source4/dsdb/samdb/ldb_modules/schema.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions
   4
   5    Copyright (C) Andrew Tridgell 2009
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "ldb.h"
  24 #include "ldb_module.h"
  25 #include "librpc/ndr/libndr.h"
  26 #include "dsdb/samdb/ldb_modules/util.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "dsdb/common/util.h"
  29 #include "libcli/security/security.h"
  30 #include "dsdb/samdb/ldb_modules/schema.h"
  31
  32 /*
  33  * This function determines the (last) structural or 88 object class of a passed
  34  * "objectClass" attribute.
  35  * Without schema this does not work and hence NULL is returned. If the
  36  * "objectClass" attribute has already been sorted then only a check on the
  37  * last value is necessary (MS-ADTS 3.1.1.1.4)
  38  */
  39 const struct dsdb_class *get_last_structural_class(const struct dsdb_schema *schema,
  40                                                    const struct ldb_message_element *element,
  41                                                    bool sorted)
  42 {
  43         const struct dsdb_class *last_class = NULL;
  44         unsigned int i = 0;
  45
  46         if (schema == NULL) {
  47                 return NULL;
  48         }
  49
  50         if (sorted && (element->num_values > 1)) {
  51                 i = element->num_values - 1;
  52         }
  53
  54         for (; i < element->num_values; i++){
  55                 const struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &element->values[i]);
  56
  57                 if(tmp_class == NULL) {
  58                         continue;
  59                 }
  60
  61                 if(tmp_class->objectClassCategory > 1) {
  62                         continue;
  63                 }
  64
  65                 if (!last_class) {
  66                         last_class = tmp_class;
  67                 } else {
  68                         if (tmp_class->subClass_order > last_class->subClass_order)
  69                                 last_class = tmp_class;
  70                 }
  71         }
  72
  73         return last_class;
  74 }
  75
  76 int acl_check_access_on_class(struct ldb_module *module,
  77                               const struct dsdb_schema *schema,
  78                               TALLOC_CTX *mem_ctx,
  79                               struct security_descriptor *sd,
  80                               struct dom_sid *rp_sid,
  81                               uint32_t access_mask,
  82                               const char *class_name)
  83 {
  84         int ret;
  85         NTSTATUS status;
  86         uint32_t access_granted;
  87         struct object_tree *root = NULL;
  88         struct object_tree *new_node = NULL;
  89         const struct GUID *guid;
  90         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
  91         struct security_token *token = acl_user_token(module);
  92         if (class_name) {
  93                 guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
  94                 if (!guid) {
  95                         DEBUG(10, ("acl_search: cannot find class %s\n",
  96                                    class_name));
  97                         goto fail;
  98                 }
  99                 if (!insert_in_object_tree(tmp_ctx,
 100                                            guid, access_mask,
 101                                            &root, &new_node)) {
 102                         DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
 103                         goto fail;
 104                 }
 105         }
 106         status = sec_access_check_ds(sd, token,
 107                                      access_mask,
 108                                      &access_granted,
 109                                      root,
 110                                      rp_sid);
 111         if (!NT_STATUS_IS_OK(status)) {
 112                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 113         }
 114         else {
 115                 ret = LDB_SUCCESS;
 116         }
 117         return ret;
 118 fail:
 119         return ldb_operr(ldb_module_get_ctx(module));
 120 }
 121
 122 const struct GUID *get_oc_guid_from_message(struct ldb_module *module,
 123                                                    const struct dsdb_schema *schema,
 124                                                    struct ldb_message *msg)
 125 {
 126         struct ldb_message_element *oc_el;
 127
 128         oc_el = ldb_msg_find_element(msg, "objectClass");
 129         if (!oc_el) {
 130                 return NULL;
 131         }
 132
 133         return class_schemaid_guid_by_lDAPDisplayName(schema,
 134                                                       (char *)oc_el->values[oc_el->num_values-1].data);
 135 }
 136
 137