Revert "libcli/security: tree and replace sid are not optional to sec_access_check_ds()"

[metze/samba/wip.git] / libcli / security / access_check.c

diff --git a/libcli/security/access_check.c b/libcli/security/access_check.c
index 3be322ef212ece36148f22b22a2a1d1036031e00..936ffca242e6b6e7682f97dc3815e54715ee8fe9 100644 (file)
--- a/libcli/security/access_check.c
+++ b/libcli/security/access_check.c
@@ -367,18 +367,32 @@ NTSTATUS se_file_access_check(const struct security_descriptor *sd,
 
 static const struct GUID *get_ace_object_type(struct security_ace *ace)
 {
-       struct GUID *type;
-
-       if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT)
-               type = &ace->object.object.type.type;
-       else
-               type = NULL;
-
-       return type;
+       if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
+               return &ace->object.object.type.type;
+       }
 
+       return NULL;
 }
 
-/* modified access check for the purposes of DS security
+/**
+ * @brief Perform directoryservice (DS) related access checks for a given user
+ *
+ * Perform DS access checks for the user represented by its security_token, on
+ * the provided security descriptor. If an tree associating GUID and access
+ * required is provided then object access (OA) are checked as well. *
+ * @param[in]   sd             The security descritor against which the required
+ *                             access are requested
+ *
+ * @param[in]   token          The security_token associated with the user to
+ *                             test
+ *
+ * @param[in]   access_desired A bitfield of rights that must be granted for the
+ *                             given user in the specified SD.
+ *
+ * If one
+ * of the entry in the tree grants all the requested rights for the given GUID
+ * FIXME
+ * tree can be null if not null it's the
  * Lots of code duplication, it will ve united in just one
  * function eventually */
 
@@ -393,7 +407,9 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
        uint32_t bits_remaining;
        struct object_tree *node;
        const struct GUID *type;
-       struct dom_sid *ps_sid = dom_sid_parse_talloc(NULL, SID_NT_SELF);
+       struct dom_sid self_sid;
+
+       dom_sid_parse(SID_NT_SELF, &self_sid);
 
        *access_granted = access_desired;
        bits_remaining = access_desired;
@@ -410,7 +426,6 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
                if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
                        bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
                } else {
-                       talloc_free(ps_sid);
                        return NT_STATUS_PRIVILEGE_NOT_HELD;
                }
        }
@@ -434,7 +449,6 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
        /* a NULL dacl allows access */
        if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
                *access_granted = access_desired;
-               talloc_free(ps_sid);
                return NT_STATUS_OK;
        }
 
@@ -451,7 +465,7 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
                        continue;
                }
 
-               if (dom_sid_equal(&ace->trustee, ps_sid) && replace_sid) {
+               if (dom_sid_equal(&ace->trustee, &self_sid) && replace_sid) {
                        trustee = replace_sid;
                } else {
                        trustee = &ace->trustee;
@@ -471,7 +485,6 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
                        break;
                case SEC_ACE_TYPE_ACCESS_DENIED:
                        if (bits_remaining & ace->access_mask) {
-                               talloc_free(ps_sid);
                                return NT_STATUS_ACCESS_DENIED;
                        }
                        break;
@@ -499,12 +512,10 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
                        if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
                                object_tree_modify_access(node, ace->access_mask);
                                if (node->remaining_access == 0) {
-                                       talloc_free(ps_sid);
                                        return NT_STATUS_OK;
                                }
                        } else {
                                if (node->remaining_access & ace->access_mask){
-                                       talloc_free(ps_sid);
                                        return NT_STATUS_ACCESS_DENIED;
                                }
                        }
@@ -515,7 +526,6 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
        }
 
 done:
-       talloc_free(ps_sid);
        if (bits_remaining != 0) {
                return NT_STATUS_ACCESS_DENIED;
        }