibleInferiors[j]);
 554                         }
 555                 }
 556         }
 557         allowedClasses = ldb_msg_find_element(msg, "allowedChildClassesEffective");
 558         if (!allowedClasses) {
 559                 return LDB_SUCCESS;
 560         }
 561
 562         if (allowedClasses->num_values > 1) {
 563                 qsort(allowedClasses->values,
 564                       allowedClasses->num_values,
 565                       sizeof(*allowedClasses->values),
 566                       (comparison_fn_t)data_blob_cmp);
 567                 for (i=1 ; i < allowedClasses->num_values; i++) {
 568                         struct ldb_val *val1 = &allowedClasses->values[i-1];
 569                         struct ldb_val *val2 = &allowedClasses->values[i];
 570                         if (data_blob_cmp(val1, val2) == 0) {
 571                                 memmove(val1, val2, (allowedClasses->num_values - i) * sizeof( struct ldb_val));
 572                                 allowedClasses->num_values--;
 573                                 i--;
 574                         }
 575                 }
 576         }
 577         return LDB_SUCCESS;
 578 }
 579
 580 static int acl_sDRightsEffective(struct ldb_module *module,
 581                                  struct ldb_message *sd_msg,
 582                                  struct ldb_message *msg,
 583                                  struct acl_context *ac)
 584 {
 585         struct ldb_message_element *rightsEffective;
 586         int ret;
 587         struct security_descriptor *sd;
 588         uint32_t flags = 0;
 589
 590         /* Must remove any existing attribute, or else confusion reins */
 591         ldb_msg_remove_attr(msg, "sDRightsEffective");
 592         ret = ldb_msg_add_empty(msg, "sDRightsEffective", 0, &rightsEffective);
 593         if (ret != LDB_SUCCESS) {
 594                 return ret;
 595         }
 596         if (ac->user_type == SECURITY_SYSTEM) {
 597                 flags = SECINFO_OWNER | SECINFO_GROUP |  SECINFO_SACL |  SECINFO_DACL;
 598         }
 599         else {
 600                 /* Get the security descriptor from the message */
 601                 ret = get_sd_from_ldb_message(msg, sd_msg, &sd);
 602                 if (ret != LDB_SUCCESS) {
 603                         return ret;
 604                 }
 605
 606                 ret = acl_check_access_on_attribute(module,
 607                                                     msg,
 608                                                     sd,
 609                                                     SEC_STD_WRITE_OWNER,
 610                                                     NULL);
 611                 if (ret == LDB_SUCCESS) {
 612                         flags |= SECINFO_OWNER | SECINFO_GROUP;
 613                 }
 614                 ret = acl_check_access_on_attribute(module,
 615                                                     msg,
 616                                                     sd,
 617                                                     SEC_STD_WRITE_DAC,
 618                                                     NULL);
 619                 if (ret == LDB_SUCCESS) {
 620                         flags |= SECINFO_DACL;
 621                 }
 622                 ret = acl_check_access_on_attribute(module,
 623                                                     msg,
 624                                                     sd,
 625                                                     SEC_FLAG_SYSTEM_SECURITY,
 626                                                     NULL);
 627                 if (ret == LDB_SUCCESS) {
 628                         flags |= SECINFO_SACL;
 629                 }
 630         }
 631         ldb_msg_add_fmt(msg, "sDRightsEffective", "%u", flags);
 632         return LDB_SUCCESS;
 633 }
 634
 635 static int acl_add(struct ldb_module *module, struct ldb_request *req)
 636 {
 637         int ret;
 638         struct ldb_dn *parent = ldb_dn_get_parent(req, req->op.add.message->dn);
 639         struct ldb_context *ldb;
 640         struct ldb_message_element *oc_el;
 641         const struct GUID *guid;
 642         struct object_tree *root = NULL;
 643         struct object_tree *new_node = NULL;
 644
 645         if (what_is_user(module) == SECURITY_SYSTEM) {
 646                 return ldb_next_request(module, req);
 647         }
 648
 649         if (ldb_dn_is_special(req->op.add.message->dn)) {
 650                 return ldb_next_request(module, req);
 651         }
 652         ldb = ldb_module_get_ctx(module);
 653         /* Creating an NC. There is probably something we should do here,
