source4/dsdb/samdb/ldb_modules/acl.c

   1 /*
   2   ldb database library
   3
   4   Copyright (C) Simo Sorce 2006-2008
   5   Copyright (C) Nadezhda Ivanova 2009
   6   Copyright (C) Anatoliy Atanasov  2009
   7
   8   This program is free software; you can redistribute it and/or modify
   9   it under the terms of the GNU General Public License as published by
  10   the Free Software Foundation; either version 3 of the License, or
  11   (at your option) any later version.
  12
  13   This program is distributed in the hope that it will be useful,
  14   but WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16   GNU General Public License for more details.
  17
  18   You should have received a copy of the GNU General Public License
  19   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23  *  Name: ldb
  24  *
  25  *  Component: ldb ACL module
  26  *
  27  *  Description: Module that performs authorisation access checks based on the
  28  *               account's security context and the DACL of the object being polled.
  29  *               Only DACL checks implemented at this point
  30  *
  31  *  Authors: Nadezhda Ivanova, Anatoliy Atanasov
  32  */
  33
  34 #include "includes.h"
  35 #include "ldb_module.h"
  36 #include "auth/auth.h"
  37 #include "libcli/security/security.h"
  38 #include "dsdb/samdb/samdb.h"
  39 #include "librpc/gen_ndr/ndr_security.h"
  40 #include "param/param.h"
  41 #include "dsdb/samdb/ldb_modules/util.h"
  42 #include "lib/util/tsort.h"
  43
  44 struct extended_access_check_attribute {
  45         const char *oa_name;
  46         const uint32_t requires_rights;
  47 };
  48
  49 struct acl_private {
  50         bool acl_perform;
  51         const char **password_attrs;
  52 };
  53
  54 struct acl_context {
  55         struct ldb_module *module;
  56         struct ldb_request *req;
  57         bool am_system;
  58         bool allowedAttributes;
  59         bool allowedAttributesEffective;
  60         bool allowedChildClasses;
  61         bool allowedChildClassesEffective;
  62         bool sDRightsEffective;
  63         const char * const *attrs;
  64         struct dsdb_schema *schema;
  65 };
  66
  67 bool is_root_base_dn(struct ldb_context *ldb, struct ldb_dn *dn_to_check)
  68 {
  69         int result;
  70         struct ldb_dn *root_base_dn = ldb_get_root_basedn(ldb);
  71         result = ldb_dn_compare(root_base_dn,dn_to_check);
  72         return (result==0);
  73 }
  74
  75 static struct security_token *acl_user_token(struct ldb_module *module)
  76 {
  77         struct ldb_context *ldb = ldb_module_get_ctx(module);
  78         struct auth_session_info *session_info
  79                 = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
  80         if(!session_info) {
  81                 return NULL;
  82         }
  83         return session_info->security_token;
  84 }
  85
  86 /* performs an access check from inside the module stack
  87  * given the dn of the object to be checked, the required access
  88  * guid is either the guid of the extended right, or NULL
  89  */
  90
  91 int dsdb_module_check_access_on_dn(struct ldb_module *module,
  92                                    TALLOC_CTX *mem_ctx,
  93                                    struct ldb_dn *dn,
  94                                    uint32_t access,
  95                                    const struct GUID *guid)
  96 {
  97         int ret;
  98         struct ldb_result *acl_res;
  99         static const char *acl_attrs[] = {
 100                 "nTSecurityDescriptor",
 101                 "objectSid",
 102                 NULL
 103         };
 104         struct ldb_context *ldb = ldb_module_get_ctx(module);
 105         struct auth_session_info *session_info
 106                 = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
 107         if(!session_info) {
 108                 return ldb_operr(ldb);
 109         }
 110         ret = dsdb_module_search_dn(module, mem_ctx, &acl_res, dn,
 111                                     acl_attrs, DSDB_SEARCH_SHOW_DELETED);
 112         if (ret != LDB_SUCCESS) {
 113                 DEBUG(10,("access_check: failed to find object %s\n", ldb_dn_get_linearized(dn)));
 114                 return ret;
 115         }
 116         return dsdb_check_access_on_dn_internal(ldb, acl_res,
 117                                                 mem_ctx,
 118                                                 session_info->security_token,
 119                                                 dn,
 120                                                 access,
 121                                                 guid);
 122 }
 123
 124
 125 static int acl_module_init(struct ldb_module *module)
 126 {
 127         struct ldb_context *ldb;
 128         struct acl_private *data;
 129         int ret, i;
 130         TALLOC_CTX *mem_ctx = talloc_new(module);
 131         static const char *attrs[] = { "passwordAttribute", NULL };
 132         struct ldb_result *res;
 133         struct ldb_message *msg;
 134         struct ldb_message_element *password_attributes;
 135
 136         ldb = ldb_module_get_ctx(module);
 137
 138         ret = ldb_mod_register_control(module, LDB_CONTROL_SD_FLAGS_OID);
 139         if (ret != LDB_SUCCESS) {
 140                 ldb_debug(ldb, LDB_DEBUG_ERROR,
 141                           "acl_module_init: Unable to register control with rootdse!\n");
 142                 return ldb_operr(ldb);
 143         }
 144
 145         data = talloc(module, struct acl_private);
 146         if (data == NULL) {
 147                 return ldb_oom(ldb);
 148         }
 149
 150         data->password_attrs = NULL;
 151         data->acl_perform = lp_parm_bool(ldb_get_opaque(ldb, "loadparm"),
 152                                          NULL, "acl", "perform", false);
 153         ldb_module_set_private(module, data);
 154
 155         if (!mem_ctx) {
 156                 return ldb_oom(ldb);
 157         }
 158
 159         ret = dsdb_module_search_dn(module, mem_ctx, &res,
 160                                     ldb_dn_new(mem_ctx, ldb, "@KLUDGEACL"),
 161                                     attrs, 0);
 162         if (ret != LDB_SUCCESS) {
 163                 goto done;
 164         }
 165         if (res->count == 0) {
 166                 goto done;
 167         }
 168
 169         if (res->count > 1) {
 170                 talloc_free(mem_ctx);
 171                 return LDB_ERR_CONSTRAINT_VIOLATION;
 172         }
 173
 174         msg = res->msgs[0];
 175
 176         password_attributes = ldb_msg_find_element(msg, "passwordAttribute");
 177         if (!password_attributes) {
 178                 goto done;
 179         }
 180         data->password_attrs = talloc_array(data, const char *, password_attributes->num_values + 1);
 181         if (!data->password_attrs) {
 182                 talloc_free(mem_ctx);
 183                 return ldb_oom(ldb);
 184         }
 185         for (i=0; i < password_attributes->num_values; i++) {
 186                 data->password_attrs[i] = (const char *)password_attributes->values[i].data;
 187                 talloc_steal(data->password_attrs, password_attributes->values[i].data);
 188         }
 189         data->password_attrs[i] = NULL;
 190
 191 done:
 192         talloc_free(mem_ctx);
