4 Copyright (C) Andrew Bartlett 2005
5 Copyright (C) Simo Sorce 2006
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * Component: ldb kludge ACL module
26 * Description: Simple module to enforce a simple form of access
27 * control, sufficient for securing a default Samba4
30 * Author: Andrew Bartlett
34 #include "ldb/include/ldb.h"
35 #include "ldb/include/ldb_errors.h"
36 #include "ldb/include/ldb_private.h"
37 #include "auth/auth.h"
38 #include "libcli/security/security.h"
39 #include "dsdb/samdb/samdb.h"
43 * - System can read passwords
44 * - Administrators can write anything
45 * - Users can read anything that is not a password
56 struct kludge_private_data {
57 const char **password_attrs;
60 static enum user_is what_is_user(struct ldb_module *module)
62 struct auth_session_info *session_info
63 = ldb_get_opaque(module->ldb, "sessionInfo");
68 if (security_token_is_system(session_info->security_token)) {
72 if (security_token_is_anonymous(session_info->security_token)) {
76 if (security_token_has_builtin_administrators(session_info->security_token)) {
80 if (security_token_has_nt_authenticated_users(session_info->security_token)) {
87 static const char *user_name(TALLOC_CTX *mem_ctx, struct ldb_module *module)
89 struct auth_session_info *session_info
90 = ldb_get_opaque(module->ldb, "sessionInfo");
92 return "UNKNOWN (NULL)";
95 return talloc_asprintf(mem_ctx, "%s\\%s",
96 session_info->server_info->domain_name,
97 session_info->server_info->account_name);
101 struct kludge_acl_context {
103 struct ldb_module *module;
105 int (*up_callback)(struct ldb_context *, void *, struct ldb_reply *);
107 enum user_is user_type;
108 bool allowedAttributes;
109 bool allowedAttributesEffective;
113 /* read all objectClasses */
115 static int kludge_acl_allowedAttributes(struct ldb_context *ldb, struct ldb_message *msg,
116 const char *attrName)
118 struct ldb_message_element *oc_el = ldb_msg_find_element(msg, "objectClass");
119 struct ldb_message_element *allowedAttributes;
120 const struct dsdb_schema *schema = dsdb_get_schema(ldb);
121 const struct dsdb_class *class;
123 ret = ldb_msg_add_empty(msg, attrName, 0, &allowedAttributes);
124 if (ret != LDB_SUCCESS) {
128 for (i=0; i < oc_el->num_values; i++) {
129 class = dsdb_class_by_lDAPDisplayName(schema, (const char *)oc_el->values[i].data);
131 /* We don't know this class? what is going on? */
134 for (j=0; class->mayContain && class->mayContain[j]; j++) {
135 ldb_msg_add_string(msg, attrName, class->mayContain[j]);
137 for (j=0; class->mustContain && class->mustContain[j]; j++) {
138 ldb_msg_add_string(msg, attrName, class->mustContain[j]);
140 for (j=0; class->systemMayContain && class->systemMayContain[j]; j++) {
141 ldb_msg_add_string(msg, attrName, class->systemMayContain[j]);
143 for (j=0; class->systemMustContain && class->systemMustContain[j]; j++) {
144 ldb_msg_add_string(msg, attrName, class->systemMustContain[j]);
148 if (allowedAttributes->num_values > 1) {
149 qsort(allowedAttributes->values,
150 allowedAttributes->num_values,
151 sizeof(*allowedAttributes->values),
154 for (i=1 ; i < allowedAttributes->num_values; i++) {
155 struct ldb_val *val1 = &allowedAttributes->values[i-1];
156 struct ldb_val *val2 = &allowedAttributes->values[i];
157 if (data_blob_cmp(val1, val2) == 0) {
158 memmove(val1, val2, (allowedAttributes->num_values - i) * sizeof( struct ldb_val));
159 allowedAttributes->num_values--;
169 /* find all attributes allowed by all these objectClasses */
171 static int kludge_acl_callback(struct ldb_context *ldb, void *context, struct ldb_reply *ares)
173 struct kludge_acl_context *ac;
174 struct kludge_private_data *data;
177 if (!context || !ares) {
178 ldb_set_errstring(ldb, "NULL Context or Result in callback");
182 ac = talloc_get_type(context, struct kludge_acl_context);
183 data = talloc_get_type(ac->module->private_data, struct kludge_private_data);
185 if (ares->type != LDB_REPLY_ENTRY) {
186 return ac->up_callback(ldb, ac->up_context, ares);
189 if (ac->allowedAttributes) {
190 ret = kludge_acl_allowedAttributes(ldb, ares->message, "allowedAttributes");
191 if (ret != LDB_SUCCESS) {
196 if (data && data->password_attrs) /* if we are not initialized just get through */
198 switch (ac->user_type) {
201 if (ac->allowedAttributesEffective) {
202 ret = kludge_acl_allowedAttributes(ldb, ares->message, "allowedAttributesEffective");
203 if (ret != LDB_SUCCESS) {
209 /* remove password attributes */
210 for (i = 0; data->password_attrs[i]; i++) {
211 ldb_msg_remove_attr(ares->message, data->password_attrs[i]);
216 if ((ac->allowedAttributes || ac->allowedAttributesEffective) &&
217 (!ldb_attr_in_list(ac->attrs, "objectClass") &&