 654          * but we will establish that later */
 655         if ((ldb_dn_compare(req->op.add.message->dn, (ldb_get_schema_basedn(ldb))) == 0) ||
 656             (ldb_dn_compare(req->op.add.message->dn, (ldb_get_config_basedn(ldb))) == 0) ||
 657             (ldb_dn_compare(req->op.add.message->dn, (ldb_get_root_basedn(ldb))) == 0)) {
 658                 return ldb_next_request(module, req);
 659         }
 660
 661         oc_el = ldb_msg_find_element(req->op.add.message, "objectClass");
 662         if (!oc_el || oc_el->num_values == 0) {
 663                 DEBUG(10,("acl:operation error %s\n", ldb_dn_get_linearized(req->op.add.message->dn)));
 664                 return ldb_module_done(req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 665         }
 666
 667         guid = class_schemaid_guid_by_lDAPDisplayName(dsdb_get_schema(ldb),
 668                                                       (char *)oc_el->values[oc_el->num_values-1].data);
 669
 670         if (!insert_in_object_tree(req, guid, SEC_ADS_CREATE_CHILD, &root, &new_node)) {
 671                 return LDB_ERR_OPERATIONS_ERROR;
 672         }
 673
 674         ret = check_access_on_dn(module, req, parent, SEC_ADS_CREATE_CHILD, root);
 675         if (ret != LDB_SUCCESS) {
 676                 return ret;
 677         }
 678
 679         return ldb_next_request(module, req);
 680 }
 681
 682 static int acl_modify(struct ldb_module *module, struct ldb_request *req)
 683 {
 684         int ret;
 685         struct ldb_context *ldb = ldb_module_get_ctx(module);
 686         const struct dsdb_schema *schema = dsdb_get_schema(ldb);
 687         int i;
 688         bool modify_sd = false;
 689         const struct GUID *guid;
 690         uint32_t access_granted;
 691         struct object_tree *root = NULL;
 692         struct object_tree *new_node = NULL;
 693         NTSTATUS status;
 694         struct ldb_result *acl_res;
 695         struct security_descriptor *sd;
 696         TALLOC_CTX *tmp_ctx = talloc_new(req);
 697         static const char *acl_attrs[] = {
 698                 "nTSecurityDescriptor",
 699                 "objectClass",
 700                 NULL
 701         };
 702
 703         DEBUG(10, ("ldb:acl_modify: %s\n", req->op.mod.message->elements[0].name));
 704         if (what_is_user(module) == SECURITY_SYSTEM) {
 705                 return ldb_next_request(module, req);
 706         }
 707         if (ldb_dn_is_special(req->op.mod.message->dn)) {
 708                 return ldb_next_request(module, req);
 709         }
 710         ret = ldb_search(ldb, req, &acl_res, req->op.mod.message->dn,
 711                          LDB_SCOPE_BASE, acl_attrs, NULL);
 712
 713         if (ret != LDB_SUCCESS) {
 714                 return ret;
 715         }
 716
 717         ret = get_sd_from_ldb_message(req, acl_res->msgs[0], &sd);
 718         if (ret != LDB_SUCCESS) {
 719                 DEBUG(10, ("acl_modify: cannot get descriptor\n"));
 720                 return ret;
 721         }
 722         /* Theoretically we pass the check if the object has no sd */
 723         if (!sd) {
 724                 return LDB_SUCCESS;
 725         }
 726
 727         guid = get_oc_guid_from_message(module,acl_res->msgs[0]);
 728         if (!guid) {
 729                 DEBUG(10, ("acl_modify: cannot get guid\n"));
 730                 goto fail;
 731         }
 732
 733         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
 734                                    &root, &new_node)) {
 735                 DEBUG(10, ("acl_modify: cannot add to object tree\n"));
 736                 goto fail;
 737         }
 738         for (i=0; i < req->op.mod.message->num_elements; i++){
 739                 const struct dsdb_attribute *attr;
 740                 /* clearTextPassword is not in schema */
 741                 if (strcmp("clearTextPassword", req->op.mod.message->elements[i].name) == 0) {
 742                         attr = dsdb_attribute_by_lDAPDisplayName(schema, "unicodePwd");
 743                 } else {
 744                         attr = dsdb_attribute_by_lDAPDisplayName(schema,
 745                                                                  req->op.mod.message->elements[i].name);
 746                 }
 747                 if (strcmp("nTSecurityDescriptor", req->op.mod.message->elements[i].name) == 0) {
 748                         modify_sd = true;
 749                 } else {
 750
 751                         if (!attr) {
 752                                 DEBUG(10, ("acl_modify: cannot find attribute %s\n",
 753                                            req->op.mod.message->elements[i].name));