 193         return ldb_next_init(module);
 194 }
 195
 196 static const struct GUID *get_oc_guid_from_message(struct ldb_module *module,
 197                                                    const struct dsdb_schema *schema,
 198                                                    struct ldb_message *msg)
 199 {
 200         struct ldb_message_element *oc_el;
 201
 202         oc_el = ldb_msg_find_element(msg, "objectClass");
 203         if (!oc_el) {
 204                 return NULL;
 205         }
 206
 207         return class_schemaid_guid_by_lDAPDisplayName(schema,
 208                                                       (char *)oc_el->values[oc_el->num_values-1].data);
 209 }
 210
 211 static int acl_check_access_on_attribute(struct ldb_module *module,
 212                                          TALLOC_CTX *mem_ctx,
 213                                          struct security_descriptor *sd,
 214                                          struct dom_sid *rp_sid,
 215                                          uint32_t access,
 216                                          const struct dsdb_attribute *attr)
 217 {
 218         int ret;
 219         NTSTATUS status;
 220         uint32_t access_granted;
 221         struct object_tree *root = NULL;
 222         struct object_tree *new_node = NULL;
 223         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 224         struct security_token *token = acl_user_token(module);
 225         if (attr) {
 226                 if (!GUID_all_zero(&attr->attributeSecurityGUID)) {
 227                         if (!insert_in_object_tree(tmp_ctx,
 228                                                    &attr->attributeSecurityGUID, access,
 229                                                    &root, &new_node)) {
 230                                 DEBUG(10, ("acl_search: cannot add to object tree securityGUID\n"));
 231                                 goto fail;
 232                         }
 233
 234                         if (!insert_in_object_tree(tmp_ctx,
 235                                                    &attr->schemaIDGUID, access, &new_node, &new_node)) {
 236                                 DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
 237                                 goto fail;
 238                         }
 239                 }
 240                 else {
 241                         if (!insert_in_object_tree(tmp_ctx,
 242                                                    &attr->schemaIDGUID, access, &root, &new_node)) {
 243                                 DEBUG(10, ("acl_search: cannot add to object tree attributeGUID\n"));
 244                                 goto fail;
 245                         }
 246                 }
 247         }
 248         status = sec_access_check_ds(sd, token,
 249                                      access,
 250                                      &access_granted,
 251                                      root,
 252                                      rp_sid);
 253         if (!NT_STATUS_IS_OK(status)) {
 254                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 255         }
 256         else {
 257                 ret = LDB_SUCCESS;
 258         }
 259         talloc_free(tmp_ctx);
 260         return ret;
 261 fail:
 262         talloc_free(tmp_ctx);
 263         return ldb_operr(ldb_module_get_ctx(module));
 264 }
 265
 266 static int acl_check_access_on_class(struct ldb_module *module,
 267                                      const struct dsdb_schema *schema,
 268                                      TALLOC_CTX *mem_ctx,
 269                                      struct security_descriptor *sd,
 270                                      struct dom_sid *rp_sid,
 271                                      uint32_t access,
 272                                      const char *class_name)
 273 {
 274         int ret;
 275         NTSTATUS status;
 276         uint32_t access_granted;
 277         struct object_tree *root = NULL;
 278         struct object_tree *new_node = NULL;
 279         const struct GUID *guid;
 280         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 281         struct security_token *token = acl_user_token(module);
 282         if (class_name) {
 283                 guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
 284                 if (!guid) {
 285                         DEBUG(10, ("acl_search: cannot find class %s\n",
 286                                    class_name));
 287                         goto fail;
 288                 }
 289                 if (!insert_in_object_tree(tmp_ctx,
 290                                            guid, access,
 291                                            &root, &new_node)) {
 292                         DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
 293                         goto fail;
 294                 }
 295         }
 296         status = sec_access_check_ds(sd, token,
 297                                      access,
 298                                      &access_granted,
 299                                      root,
 300                                      rp_sid);
 301         if (!NT_STATUS_IS_OK(status)) {
 302                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 303         }
 304         else {
 305                 ret = LDB_SUCCESS;
 306         }
 307         return ret;
 308 fail:
 309         return ldb_operr(ldb_module_get_ctx(module));
 310 }
 311
 312 static int acl_allowedAttributes(struct ldb_module *module,
 313                                  const struct dsdb_schema *schema,
 314                                  struct ldb_message *sd_msg,
 315                                  struct ldb_message *msg,
 316                                  struct acl_context *ac)
 317 {
 318         struct ldb_message_element *oc_el;
 319         struct ldb_context *ldb = ldb_module_get_ctx(module);
 320         TALLOC_CTX *mem_ctx;
 321         const char **attr_list;
 322         int i, ret;
 323
 324         /* If we don't have a schema yet, we can't do anything... */
 325         if (schema == NULL) {
 326                 ldb_asprintf_errstring(ldb, "cannot add allowedAttributes to %s because no schema is loaded", ldb_dn_get_linearized(msg->dn));
 327                 return LDB_ERR_OPERATIONS_ERROR;
 328         }
 329
 330         /* Must remove any existing attribute */
 331         if (ac->allowedAttributes) {
 332                 ldb_msg_remove_attr(msg, "allowedAttributes");
 333         }
 334
 335         mem_ctx = talloc_new(msg);
 336         if (!mem_ctx) {
 337                 return ldb_oom(ldb);
 338         }
 339
 340         oc_el = ldb_msg_find_element(sd_msg, "objectClass");
 341         attr_list = dsdb_full_attribute_list(mem_ctx, schema, oc_el, DSDB_SCHEMA_ALL);
 342         if (!attr_list) {
 343                 ldb_asprintf_errstring(ldb, "acl: Failed to get list of attributes");
 344                 talloc_free(mem_ctx);
 345                 return LDB_ERR_OPERATIONS_ERROR;
 346         }
 347         if (ac->allowedAttributes) {
 348                 for (i=0; attr_list && attr_list[i]; i++) {
 349                         ldb_msg_add_string(msg, "allowedAttributes", attr_list[i]);
 350                 }
 351         }
 352         if (ac->allowedAttributesEffective) {
