2 Unix SMB/CIFS implementation.
4 manipulate privilege records in samdb
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "libcli/ldap/ldap.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "auth/auth.h"
27 #include "libcli/security/proto.h"
31 add privilege bits for one sid to a security_token
33 static NTSTATUS samdb_privilege_setup_sid(void *samctx, TALLOC_CTX *mem_ctx,
34 const struct dom_sid *sid,
37 const char * const attrs[] = { "privilege", NULL };
38 struct ldb_message **res = NULL;
39 struct ldb_message_element *el;
45 sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
46 NT_STATUS_HAVE_NO_MEMORY(sidstr);
48 ret = gendb_search(samctx, mem_ctx, NULL, &res, attrs, "objectSid=%s", sidstr);
51 /* not an error to not match */
55 el = ldb_msg_find_element(res[0], "privilege");
60 for (i=0;i<el->num_values;i++) {
61 const char *priv_str = (const char *)el->values[i].data;
62 int privilege = sec_privilege_id(priv_str);
63 if (privilege == -1) {
64 DEBUG(1,("Unknown privilege '%s' in samdb\n",
68 *mask |= sec_privilege_mask(privilege);
75 setup the privilege mask for this security token based on our
78 NTSTATUS samdb_privilege_setup(struct security_token *token)
85 /* Shortcuts to prevent recursion and avoid lookups */
86 if (is_system_token(token)) {
87 token->privilege_mask = ~0;
91 if (is_anonymous_token(token)) {
92 token->privilege_mask = 0;
96 mem_ctx = talloc_new(token);
97 samctx = samdb_connect(mem_ctx, system_session(mem_ctx));
100 return NT_STATUS_INTERNAL_DB_CORRUPTION;
103 token->privilege_mask = 0;
105 for (i=0;i<token->num_sids;i++) {
107 status = samdb_privilege_setup_sid(samctx, mem_ctx,
108 token->sids[i], &mask);
109 if (!NT_STATUS_IS_OK(status)) {
110 talloc_free(mem_ctx);
113 token->privilege_mask |= mask;
116 talloc_free(mem_ctx);