 754                                 goto fail;
 755                         }
 756                         if (!insert_in_object_tree(tmp_ctx,
 757                                                    &attr->attributeSecurityGUID, SEC_ADS_WRITE_PROP,
 758                                                    &new_node, &new_node)) {
 759                                 DEBUG(10, ("acl_modify: cannot add to object tree securityGUID\n"));
 760                                 goto fail;
 761                         }
 762
 763                         if (!insert_in_object_tree(tmp_ctx,
 764                                                    &attr->schemaIDGUID, SEC_ADS_WRITE_PROP, &new_node, &new_node)) {
 765                                 DEBUG(10, ("acl_modify: cannot add to object tree attributeGUID\n"));
 766                                 goto fail;
 767                         }
 768                 }
 769         }
 770
 771         if (root->num_of_children > 0) {
 772                 status = sec_access_check_ds(sd, acl_user_token(module),
 773                                              SEC_ADS_WRITE_PROP,
 774                                              &access_granted,
 775                                              root);
 776
 777                 if (!NT_STATUS_IS_OK(status)) {
 778                         DEBUG(10, ("Object %s nas no write property access\n",
 779                                    ldb_dn_get_linearized(req->op.mod.message->dn)));
 780                         acl_debug(sd,
 781                                   acl_user_token(module),
 782                                   req->op.mod.message->dn,
 783                                   true,
 784                                   10);
 785                         talloc_free(tmp_ctx);
 786                         return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 787                 }
 788         }
 789         if (modify_sd) {
 790                 status = sec_access_check_ds(sd, acl_user_token(module),
 791                                              SEC_STD_WRITE_DAC,
 792                                              &access_granted,
 793                                              NULL);
 794
 795                 if (!NT_STATUS_IS_OK(status)) {
 796                         DEBUG(10, ("Object %s nas no write dacl access\n",
 797                                    ldb_dn_get_linearized(req->op.mod.message->dn)));
 798                         acl_debug(sd,
 799                                   acl_user_token(module),
 800                                   req->op.mod.message->dn,
 801                                   true,
 802                                   10);
 803                         talloc_free(tmp_ctx);
 804                         return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 805                 }
 806         }
 807
 808         talloc_free(tmp_ctx);
 809         return ldb_next_request(module, req);
 810 fail:
 811         talloc_free(tmp_ctx);
 812         return LDB_ERR_OPERATIONS_ERROR;
 813 }
 814
 815 /* similar to the modify for the time being.
 816  * We need to concider the special delete tree case, though - TODO */
 817 static int acl_delete(struct ldb_module *module, struct ldb_request *req)
 818 {
 819         int ret;
 820         struct ldb_dn *parent = ldb_dn_get_parent(req, req->op.del.dn);
 821         struct ldb_context *ldb;
 822
 823         DEBUG(10, ("ldb:acl_delete: %s\n", ldb_dn_get_linearized(req->op.del.dn)));
 824         if (what_is_user(module) == SECURITY_SYSTEM) {
 825                 return ldb_next_request(module, req);
 826         }
 827
 828         if (ldb_dn_is_special(req->op.del.dn)) {
 829                 return ldb_next_request(module, req);
 830         }
 831         ldb = ldb_module_get_ctx(module);
 832         /* first check if we have delete object right */
 833         ret = check_access_on_dn(module, req, req->op.del.dn, SEC_STD_DELETE, NULL);
 834         if (ret == LDB_SUCCESS) {
 835                 return ldb_next_request(module, req);
 836         }
 837
 838         /* Nope, we don't have delete object. Lets check if we have delete child on the parent */
 839         /* No parent, so check fails */
 840         if ((ldb_dn_compare(req->op.del.dn, (ldb_get_schema_basedn(ldb))) == 0) ||
 841             (ldb_dn_compare(req->op.del.dn, (ldb_get_config_basedn(ldb))) == 0) ||
 842             (ldb_dn_compare(req->op.del.dn, (ldb_get_root_basedn(ldb))) == 0)) {
 843                 DEBUG(10,("acl:deleting an NC\n"));
 844                 return ldb_module_done(req, NULL, NULL, LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS);