 353                 struct security_descriptor *sd;
 354                 struct dom_sid *sid = NULL;
 355                 struct ldb_control *as_system = ldb_request_get_control(ac->req,
 356                                                                         LDB_CONTROL_AS_SYSTEM_OID);
 357
 358                 if (as_system != NULL) {
 359                         as_system->critical = 0;
 360                 }
 361
 362                 ldb_msg_remove_attr(msg, "allowedAttributesEffective");
 363                 if (ac->am_system || as_system) {
 364                         for (i=0; attr_list && attr_list[i]; i++) {
 365                                 ldb_msg_add_string(msg, "allowedAttributesEffective", attr_list[i]);
 366                         }
 367                         return LDB_SUCCESS;
 368                 }
 369
 370                 ret = dsdb_get_sd_from_ldb_message(ldb_module_get_ctx(module), mem_ctx, sd_msg, &sd);
 371
 372                 if (ret != LDB_SUCCESS) {
 373                         return ret;
 374                 }
 375
 376                 sid = samdb_result_dom_sid(mem_ctx, sd_msg, "objectSid");
 377                 for (i=0; attr_list && attr_list[i]; i++) {
 378                         const struct dsdb_attribute *attr = dsdb_attribute_by_lDAPDisplayName(schema,
 379                                                                                         attr_list[i]);
 380                         if (!attr) {
 381                                 return ldb_operr(ldb);
 382                         }
 383                         /* remove constructed attributes */
 384                         if (attr->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED
 385                             || attr->systemOnly
 386                             || (attr->linkID != 0 && attr->linkID % 2 != 0 )) {
 387                                 continue;
 388                         }
 389                         ret = acl_check_access_on_attribute(module,
 390                                                             msg,
 391                                                             sd,
 392                                                             sid,
 393                                                             SEC_ADS_WRITE_PROP,
 394                                                             attr);
 395                         if (ret == LDB_SUCCESS) {
 396                                 ldb_msg_add_string(msg, "allowedAttributesEffective", attr_list[i]);
 397                         }
 398                 }
 399         }
 400         return LDB_SUCCESS;
 401 }
 402
 403 static int acl_childClasses(struct ldb_module *module,
 404                             const struct dsdb_schema *schema,
 405                             struct ldb_message *sd_msg,
 406                             struct ldb_message *msg,
 407                             const char *attrName)
 408 {
 409         struct ldb_message_element *oc_el;
 410         struct ldb_message_element *allowedClasses;
 411         const struct dsdb_class *sclass;
 412         unsigned int i, j;
 413         int ret;
 414
 415         /* If we don't have a schema yet, we can't do anything... */
 416         if (schema == NULL) {
 417                 ldb_asprintf_errstring(ldb_module_get_ctx(module), "cannot add childClassesEffective to %s because no schema is loaded", ldb_dn_get_linearized(msg->dn));
 418                 return LDB_ERR_OPERATIONS_ERROR;
 419         }
 420
 421         /* Must remove any existing attribute, or else confusion reins */
 422         ldb_msg_remove_attr(msg, attrName);
 423         ret = ldb_msg_add_empty(msg, attrName, 0, &allowedClasses);
 424         if (ret != LDB_SUCCESS) {
 425                 return ret;
 426         }
 427
 428         oc_el = ldb_msg_find_element(sd_msg, "objectClass");
 429
 430         for (i=0; oc_el && i < oc_el->num_values; i++) {
 431                 sclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &oc_el->values[i]);
 432                 if (!sclass) {
 433                         /* We don't know this class?  what is going on? */
 434                         continue;
 435                 }
 436
 437                 for (j=0; sclass->possibleInferiors && sclass->possibleInferiors[j]; j++) {
 438                         ldb_msg_add_string(msg, attrName, sclass->possibleInferiors[j]);
 439                 }
 440         }
 441         if (allowedClasses->num_values > 1) {
 442                 TYPESAFE_QSORT(allowedClasses->values, allowedClasses->num_values, data_blob_cmp);
 443                 for (i=1 ; i < allowedClasses->num_values; i++) {
 444                         struct ldb_val *val1 = &allowedClasses->values[i-1];
 445                         struct ldb_val *val2 = &allowedClasses->values[i];
 446                         if (data_blob_cmp(val1, val2) == 0) {
 447                                 memmove(val1, val2, (allowedClasses->num_values - i) * sizeof(struct ldb_val));
 448                                 allowedClasses->num_values--;
 449                                 i--;
 450                         }
 451                 }
 452         }
 453
 454         return LDB_SUCCESS;
 455 }
 456
 457 static int acl_childClassesEffective(struct ldb_module *module,
 458                                      const struct dsdb_schema *schema,
 459                                      struct ldb_message *sd_msg,
 460                                      struct ldb_message *msg,
 461                                      struct acl_context *ac)
 462 {
 463         struct ldb_message_element *oc_el;
 464         struct ldb_message_element *allowedClasses = NULL;
 465         const struct dsdb_class *sclass;
 466         struct security_descriptor *sd;
 467         struct ldb_control *as_system = ldb_request_get_control(ac->req,
 468                                                                 LDB_CONTROL_AS_SYSTEM_OID);
 469         struct dom_sid *sid = NULL;
 470         unsigned int i, j;
 471         int ret;
 472
 473         if (as_system != NULL) {
 474                 as_system->critical = 0;
 475         }
 476
 477         if (ac->am_system || as_system) {
 478                 return acl_childClasses(module, schema, sd_msg, msg, "allowedChildClassesEffective");
 479         }
 480
 481         /* If we don't have a schema yet, we can't do anything... */
 482         if (schema == NULL) {
 483                 ldb_asprintf_errstring(ldb_module_get_ctx(module), "cannot add allowedChildClassesEffective to %s because no schema is loaded", ldb_dn_get_linearized(msg->dn));
 484                 return LDB_ERR_OPERATIONS_ERROR;
 485         }
 486
 487         /* Must remove any existing attribute, or else confusion reins */
 488         ldb_msg_remove_attr(msg, "allowedChildClassesEffective");
 489
 490         oc_el = ldb_msg_find_element(sd_msg, "objectClass");
 491         ret = dsdb_get_sd_from_ldb_message(ldb_module_get_ctx(module), msg, sd_msg, &sd);
 492         if (ret != LDB_SUCCESS) {
 493                 return ret;
 494         }
 495
 496         sid = samdb_result_dom_sid(msg, sd_msg, "objectSid");
 497         for (i=0; oc_el && i < oc_el->num_values; i++) {
 498                 sclass = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &oc_el->values[i]);
 499                 if (!sclass) {
