source4/dsdb/samdb/ldb_modules/schema.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions
   4
   5    Copyright (C) Andrew Tridgell 2009
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "ldb.h"
  24 #include "ldb_module.h"
  25 #include "librpc/ndr/libndr.h"
  26 #include "dsdb/samdb/ldb_modules/util.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "util.h"
  29 #include "libcli/security/security.h"
  30
  31
  32 const struct dsdb_class * get_last_structural_class(const struct dsdb_schema *schema,const struct ldb_message_element *element,
  33                                                     struct ldb_request *parent)
  34 {
  35         const struct dsdb_class *last_class = NULL;
  36         unsigned int i;
  37
  38         for (i = 0; i < element->num_values; i++){
  39                 const struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &element->values[i]);
  40
  41                 if(tmp_class == NULL) {
  42                         continue;
  43                 }
  44
  45                 if(tmp_class->objectClassCategory > 1) {
  46                         continue;
  47                 }
  48
  49                 if (!last_class) {
  50                         last_class = tmp_class;
  51                 } else {
  52                         if (tmp_class->subClass_order > last_class->subClass_order)
  53                                 last_class = tmp_class;
  54                 }
  55         }
  56
  57         return last_class;
  58 }
  59
  60 int acl_check_access_on_class(struct ldb_module *module,
  61                               const struct dsdb_schema *schema,
  62                               TALLOC_CTX *mem_ctx,
  63                               struct security_descriptor *sd,
  64                               struct dom_sid *rp_sid,
  65                               uint32_t access_mask,
  66                               const char *class_name)
  67 {
  68         int ret;
  69         NTSTATUS status;
  70         uint32_t access_granted;
  71         struct object_tree *root = NULL;
  72         struct object_tree *new_node = NULL;
  73         const struct GUID *guid;
  74         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
  75         struct security_token *token = acl_user_token(module);
  76         if (class_name) {
  77                 guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
  78                 if (!guid) {
  79                         DEBUG(10, ("acl_search: cannot find class %s\n",
  80                                    class_name));
  81                         goto fail;
  82                 }
  83                 if (!insert_in_object_tree(tmp_ctx,
  84                                            guid, access_mask,
  85                                            &root, &new_node)) {
  86                         DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
  87                         goto fail;
  88                 }
  89         }
  90         status = sec_access_check_ds(sd, token,
  91                                      access_mask,
  92                                      &access_granted,
  93                                      root,
  94                                      rp_sid);
  95         if (!NT_STATUS_IS_OK(status)) {
  96                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
  97         }
  98         else {
  99                 ret = LDB_SUCCESS;
 100         }
 101         return ret;
 102 fail:
 103         return ldb_operr(ldb_module_get_ctx(module));
 104 }
 105
 106 const struct GUID *get_oc_guid_from_message(struct ldb_module *module,
 107                                                    const struct dsdb_schema *schema,
 108                                                    struct ldb_message *msg)
 109 {
 110         struct ldb_message_element *oc_el;
 111
 112         oc_el = ldb_msg_find_element(msg, "objectClass");
 113         if (!oc_el) {
 114                 return NULL;
 115         }
 116
 117         return class_schemaid_guid_by_lDAPDisplayName(schema,
 118                                                       (char *)oc_el->values[oc_el->num_values-1].data);
 119 }
 120
 121