 845         }
 846
 847         ret = check_access_on_dn(module, req, parent, SEC_ADS_DELETE_CHILD, NULL);
 848         if (ret != LDB_SUCCESS) {
 849                 return ret;
 850         }
 851         return ldb_next_request(module, req);
 852 }
 853
 854 static int acl_rename(struct ldb_module *module, struct ldb_request *req)
 855 {
 856         int ret;
 857         struct ldb_dn *oldparent = ldb_dn_get_parent(req, req->op.rename.olddn);
 858         struct ldb_dn *newparent = ldb_dn_get_parent(req, req->op.rename.newdn);
 859         struct ldb_context *ldb;
 860         struct security_descriptor *sd = NULL;
 861         struct ldb_result *acl_res;
 862         const struct GUID *guid;
 863         struct object_tree *root = NULL;
 864         struct object_tree *new_node = NULL;
 865         TALLOC_CTX *tmp_ctx = talloc_new(req);
 866         NTSTATUS status;
 867         uint32_t access_granted;
 868         static const char *acl_attrs[] = {
 869                 "nTSecurityDescriptor",
 870                 "objectClass",
 871                 NULL
 872         };
 873
 874         DEBUG(10, ("ldb:acl_rename: %s\n", ldb_dn_get_linearized(req->op.rename.olddn)));
 875         if (what_is_user(module) == SECURITY_SYSTEM) {
 876                 return ldb_next_request(module, req);
 877         }
 878         if (ldb_dn_is_special(req->op.rename.olddn)) {
 879                 return ldb_next_request(module, req);
 880         }
 881         ldb = ldb_module_get_ctx(module);
 882
 883         /* TODO search to include deleted objects */
 884         ret = ldb_search(ldb, req, &acl_res, req->op.rename.olddn,
 885                          LDB_SCOPE_BASE, acl_attrs, NULL);
 886         /* we sould be able to find the parent */
 887         if (ret != LDB_SUCCESS) {
 888                 DEBUG(10,("acl: failed to find object %s\n",
 889                           ldb_dn_get_linearized(req->op.rename.olddn)));
 890                 return ret;
 891         }
 892
 893         guid = get_oc_guid_from_message(module,acl_res->msgs[0]);
 894         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
 895                                    &root, &new_node)) {
 896                 return LDB_ERR_OPERATIONS_ERROR;
 897         };
 898
 899         guid = attribute_schemaid_guid_by_lDAPDisplayName(dsdb_get_schema(ldb),
 900                                                           "name");
 901         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
 902                                    &new_node, &new_node)) {
 903                 return LDB_ERR_OPERATIONS_ERROR;
 904         };
 905
 906         ret = get_sd_from_ldb_message(req, acl_res->msgs[0], &sd);
 907
 908         if (ret != LDB_SUCCESS) {
 909                 return LDB_ERR_OPERATIONS_ERROR;
 910         }
 911         /* Theoretically we pass the check if the object has no sd */
 912         if (!sd) {
 913                 return LDB_SUCCESS;
 914         }
 915         status = sec_access_check_ds(sd, acl_user_token(module),
 916                                      SEC_ADS_WRITE_PROP,
 917                                      &access_granted,
 918                                      root);
 919
 920         if (!NT_STATUS_IS_OK(status)) {
 921                 DEBUG(10, ("Object %s nas no wp on name\n",
 922                            ldb_dn_get_linearized(req->op.rename.olddn)));
 923                 acl_debug(sd,
 924                           acl_user_token(module),
 925                           req->op.rename.olddn,
 926                           true,
 927                           10);
 928                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 929         }
 930
 931         if (ldb_dn_compare(oldparent, newparent) == 0) {
 932                 /* regular rename, not move, nothing more to do */
 933                 return ldb_next_request(module, req);
 934         }
 935
 936         /* What exactly to do in this case? It would fail anyway.. */
 937         if ((ldb_dn_compare(req->op.rename.newdn, (ldb_get_schema_basedn(ldb))) == 0) ||
 938             (ldb_dn_compare(req->op.rename.newdn, (ldb_get_config_basedn(ldb))) == 0) ||
 939             (ldb_dn_compare(req->op.rename.newdn, (ldb_get_root_basedn(ldb))) == 0)) {
 940                 DEBUG(10,("acl:moving as an NC\n"));
 941                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 942         }
 943         /* new parent should have create child */
 944         talloc_free(tmp_ctx);
 945         tmp_ctx = talloc_new(req);
 946         root = NULL;
 947         new_node = NULL;