 500                         /* We don't know this class?  what is going on? */
 501                         continue;
 502                 }
 503
 504                 for (j=0; sclass->possibleInferiors && sclass->possibleInferiors[j]; j++) {
 505                         ret = acl_check_access_on_class(module,
 506                                                         schema,
 507                                                         msg,
 508                                                         sd,
 509                                                         sid,
 510                                                         SEC_ADS_CREATE_CHILD,
 511                                                         sclass->possibleInferiors[j]);
 512                         if (ret == LDB_SUCCESS) {
 513                                 ldb_msg_add_string(msg, "allowedChildClassesEffective",
 514                                                    sclass->possibleInferiors[j]);
 515                         }
 516                 }
 517         }
 518         allowedClasses = ldb_msg_find_element(msg, "allowedChildClassesEffective");
 519         if (!allowedClasses) {
 520                 return LDB_SUCCESS;
 521         }
 522
 523         if (allowedClasses->num_values > 1) {
 524                 TYPESAFE_QSORT(allowedClasses->values, allowedClasses->num_values, data_blob_cmp);
 525                 for (i=1 ; i < allowedClasses->num_values; i++) {
 526                         struct ldb_val *val1 = &allowedClasses->values[i-1];
 527                         struct ldb_val *val2 = &allowedClasses->values[i];
 528                         if (data_blob_cmp(val1, val2) == 0) {
 529                                 memmove(val1, val2, (allowedClasses->num_values - i) * sizeof( struct ldb_val));
 530                                 allowedClasses->num_values--;
 531                                 i--;
 532                         }
 533                 }
 534         }
 535         return LDB_SUCCESS;
 536 }
 537
 538 static int acl_sDRightsEffective(struct ldb_module *module,
 539                                  struct ldb_message *sd_msg,
 540                                  struct ldb_message *msg,
 541                                  struct acl_context *ac)
 542 {
 543         struct ldb_message_element *rightsEffective;
 544         int ret;
 545         struct security_descriptor *sd;
 546         struct ldb_control *as_system = ldb_request_get_control(ac->req,
 547                                                                 LDB_CONTROL_AS_SYSTEM_OID);
 548         struct dom_sid *sid = NULL;
 549         uint32_t flags = 0;
 550
 551         if (as_system != NULL) {
 552                 as_system->critical = 0;
 553         }
 554
 555         /* Must remove any existing attribute, or else confusion reins */
 556         ldb_msg_remove_attr(msg, "sDRightsEffective");
 557         ret = ldb_msg_add_empty(msg, "sDRightsEffective", 0, &rightsEffective);
 558         if (ret != LDB_SUCCESS) {
 559                 return ret;
 560         }
 561         if (ac->am_system || as_system) {
 562                 flags = SECINFO_OWNER | SECINFO_GROUP |  SECINFO_SACL |  SECINFO_DACL;
 563         }
 564         else {
 565                 /* Get the security descriptor from the message */
 566                 ret = dsdb_get_sd_from_ldb_message(ldb_module_get_ctx(module), msg, sd_msg, &sd);
 567                 if (ret != LDB_SUCCESS) {
 568                         return ret;
 569                 }
 570                 sid = samdb_result_dom_sid(msg, sd_msg, "objectSid");
 571                 ret = acl_check_access_on_attribute(module,
 572                                                     msg,
 573                                                     sd,
 574                                                     sid,
 575                                                     SEC_STD_WRITE_OWNER,
 576                                                     NULL);
 577                 if (ret == LDB_SUCCESS) {
 578                         flags |= SECINFO_OWNER | SECINFO_GROUP;
 579                 }
 580                 ret = acl_check_access_on_attribute(module,
 581                                                     msg,
 582                                                     sd,
 583                                                     sid,
 584                                                     SEC_STD_WRITE_DAC,
 585                                                     NULL);
 586                 if (ret == LDB_SUCCESS) {
 587                         flags |= SECINFO_DACL;
 588                 }
 589                 ret = acl_check_access_on_attribute(module,
 590                                                     msg,
 591                                                     sd,
 592                                                     sid,
 593                                                     SEC_FLAG_SYSTEM_SECURITY,
 594                                                     NULL);
 595                 if (ret == LDB_SUCCESS) {
 596                         flags |= SECINFO_SACL;
 597                 }
 598         }
 599         ldb_msg_add_fmt(msg, "sDRightsEffective", "%u", flags);
 600         return LDB_SUCCESS;
 601 }
 602
 603 static int acl_add(struct ldb_module *module, struct ldb_request *req)
 604 {
 605         int ret;
 606         struct ldb_dn *parent = ldb_dn_get_parent(req, req->op.add.message->dn);
 607         struct ldb_context *ldb;
 608         const struct dsdb_schema *schema;
 609         struct ldb_message_element *oc_el;
 610         const struct GUID *guid;
 611         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
 612
 613         if (as_system != NULL) {
 614                 as_system->critical = 0;
 615         }
 616
 617         if (dsdb_module_am_system(module) || as_system) {
 618                 return ldb_next_request(module, req);
 619         }
 620
 621         if (ldb_dn_is_special(req->op.add.message->dn)) {
 622                 return ldb_next_request(module, req);
 623         }
 624         ldb = ldb_module_get_ctx(module);
 625         /* Creating an NC. There is probably something we should do here,
 626          * but we will establish that later */
 627         /* FIXME: this has to be made dynamic at some point */
 628         if ((ldb_dn_compare(req->op.add.message->dn, (ldb_get_schema_basedn(ldb))) == 0) ||
 629             (ldb_dn_compare(req->op.add.message->dn, (ldb_get_config_basedn(ldb))) == 0) ||
 630             (ldb_dn_compare(req->op.add.message->dn, (ldb_get_default_basedn(ldb))) == 0) ||
 631             (ldb_dn_compare(req->op.add.message->dn, (ldb_get_root_basedn(ldb))) == 0)) {
 632                 return ldb_next_request(module, req);
 633         }
 634
 635         schema = dsdb_get_schema(ldb, req);
 636         if (!schema) {
 637                 return ldb_operr(ldb);
 638         }
 639
 640         oc_el = ldb_msg_find_element(req->op.add.message, "objectClass");
 641         if (!oc_el || oc_el->num_values == 0) {
 642                 DEBUG(10,("acl:operation error %s\n", ldb_dn_get_linearized(req->op.add.message->dn)));
 643                 return ldb_module_done(req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
 644         }
 645
 646         guid = class_schemaid_guid_by_lDAPDisplayName(schema,
