-/*
+/*
Unix SMB/CIFS implementation.
security descriptor utility functions
Copyright (C) Andrew Tridgell 2004
+ Copyright (C) Andrew Bartlett 2010
Copyright (C) Stefan Metzmacher 2005
-
+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
-#include "libcli/security/security.h"
-#include "auth/session.h"
+#include "libcli/security/security_token.h"
+#include "libcli/security/dom_sid.h"
+#include "libcli/security/privileges.h"
/*
return a blank security token
return;
}
- DEBUG(dbg_lev, ("Security token SIDs (%lu):\n",
+ DEBUG(dbg_lev, ("Security token SIDs (%lu):\n",
(unsigned long)token->num_sids));
for (i = 0; i < token->num_sids; i++) {
- DEBUGADD(dbg_lev, (" SID[%3lu]: %s\n", (unsigned long)i,
+ DEBUGADD(dbg_lev, (" SID[%3lu]: %s\n", (unsigned long)i,
dom_sid_string(mem_ctx, &token->sids[i])));
}
return ret;
}
-bool security_token_is_system(const struct security_token *token)
+bool security_token_is_system(const struct security_token *token)
{
return security_token_is_sid_string(token, SID_NT_SYSTEM);
}
-bool security_token_is_anonymous(const struct security_token *token)
+bool security_token_is_anonymous(const struct security_token *token)
{
return security_token_is_sid_string(token, SID_NT_ANONYMOUS);
}
{
return security_token_has_sid_string(token, SID_NT_ENTERPRISE_DCS);
}
-
-enum security_user_level security_session_user_level(struct auth_session_info *session_info,
- const struct dom_sid *domain_sid)
-{
- if (!session_info) {
- return SECURITY_ANONYMOUS;
- }
-
- if (security_token_is_system(session_info->security_token)) {
- return SECURITY_SYSTEM;
- }
-
- if (security_token_is_anonymous(session_info->security_token)) {
- return SECURITY_ANONYMOUS;
- }
-
- if (security_token_has_builtin_administrators(session_info->security_token)) {
- return SECURITY_ADMINISTRATOR;
- }
-
- if (domain_sid) {
- struct dom_sid *rodc_dcs;
- rodc_dcs = dom_sid_add_rid(session_info, domain_sid, DOMAIN_RID_READONLY_DCS);
- if (security_token_has_sid(session_info->security_token, rodc_dcs)) {
- talloc_free(rodc_dcs);
- return SECURITY_RO_DOMAIN_CONTROLLER;
- }
- talloc_free(rodc_dcs);
- }
-
- if (security_token_has_enterprise_dcs(session_info->security_token)) {
- return SECURITY_DOMAIN_CONTROLLER;
- }
-
- if (security_token_has_nt_authenticated_users(session_info->security_token)) {
- return SECURITY_USER;
- }
-
- return SECURITY_ANONYMOUS;
-}
-
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+
+ security descriptor utility functions
+
+ Copyright (C) Andrew Tridgell 2004
+ Copyright (C) Andrew Bartlett 2010
+ Copyright (C) Stefan Metzmacher 2005
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _LIBCLI_SECURITY_SECURITY_TOKEN_H_
+#define _LIBCLI_SECURITY_SECURITY_TOKEN_H_
+
+#include "librpc/gen_ndr/security.h"
+
+#define PRIMARY_USER_SID_INDEX 0
+#define PRIMARY_GROUP_SID_INDEX 1
+
+/*
+ return a blank security token
+*/
+struct security_token *security_token_initialise(TALLOC_CTX *mem_ctx);
+
+/****************************************************************************
+ prints a struct security_token to debug output.
+****************************************************************************/
+void security_token_debug(int dbg_lev, const struct security_token *token);
+
+bool security_token_is_sid(const struct security_token *token, const struct dom_sid *sid);
+
+bool security_token_is_sid_string(const struct security_token *token, const char *sid_string);
+
+bool security_token_is_system(const struct security_token *token);
+
+bool security_token_is_anonymous(const struct security_token *token);
+
+bool security_token_has_sid(const struct security_token *token, const struct dom_sid *sid);
+
+bool security_token_has_sid_string(const struct security_token *token, const char *sid_string);
+
+bool security_token_has_builtin_administrators(const struct security_token *token);
+
+bool security_token_has_nt_authenticated_users(const struct security_token *token);
+
+bool security_token_has_enterprise_dcs(const struct security_token *token);
+
+#endif
bld.SAMBA_SUBSYSTEM('LIBSECURITY_COMMON',
- source='dom_sid.c display_sec.c secace.c secacl.c security_descriptor.c sddl.c privileges.c',
+ source='dom_sid.c display_sec.c secace.c secacl.c security_descriptor.c sddl.c privileges.c security_token.c',
deps='talloc LIBNDR'
)
#include "libcli/security/secacl.h"
#include "libcli/security/proto.h"
#include "libcli/security/security_descriptor.h"
+#include "libcli/security/security_token.h"
#include "libcli/security/sddl.h"
#include "libcli/security/privileges.h"
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+
+ session_info utility functions
+
+ Copyright (C) Andrew Bartlett 2008-2010
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "auth/session.h"
+#include "libcli/security/security.h"
+
+enum security_user_level security_session_user_level(struct auth_session_info *session_info,
+ const struct dom_sid *domain_sid)
+{
+ if (!session_info) {
+ return SECURITY_ANONYMOUS;
+ }
+
+ if (security_token_is_system(session_info->security_token)) {
+ return SECURITY_SYSTEM;
+ }
+
+ if (security_token_is_anonymous(session_info->security_token)) {
+ return SECURITY_ANONYMOUS;
+ }
+
+ if (security_token_has_builtin_administrators(session_info->security_token)) {
+ return SECURITY_ADMINISTRATOR;
+ }
+
+ if (domain_sid) {
+ struct dom_sid *rodc_dcs;
+ rodc_dcs = dom_sid_add_rid(session_info, domain_sid, DOMAIN_RID_READONLY_DCS);
+ if (security_token_has_sid(session_info->security_token, rodc_dcs)) {
+ talloc_free(rodc_dcs);
+ return SECURITY_RO_DOMAIN_CONTROLLER;
+ }
+ talloc_free(rodc_dcs);
+ }
+
+ if (security_token_has_enterprise_dcs(session_info->security_token)) {
+ return SECURITY_DOMAIN_CONTROLLER;
+ }
+
+ if (security_token_has_nt_authenticated_users(session_info->security_token)) {
+ return SECURITY_USER;
+ }
+
+ return SECURITY_ANONYMOUS;
+}
#!/usr/bin/env python
bld.SAMBA_SUBSYSTEM('LIBSECURITY',
- source='security_token.c access_check.c create_descriptor.c object_tree.c',
+ source='access_check.c create_descriptor.c object_tree.c session.c',
autoproto='proto.h',
public_deps='LIBNDR LIBSECURITY_COMMON'
)
git.samba.org / samba.git / commitdiff