source4/dsdb/samdb/ldb_modules/schema.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions
   4
   5    Copyright (C) Andrew Tridgell 2009
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "ldb.h"
  24 #include "ldb_module.h"
  25 #include "librpc/ndr/libndr.h"
  26 #include "dsdb/samdb/ldb_modules/util.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "util.h"
  29 #include "libcli/security/security.h"
  30
  31
  32 const struct dsdb_class * get_last_structural_class(const struct dsdb_schema *schema,const struct ldb_message_element *element)
  33 {
  34         const struct dsdb_class *last_class = NULL;
  35         unsigned int i;
  36
  37         for (i = 0; i < element->num_values; i++){
  38                 const struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &element->values[i]);
  39
  40                 if(tmp_class == NULL) {
  41                         continue;
  42                 }
  43
  44                 if(tmp_class->objectClassCategory > 1) {
  45                         continue;
  46                 }
  47
  48                 if (!last_class) {
  49                         last_class = tmp_class;
  50                 } else {
  51                         if (tmp_class->subClass_order > last_class->subClass_order)
  52                                 last_class = tmp_class;
  53                 }
  54         }
  55
  56         return last_class;
  57 }
  58
  59 int acl_check_access_on_class(struct ldb_module *module,
  60                               const struct dsdb_schema *schema,
  61                               TALLOC_CTX *mem_ctx,
  62                               struct security_descriptor *sd,
  63                               struct dom_sid *rp_sid,
  64                               uint32_t access_mask,
  65                               const char *class_name)
  66 {
  67         int ret;
  68         NTSTATUS status;
  69         uint32_t access_granted;
  70         struct object_tree *root = NULL;
  71         struct object_tree *new_node = NULL;
  72         const struct GUID *guid;
  73         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
  74         struct security_token *token = acl_user_token(module);
  75         if (class_name) {
  76                 guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
  77                 if (!guid) {
  78                         DEBUG(10, ("acl_search: cannot find class %s\n",
  79                                    class_name));
  80                         goto fail;
  81                 }
  82                 if (!insert_in_object_tree(tmp_ctx,
  83                                            guid, access_mask,
  84                                            &root, &new_node)) {
  85                         DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
  86                         goto fail;
  87                 }
  88         }
  89         status = sec_access_check_ds(sd, token,
  90                                      access_mask,
  91                                      &access_granted,
  92                                      root,
  93                                      rp_sid);
  94         if (!NT_STATUS_IS_OK(status)) {
  95                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
  96         }
  97         else {
  98                 ret = LDB_SUCCESS;
  99         }
 100         return ret;
 101 fail:
 102         return ldb_operr(ldb_module_get_ctx(module));
 103 }
 104
 105 const struct GUID *get_oc_guid_from_message(struct ldb_module *module,
 106                                                    const struct dsdb_schema *schema,
 107                                                    struct ldb_message *msg)
 108 {
 109         struct ldb_message_element *oc_el;
 110
 111         oc_el = ldb_msg_find_element(msg, "objectClass");
 112         if (!oc_el) {
 113                 return NULL;
 114         }
 115
 116         return class_schemaid_guid_by_lDAPDisplayName(schema,
 117                                                       (char *)oc_el->values[oc_el->num_values-1].data);
 118 }
 119
 120