 647                                                       (char *)oc_el->values[oc_el->num_values-1].data);
 648         ret = dsdb_module_check_access_on_dn(module, req, parent, SEC_ADS_CREATE_CHILD, guid);
 649         if (ret != LDB_SUCCESS) {
 650                 return ret;
 651         }
 652         return ldb_next_request(module, req);
 653 }
 654
 655 /* checks for validated writes */
 656 static int acl_check_extended_right(TALLOC_CTX *mem_ctx,
 657                                     struct security_descriptor *sd,
 658                                     struct security_token *token,
 659                                     const char *ext_right,
 660                                     uint32_t right_type,
 661                                     struct dom_sid *sid)
 662 {
 663         struct GUID right;
 664         NTSTATUS status;
 665         uint32_t access_granted;
 666         struct object_tree *root = NULL;
 667         struct object_tree *new_node = NULL;
 668         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 669
 670         GUID_from_string(ext_right, &right);
 671
 672         if (!insert_in_object_tree(tmp_ctx, &right, right_type,
 673                                    &root, &new_node)) {
 674                 DEBUG(10, ("acl_ext_right: cannot add to object tree\n"));
 675                 talloc_free(tmp_ctx);
 676                 return LDB_ERR_OPERATIONS_ERROR;
 677         }
 678         status = sec_access_check_ds(sd, token,
 679                                      right_type,
 680                                      &access_granted,
 681                                      root,
 682                                      sid);
 683
 684         if (!NT_STATUS_IS_OK(status)) {
 685                 talloc_free(tmp_ctx);
 686                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 687         }
 688         talloc_free(tmp_ctx);
 689         return LDB_SUCCESS;
 690 }
 691
 692
 693 /* ckecks if modifications are allowed on "Member" attribute */
 694 static int acl_check_self_membership(TALLOC_CTX *mem_ctx,
 695                                      struct ldb_module *module,
 696                                      struct ldb_request *req,
 697                                      struct security_descriptor *sd,
 698                                      struct dom_sid *sid,
 699                                      const struct GUID *oc_guid,
 700                                      const struct dsdb_attribute *attr)
 701 {
 702         int ret;
 703         unsigned int i;
 704         struct ldb_context *ldb = ldb_module_get_ctx(module);
 705         struct ldb_dn *user_dn;
 706         struct ldb_message_element *member_el;
 707         /* if we have wp, we can do whatever we like */
 708         if (acl_check_access_on_attribute(module,
 709                                           mem_ctx,
 710                                           sd,
 711                                           sid,
 712                                           SEC_ADS_WRITE_PROP,
 713                                           attr) == LDB_SUCCESS) {
 714                 return LDB_SUCCESS;
 715         }
 716         /* if we are adding/deleting ourselves, check for self membership */
 717         ret = dsdb_find_dn_by_sid(ldb, mem_ctx, acl_user_token(module)->user_sid, &user_dn);
 718         if (ret != LDB_SUCCESS) {
 719                 return ret;
 720         }
 721         member_el = ldb_msg_find_element(req->op.mod.message, "member");
 722         if (!member_el) {
 723                 return ldb_operr(ldb);
 724         }
 725         /* user can only remove oneself */
 726         if (member_el->num_values == 0) {
 727                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 728         }
 729         for (i = 0; i < member_el->num_values; i++) {
 730                 if (strcasecmp((const char *)member_el->values[i].data,
 731                                ldb_dn_get_extended_linearized(mem_ctx, user_dn, 1)) != 0) {
 732                         return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 733                 }
 734         }
 735         ret = acl_check_extended_right(mem_ctx, sd, acl_user_token(module),
 736                                        GUID_DRS_SELF_MEMBERSHIP,
 737                                        SEC_ADS_SELF_WRITE,
 738                                        sid);
 739         if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
 740                 dsdb_acl_debug(sd, acl_user_token(module),
 741                                req->op.mod.message->dn,
 742                                true,
 743                                10);
 744         }
 745         return ret;
 746 }
 747
 748 static int acl_check_password_rights(TALLOC_CTX *mem_ctx,
 749                                      struct ldb_module *module,
 750                                      struct ldb_request *req,
 751                                      struct security_descriptor *sd,
 752                                      struct dom_sid *sid,
 753                                      const struct GUID *oc_guid)
 754 {
 755         int ret = LDB_SUCCESS;
 756         unsigned int del_attr_cnt = 0, add_attr_cnt = 0, rep_attr_cnt = 0;
 757         struct ldb_message_element *el;
 758         struct ldb_message *msg;
 759         const char *passwordAttrs[] = { "userPassword", "unicodePwd",
 760                                         "clearTextPassword", NULL }, **l;
 761         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 762
 763         msg = ldb_msg_copy_shallow(tmp_ctx, req->op.mod.message);
 764         if (msg == NULL) {
 765                 return ldb_module_oom(module);
 766         }
 767         for (l = passwordAttrs; *l != NULL; l++) {
 768                 while ((el = ldb_msg_find_element(msg, *l)) != NULL) {
 769                         if (el->flags == LDB_FLAG_MOD_DELETE) {
 770                                 ++del_attr_cnt;
 771                         }
 772                         if (el->flags == LDB_FLAG_MOD_ADD) {
 773                                 ++add_attr_cnt;
 774                         }
 775                         if (el->flags == LDB_FLAG_MOD_REPLACE) {
 776                                 ++rep_attr_cnt;
 777                         }
 778                         ldb_msg_remove_element(msg, el);
 779                 }
 780         }
 781         /* a single delete will be handled by password hash
 782            later in the stack, so we let it though here */
 783         if (del_attr_cnt > 0 && add_attr_cnt == 0) {
 784                 talloc_free(tmp_ctx);
 785                 return LDB_SUCCESS;
 786         }
 787         if (rep_attr_cnt > 0 || (add_attr_cnt != del_attr_cnt)) {
 788                 ret = acl_check_extended_right(tmp_ctx, sd, acl_user_token(module),
 789                                                GUID_DRS_FORCE_CHANGE_PASSWORD,
 790                                                SEC_ADS_CONTROL_ACCESS,
 791                                                sid);
 792         }
 793         else if (add_attr_cnt == 1 && del_attr_cnt == 1) {
 794                 ret = acl_check_extended_right(tmp_ctx, sd, acl_user_token(module),
 795                                                GUID_DRS_USER_CHANGE_PASSWORD,