 948         guid = get_oc_guid_from_message(module,acl_res->msgs[0]);
 949         if (!guid) {
 950                 DEBUG(10,("acl:renamed object has no object class\n"));
 951                 return ldb_module_done(req, NULL, NULL,  LDB_ERR_OPERATIONS_ERROR);
 952         }
 953         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_CREATE_CHILD,
 954                                    &root, &new_node)) {
 955                 return LDB_ERR_OPERATIONS_ERROR;
 956         }
 957         ret = check_access_on_dn(module, req, newparent, SEC_ADS_CREATE_CHILD, root);
 958         if (ret != LDB_SUCCESS) {
 959                 DEBUG(10,("acl:access_denied renaming %s", ldb_dn_get_linearized(req->op.rename.olddn)));
 960                 return ret;
 961         }
 962         /* do we have delete object on the object? */
 963
 964         status = sec_access_check_ds(sd, acl_user_token(module),
 965                                      SEC_STD_DELETE,
 966                                      &access_granted,
 967                                      NULL);
 968
 969         if (NT_STATUS_IS_OK(status)) {
 970                 return ldb_next_request(module, req);
 971         }
 972         /* what about delete child on the current parent */
 973         ret = check_access_on_dn(module, req, oldparent, SEC_ADS_DELETE_CHILD, NULL);
 974         if (ret != LDB_SUCCESS) {
 975                 DEBUG(10,("acl:access_denied renaming %s", ldb_dn_get_linearized(req->op.rename.olddn)));
 976                 return ldb_module_done(req, NULL, NULL, ret);
 977         }
 978         return ldb_next_request(module, req);
 979 }
 980
 981 static int acl_search_callback(struct ldb_request *req, struct ldb_reply *ares)
 982 {
 983         struct ldb_context *ldb;
 984         struct acl_context *ac;
 985         struct acl_private *data;
 986         struct ldb_result *acl_res;
 987         static const char *acl_attrs[] = {
 988                 "objectClass",
 989                 "nTSecurityDescriptor",
 990                 NULL
 991         };
 992         int ret, i;
 993
 994         ac = talloc_get_type(req->context, struct acl_context);
 995         data = talloc_get_type(ldb_module_get_private(ac->module), struct acl_private);
 996         ldb = ldb_module_get_ctx(ac->module);
 997
 998         if (!ares) {
 999                 return ldb_module_done(ac->req, NULL, NULL,
1000                                        LDB_ERR_OPERATIONS_ERROR);
1001         }
1002         if (ares->error != LDB_SUCCESS) {
1003                 return ldb_module_done(ac->req, ares->controls,
1004                                        ares->response, ares->error);
1005         }
1006
1007         switch (ares->type) {
1008         case LDB_REPLY_ENTRY:
1009                 if (ac->allowedAttributes
1010                     || ac->allowedChildClasses
1011                     || ac->allowedChildClassesEffective
1012                     || ac->allowedAttributesEffective
1013                     || ac->sDRightsEffective) {
1014                         ret = ldb_search(ldb, ac, &acl_res, ares->message->dn, LDB_SCOPE_BASE, acl_attrs, NULL);
1015                         if (ret != LDB_SUCCESS) {
1016                                 return ldb_module_done(ac->req, NULL, NULL, ret);
1017                         }
1018                         if (ac->allowedAttributes || ac->allowedAttributesEffective) {
1019                                 ret = acl_allowedAttributes(ac->module, acl_res->msgs[0], ares->message, ac);
1020                                 if (ret != LDB_SUCCESS) {
1021                                         return ldb_module_done(ac->req, NULL, NULL, ret);
1022                                 }
1023                         }
1024                         if (ac->allowedChildClasses) {
1025                                 ret = acl_childClasses(ac->module, acl_res->msgs[0],
1026                                                        ares->message, "allowedChildClasses");
1027                                 if (ret != LDB_SUCCESS) {
1028                                         return ldb_module_done(ac->req, NULL, NULL, ret);
1029                                 }
1030                         }
1031                         if (ac->allowedChildClassesEffective) {
1032                                 ret = acl_childClassesEffective(ac->module,
1033                                                                 acl_res->msgs[0], ares->message, ac);
1034                                 if (ret != LDB_SUCCESS) {
1035                                         return ldb_module_done(ac->req, NULL, NULL, ret);