218 !ldb_attr_in_list(ac->attrs, "*"))) {
219 ldb_msg_remove_attr(ares->message, "objectClass");
222 return ac->up_callback(ldb, ac->up_context, ares);
226 return LDB_ERR_OPERATIONS_ERROR;
229 static int kludge_acl_search(struct ldb_module *module, struct ldb_request *req)
231 struct kludge_acl_context *ac;
232 struct ldb_request *down_req;
233 struct kludge_private_data *data;
238 ac = talloc(req, struct kludge_acl_context);
240 return LDB_ERR_OPERATIONS_ERROR;
243 data = talloc_get_type(module->private_data, struct kludge_private_data);
246 ac->up_context = req->context;
247 ac->up_callback = req->callback;
248 ac->user_type = what_is_user(module);
249 ac->attrs = req->op.search.attrs;
251 down_req = talloc_zero(req, struct ldb_request);
252 if (down_req == NULL) {
253 return LDB_ERR_OPERATIONS_ERROR;
256 down_req->operation = req->operation;
257 down_req->op.search.base = req->op.search.base;
258 down_req->op.search.scope = req->op.search.scope;
259 down_req->op.search.tree = req->op.search.tree;
260 down_req->op.search.attrs = req->op.search.attrs;
262 ac->allowedAttributes = ldb_attr_in_list(req->op.search.attrs, "allowedAttributes");
264 ac->allowedAttributesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedAttributesEffective");
266 if (ac->allowedAttributes || ac->allowedAttributesEffective) {
267 down_req->op.search.attrs
268 = ldb_attr_list_copy_add(down_req, down_req->op.search.attrs, "objectClass");
271 /* FIXME: I hink we should copy the tree and keep the original
273 /* replace any attributes in the parse tree that are private,
274 so we don't allow a search for 'sambaPassword=penguin',
275 just as we would not allow that attribute to be returned */
276 switch (ac->user_type) {
280 /* remove password attributes */
281 for (i = 0; data && data->password_attrs && data->password_attrs[i]; i++) {
282 ldb_parse_tree_attr_replace(down_req->op.search.tree,
283 data->password_attrs[i],
284 "kludgeACLredactedattribute");
288 down_req->controls = req->controls;
290 down_req->context = ac;
291 down_req->callback = kludge_acl_callback;
292 ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
294 /* perform the search */
295 ret = ldb_next_request(module, down_req);
297 /* do not free down_req as the call results may be linked to it,
298 * it will be freed when the upper level request get freed */
299 if (ret == LDB_SUCCESS) {
300 req->handle = down_req->handle;
306 /* ANY change type */
307 static int kludge_acl_change(struct ldb_module *module, struct ldb_request *req)
309 enum user_is user_type = what_is_user(module);
313 return ldb_next_request(module, req);
315 ldb_asprintf_errstring(module->ldb,
316 "kludge_acl_change: "
317 "attempted database modify not permitted. "
318 "User %s is not SYSTEM or an administrator",
319 user_name(req, module));
320 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
324 static int kludge_acl_init(struct ldb_module *module)
327 TALLOC_CTX *mem_ctx = talloc_new(module);
328 static const char *attrs[] = { "passwordAttribute", NULL };
329 struct ldb_result *res;
330 struct ldb_message *msg;
331 struct ldb_message_element *password_attributes;
333 struct kludge_private_data *data;
335 data = talloc(module, struct kludge_private_data);
337 return LDB_ERR_OPERATIONS_ERROR;
340 data->password_attrs = NULL;
341 module->private_data = data;
344 return LDB_ERR_OPERATIONS_ERROR;
347 ret = ldb_search(module->ldb, ldb_dn_new(mem_ctx, module->ldb, "@KLUDGEACL"),
351 if (ret != LDB_SUCCESS) {
354 talloc_steal(mem_ctx, res);
355 if (res->count == 0) {
359 if (res->count > 1) {
360 talloc_free(mem_ctx);
361 return LDB_ERR_CONSTRAINT_VIOLATION;
366 password_attributes = ldb_msg_find_element(msg, "passwordAttribute");
367 if (!password_attributes) {
370 data->password_attrs = talloc_array(data, const char *, password_attributes->num_values + 1);
371 if (!data->password_attrs) {
372 talloc_free(mem_ctx);
373 return LDB_ERR_OPERATIONS_ERROR;
375 for (i=0; i < password_attributes->num_values; i++) {
376 data->password_attrs[i] = (const char *)password_attributes->values[i].data;
377 talloc_steal(data->password_attrs, password_attributes->values[i].data);
379 data->password_attrs[i] = NULL;
382 talloc_free(mem_ctx);
383 return ldb_next_init(module);
386 static const struct ldb_module_ops kludge_acl_ops = {
387 .name = "kludge_acl",
388 .search = kludge_acl_search,
389 .add = kludge_acl_change,
390 .modify = kludge_acl_change,
391 .del = kludge_acl_change,
392 .rename = kludge_acl_change,
393 .extended = kludge_acl_change,
394 .init_context = kludge_acl_init
397 int ldb_kludge_acl_init(void)
399 return ldb_register_module(&kludge_acl_ops);