 796                                                SEC_ADS_CONTROL_ACCESS,
 797                                                sid);
 798                 /* Very strange, but we get constraint violation in this case */
 799                 if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
 800                         ret = LDB_ERR_CONSTRAINT_VIOLATION;
 801                 }
 802         }
 803         if (ret != LDB_SUCCESS) {
 804                 dsdb_acl_debug(sd, acl_user_token(module),
 805                                req->op.mod.message->dn,
 806                                true,
 807                                10);
 808         }
 809         talloc_free(tmp_ctx);
 810         return ret;
 811 }
 812
 813 static int acl_modify(struct ldb_module *module, struct ldb_request *req)
 814 {
 815         int ret;
 816         struct ldb_context *ldb = ldb_module_get_ctx(module);
 817         const struct dsdb_schema *schema;
 818         unsigned int i;
 819         const struct GUID *guid;
 820         uint32_t access_granted;
 821         struct object_tree *root = NULL;
 822         struct object_tree *new_node = NULL;
 823         NTSTATUS status;
 824         struct ldb_result *acl_res;
 825         struct security_descriptor *sd;
 826         struct dom_sid *sid = NULL;
 827         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
 828         TALLOC_CTX *tmp_ctx = talloc_new(req);
 829         static const char *acl_attrs[] = {
 830                 "nTSecurityDescriptor",
 831                 "objectClass",
 832                 "objectSid",
 833                 NULL
 834         };
 835
 836         if (as_system != NULL) {
 837                 as_system->critical = 0;
 838         }
 839
 840         /* Don't print this debug statement if elements[0].name is going to be NULL */
 841         if(req->op.mod.message->num_elements > 0)
 842         {
 843                 DEBUG(10, ("ldb:acl_modify: %s\n", req->op.mod.message->elements[0].name));
 844         }
 845         if (dsdb_module_am_system(module) || as_system) {
 846                 return ldb_next_request(module, req);
 847         }
 848         if (ldb_dn_is_special(req->op.mod.message->dn)) {
 849                 return ldb_next_request(module, req);
 850         }
 851         ret = dsdb_module_search_dn(module, tmp_ctx, &acl_res, req->op.mod.message->dn,
 852                                     acl_attrs, 0);
 853
 854         if (ret != LDB_SUCCESS) {
 855                 goto fail;
 856         }
 857
 858         schema = dsdb_get_schema(ldb, tmp_ctx);
 859         if (!schema) {
 860                 ret = LDB_ERR_OPERATIONS_ERROR;
 861                 goto fail;
 862         }
 863
 864         ret = dsdb_get_sd_from_ldb_message(ldb, tmp_ctx, acl_res->msgs[0], &sd);
 865         if (ret != LDB_SUCCESS) {
 866                 DEBUG(10, ("acl_modify: cannot get descriptor\n"));
 867                 goto fail;
 868         }
 869         /* Theoretically we pass the check if the object has no sd */
 870         if (!sd) {
 871                 goto success;
 872         }
 873
 874         guid = get_oc_guid_from_message(module, schema, acl_res->msgs[0]);
 875         if (!guid) {
 876                 DEBUG(10, ("acl_modify: cannot get guid\n"));
 877                 goto fail;
 878         }
 879         sid = samdb_result_dom_sid(req, acl_res->msgs[0], "objectSid");
 880         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
 881                                    &root, &new_node)) {
 882                 DEBUG(10, ("acl_modify: cannot add to object tree\n"));
 883                 goto fail;
 884         }
 885         for (i=0; i < req->op.mod.message->num_elements; i++){
 886                 const struct dsdb_attribute *attr;
 887                 attr = dsdb_attribute_by_lDAPDisplayName(schema,
 888                                                                  req->op.mod.message->elements[i].name);
 889
 890                 if (ldb_attr_cmp("nTSecurityDescriptor", req->op.mod.message->elements[i].name) == 0) {
 891                         status = sec_access_check_ds(sd, acl_user_token(module),
 892                                              SEC_STD_WRITE_DAC,
 893                                              &access_granted,
 894                                              NULL,
 895                                              sid);
 896
 897                         if (!NT_STATUS_IS_OK(status)) {
 898                                 DEBUG(10, ("Object %s has no write dacl access\n",
 899                                            ldb_dn_get_linearized(req->op.mod.message->dn)));
 900                                 dsdb_acl_debug(sd,
 901                                                acl_user_token(module),
 902                                                req->op.mod.message->dn,
 903                                                true,
 904                                                10);
 905                                 ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 906                                 goto fail;
 907                         }
 908                 }
 909                 else if (ldb_attr_cmp("member", req->op.mod.message->elements[i].name) == 0) {
 910                         ret = acl_check_self_membership(tmp_ctx,
 911                                                         module,
 912                                                         req,
 913                                                         sd,
 914                                                         sid,
 915                                                         guid,
 916                                                         attr);
 917                         if (ret != LDB_SUCCESS) {
 918                                 goto fail;
 919                         }
 920                 }
 921                 else if (ldb_attr_cmp("dBCSPwd", req->op.mod.message->elements[i].name) == 0) {
 922                         /* this one is not affected by any rights, we should let it through
 923                            so that passwords_hash returns the correct error */
 924                         continue;
 925                 }
 926                 else if (ldb_attr_cmp("unicodePwd", req->op.mod.message->elements[i].name) == 0 ||
 927                          ldb_attr_cmp("userPassword", req->op.mod.message->elements[i].name) == 0 ||
 928                          ldb_attr_cmp("clearTextPassword", req->op.mod.message->elements[i].name) == 0) {
 929                         ret = acl_check_password_rights(tmp_ctx,
 930                                                         module,
 931                                                         req,
 932                                                         sd,
 933                                                         sid,
 934                                                         guid);
 935                         if (ret != LDB_SUCCESS) {
 936                                 goto fail;
 937                         }
 938                 } else {
 939
 940                 /* This basic attribute existence check with the right errorcode
 941                  * is needed since this module is the first one which requests
 942                  * schema attribute informations.