1036                                 }
1037                         }
1038                         if (ac->sDRightsEffective) {
1039                                 ret = acl_sDRightsEffective(ac->module,
1040                                                             acl_res->msgs[0], ares->message, ac);
1041                                 if (ret != LDB_SUCCESS) {
1042                                         return ldb_module_done(ac->req, NULL, NULL, ret);
1043                                 }
1044                         }
1045                 }
1046                 if (data && data->password_attrs) {
1047                         if (ac->user_type != SECURITY_SYSTEM) {
1048                                 for (i = 0; data->password_attrs[i]; i++) {
1049                                         ldb_msg_remove_attr(ares->message, data->password_attrs[i]);
1050                                 }
1051                         }
1052                 }
1053                 return ldb_module_send_entry(ac->req, ares->message, ares->controls);
1054
1055         case LDB_REPLY_REFERRAL:
1056                 return ldb_module_send_referral(ac->req, ares->referral);
1057
1058         case LDB_REPLY_DONE:
1059                 return ldb_module_done(ac->req, ares->controls,
1060                                        ares->response, LDB_SUCCESS);
1061
1062         }
1063         return LDB_SUCCESS;
1064 }
1065
1066 static int acl_search(struct ldb_module *module, struct ldb_request *req)
1067 {
1068         struct ldb_context *ldb;
1069         struct acl_context *ac;
1070         struct ldb_request *down_req;
1071         struct acl_private *data;
1072         int ret, i;
1073
1074         ldb = ldb_module_get_ctx(module);
1075
1076         ac = talloc_zero(req, struct acl_context);
1077         if (ac == NULL) {
1078                 ldb_oom(ldb);
1079                 return LDB_ERR_OPERATIONS_ERROR;
1080         }
1081         data = talloc_get_type(ldb_module_get_private(module), struct acl_private);
1082
1083         ac->module = module;
1084         ac->req = req;
1085         ac->user_type = what_is_user(module);
1086         ac->allowedAttributes = ldb_attr_in_list(req->op.search.attrs, "allowedAttributes");
1087         ac->allowedAttributesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedAttributesEffective");
1088         ac->allowedChildClasses = ldb_attr_in_list(req->op.search.attrs, "allowedChildClasses");
1089         ac->allowedChildClassesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedChildClassesEffective");
1090         ac->sDRightsEffective = ldb_attr_in_list(req->op.search.attrs, "sDRightsEffective");
1091
1092         /* replace any attributes in the parse tree that are private,
1093            so we don't allow a search for 'userPassword=penguin',
1094            just as we would not allow that attribute to be returned */
1095         if (ac->user_type != SECURITY_SYSTEM) {
1096                 /* FIXME: We should copy the tree and keep the original unmodified. */
1097                 /* remove password attributes */
1098                 if (data && data->password_attrs) {
1099                         for (i = 0; data->password_attrs[i]; i++) {
1100                                 ldb_parse_tree_attr_replace(req->op.search.tree,
1101                                                             data->password_attrs[i],
1102                                                             "kludgeACLredactedattribute");
1103                         }
1104                 }
1105         }
1106         ret = ldb_build_search_req_ex(&down_req,
1107                                       ldb, ac,
1108                                       req->op.search.base,
1109                                       req->op.search.scope,
1110                                       req->op.search.tree,
1111                                       req->op.search.attrs,
1112                                       req->controls,
1113                                       ac, acl_search_callback,
1114                                       req);
1115         if (ret != LDB_SUCCESS) {
1116                 return ret;
1117         }
1118         /* perform the search */
1119         return ldb_next_request(module, down_req);
1120 }
1121
1122 _PUBLIC_ const struct ldb_module_ops ldb_acl_module_ops = {
1123         .name              = "acl",
1124         .search            = acl_search,
1125         .add               = acl_add,
1126         .modify            = acl_modify,
1127         .del               = acl_delete,
1128         .rename            = acl_rename,
1129         .init_context      = acl_module_init
1130 };