 943                  * The complete attribute checking is done in the
 944                  * "objectclass_attrs" module behind this one.
 945                  */
 946                         if (!attr) {
 947                                 ldb_asprintf_errstring(ldb, "acl_modify: attribute '%s' on entry '%s' was not found in the schema!",
 948                                                        req->op.mod.message->elements[i].name,
 949                                                ldb_dn_get_linearized(req->op.mod.message->dn));
 950                                 ret =  LDB_ERR_NO_SUCH_ATTRIBUTE;
 951                                 goto fail;
 952                         }
 953                         if (!insert_in_object_tree(tmp_ctx,
 954                                                    &attr->attributeSecurityGUID, SEC_ADS_WRITE_PROP,
 955                                                    &new_node, &new_node)) {
 956                                 DEBUG(10, ("acl_modify: cannot add to object tree securityGUID\n"));
 957                                 ret = LDB_ERR_OPERATIONS_ERROR;
 958                                 goto fail;
 959                         }
 960
 961                         if (!insert_in_object_tree(tmp_ctx,
 962                                                    &attr->schemaIDGUID, SEC_ADS_WRITE_PROP, &new_node, &new_node)) {
 963                                 DEBUG(10, ("acl_modify: cannot add to object tree attributeGUID\n"));
 964                                 ret = LDB_ERR_OPERATIONS_ERROR;
 965                                 goto fail;
 966                         }
 967                 }
 968         }
 969
 970         if (root->num_of_children > 0) {
 971                 status = sec_access_check_ds(sd, acl_user_token(module),
 972                                              SEC_ADS_WRITE_PROP,
 973                                              &access_granted,
 974                                              root,
 975                                              sid);
 976
 977                 if (!NT_STATUS_IS_OK(status)) {
 978                         DEBUG(10, ("Object %s has no write property access\n",
 979                                    ldb_dn_get_linearized(req->op.mod.message->dn)));
 980                         dsdb_acl_debug(sd,
 981                                   acl_user_token(module),
 982                                   req->op.mod.message->dn,
 983                                   true,
 984                                   10);
 985                         ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
 986                         goto fail;
 987                 }
 988         }
 989
 990 success:
 991         talloc_free(tmp_ctx);
 992         return ldb_next_request(module, req);
 993 fail:
 994         talloc_free(tmp_ctx);
 995         return ret;
 996 }
 997
 998 /* similar to the modify for the time being.
 999  * We need to concider the special delete tree case, though - TODO */
1000 static int acl_delete(struct ldb_module *module, struct ldb_request *req)
1001 {
1002         int ret;
1003         struct ldb_dn *parent = ldb_dn_get_parent(req, req->op.del.dn);
1004         struct ldb_context *ldb;
1005         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
1006
1007         if (as_system != NULL) {
1008                 as_system->critical = 0;
1009         }
1010
1011         DEBUG(10, ("ldb:acl_delete: %s\n", ldb_dn_get_linearized(req->op.del.dn)));
1012         if (dsdb_module_am_system(module) || as_system) {
1013                 return ldb_next_request(module, req);
1014         }
1015
1016         if (ldb_dn_is_special(req->op.del.dn)) {
1017                 return ldb_next_request(module, req);
1018         }
1019         ldb = ldb_module_get_ctx(module);
1020         /* first check if we have delete object right */
1021         ret = dsdb_module_check_access_on_dn(module, req, req->op.del.dn, SEC_STD_DELETE, NULL);
1022         if (ret == LDB_SUCCESS) {
1023                 return ldb_next_request(module, req);
1024         }
1025
1026         /* Nope, we don't have delete object. Lets check if we have delete child on the parent */
1027         /* No parent, so check fails */
1028         /* FIXME: this has to be made dynamic at some point */
1029         if ((ldb_dn_compare(req->op.del.dn, (ldb_get_schema_basedn(ldb))) == 0) ||
1030             (ldb_dn_compare(req->op.del.dn, (ldb_get_config_basedn(ldb))) == 0) ||
1031             (ldb_dn_compare(req->op.del.dn, (ldb_get_default_basedn(ldb))) == 0) ||
1032             (ldb_dn_compare(req->op.del.dn, (ldb_get_root_basedn(ldb))) == 0)) {
1033                 DEBUG(10,("acl:deleting an NC\n"));
1034                 return ldb_module_done(req, NULL, NULL, LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS);
1035         }
1036
1037         ret = dsdb_module_check_access_on_dn(module, req, parent, SEC_ADS_DELETE_CHILD, NULL);
1038         if (ret != LDB_SUCCESS) {
1039                 return ret;
1040         }
1041         return ldb_next_request(module, req);
1042 }
1043
1044 static int acl_rename(struct ldb_module *module, struct ldb_request *req)
1045 {
1046         int ret;
1047         struct ldb_dn *oldparent = ldb_dn_get_parent(req, req->op.rename.olddn);
1048         struct ldb_dn *newparent = ldb_dn_get_parent(req, req->op.rename.newdn);
1049         const struct dsdb_schema *schema;
1050         struct ldb_context *ldb;
1051         struct security_descriptor *sd = NULL;
1052         struct dom_sid *sid = NULL;
1053         struct ldb_result *acl_res;
1054         const struct GUID *guid;
1055         struct object_tree *root = NULL;
1056         struct object_tree *new_node = NULL;
1057         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
1058         TALLOC_CTX *tmp_ctx = talloc_new(req);
1059         NTSTATUS status;
1060         uint32_t access_granted;
1061         const char *rdn_name;
1062         static const char *acl_attrs[] = {
1063                 "nTSecurityDescriptor",
1064                 "objectClass",
1065                 "objectSid",
1066                 NULL
1067         };
1068
1069         if (as_system != NULL) {
1070                 as_system->critical = 0;
1071         }
1072
1073         DEBUG(10, ("ldb:acl_rename: %s\n", ldb_dn_get_linearized(req->op.rename.olddn)));
1074         if (dsdb_module_am_system(module) || as_system) {
1075                 return ldb_next_request(module, req);
1076         }
1077         if (ldb_dn_is_special(req->op.rename.olddn)) {
1078                 return ldb_next_request(module, req);
1079         }
1080         ldb = ldb_module_get_ctx(module);
1081
1082         ret = dsdb_module_search_dn(module, req, &acl_res, req->op.rename.olddn,
1083                                     acl_attrs, DSDB_SEARCH_SHOW_DELETED);
1084         /* we sould be able to find the parent */
1085         if (ret != LDB_SUCCESS) {
1086                 DEBUG(10,("acl: failed to find object %s\n",
1087                           ldb_dn_get_linearized(req->op.rename.olddn)));
1088                 return ret;
1089         }
1090
1091         schema = dsdb_get_schema(ldb, acl_res);
1092         if (!schema) {
1093                 talloc_free(acl_res);
1094                 return ldb_operr(ldb);
1095         }
1096
1097         guid = get_oc_guid_from_message(module, schema, acl_res->msgs[0]);
1098         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
1099                                    &root, &new_node)) {
1100                 return ldb_operr(ldb);
1101         };
1102
1103         guid = attribute_schemaid_guid_by_lDAPDisplayName(schema,
1104                                                           "name");
1105         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
1106                                    &new_node, &new_node)) {
1107                 return ldb_operr(ldb);
1108         };
1109
1110         rdn_name = ldb_dn_get_rdn_name(req->op.rename.olddn);
1111         if (rdn_name == NULL) {
1112                 return ldb_operr(ldb);
1113         }
1114         guid = attribute_schemaid_guid_by_lDAPDisplayName(schema,
1115                                                           rdn_name);
1116         if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
1117                                    &new_node, &new_node)) {
1118                 return ldb_operr(ldb);
1119         };
1120
1121         ret = dsdb_get_sd_from_ldb_message(ldb, req, acl_res->msgs[0], &sd);
1122
1123         if (ret != LDB_SUCCESS) {
1124                 return ldb_operr(ldb);
1125         }
1126         /* Theoretically we pass the check if the object has no sd */
1127         if (!sd) {
1128                 return LDB_SUCCESS;
1129         }
1130         sid = samdb_result_dom_sid(req, acl_res->msgs[0], "objectSid");
1131         status = sec_access_check_ds(sd, acl_user_token(module),
1132                                      SEC_ADS_WRITE_PROP,
1133                                      &access_granted,
1134                                      root,
1135                                      sid);
1136
1137         if (!NT_STATUS_IS_OK(status)) {
1138                 DEBUG(10, ("Object %s has no wp on name\n",
1139                            ldb_dn_get_linearized(req->op.rename.olddn)));
1140                 dsdb_acl_debug(sd,
1141                           acl_user_token(module),
1142                           req->op.rename.olddn,
1143                           true,
1144                           10);
1145                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
1146         }
1147
1148         if (ldb_dn_compare(oldparent, newparent) == 0) {
1149                 /* regular rename, not move, nothing more to do */
1150                 return ldb_next_request(module, req);
1151         }
1152
1153         /* What exactly to do in this case? It would fail anyway.. */
1154         /* FIXME: this has to be made dynamic at some point */
1155         if ((ldb_dn_compare(req->op.rename.newdn, (ldb_get_schema_basedn(ldb))) == 0) ||
1156             (ldb_dn_compare(req->op.rename.newdn, (ldb_get_config_basedn(ldb))) == 0) ||
1157             (ldb_dn_compare(req->op.rename.newdn, (ldb_get_default_basedn(ldb))) == 0) ||
1158             (ldb_dn_compare(req->op.rename.newdn, (ldb_get_root_basedn(ldb))) == 0)) {
1159                 DEBUG(10,("acl:moving as an NC\n"));
1160                 return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
1161         }
1162         /* new parent should have create child */
1163         talloc_free(tmp_ctx);
1164         tmp_ctx = talloc_new(req);
1165         root = NULL;
1166         new_node = NULL;
1167         guid = get_oc_guid_from_message(module, schema, acl_res->msgs[0]);
1168         if (!guid) {
1169                 DEBUG(10,("acl:renamed object has no object class\n"));
1170                 return ldb_module_done(req, NULL, NULL,  LDB_ERR_OPERATIONS_ERROR);
1171         }
1172
1173         ret = dsdb_module_check_access_on_dn(module, req, newparent, SEC_ADS_CREATE_CHILD, guid);
1174         if (ret != LDB_SUCCESS) {
1175                 DEBUG(10,("acl:access_denied renaming %s", ldb_dn_get_linearized(req->op.rename.olddn)));
1176                 return ret;
1177         }
1178         /* do we have delete object on the object? */
1179
1180         status = sec_access_check_ds(sd, acl_user_token(module),
1181                                      SEC_STD_DELETE,
1182                                      &access_granted,
1183                                      NULL,
1184                                      sid);
1185
1186         if (NT_STATUS_IS_OK(status)) {
1187                 return ldb_next_request(module, req);
1188         }
1189         /* what about delete child on the current parent */
1190         ret = dsdb_module_check_access_on_dn(module, req, oldparent, SEC_ADS_DELETE_CHILD, NULL);
1191         if (ret != LDB_SUCCESS) {
1192                 DEBUG(10,("acl:access_denied renaming %s", ldb_dn_get_linearized(req->op.rename.olddn)));
1193                 return ldb_module_done(req, NULL, NULL, ret);
1194         }
1195         return ldb_next_request(module, req);
1196 }
1197
1198 static int acl_search_callback(struct ldb_request *req, struct ldb_reply *ares)
1199 {
1200         struct ldb_context *ldb;
1201         struct acl_context *ac;
1202         struct acl_private *data;
1203         struct ldb_result *acl_res;
1204         static const char *acl_attrs[] = {
1205                 "objectClass",
1206                 "nTSecurityDescriptor",
1207                 "objectSid",
1208                 NULL
1209         };
1210         int ret, i;
1211
1212         ac = talloc_get_type(req->context, struct acl_context);
1213         data = talloc_get_type(ldb_module_get_private(ac->module), struct acl_private);
1214         ldb = ldb_module_get_ctx(ac->module);
1215
1216         if (!ares) {
1217                 return ldb_module_done(ac->req, NULL, NULL,
1218                                        LDB_ERR_OPERATIONS_ERROR);
1219         }
1220         if (ares->error != LDB_SUCCESS) {
1221                 return ldb_module_done(ac->req, ares->controls,
1222                                        ares->response, ares->error);
1223         }
1224
1225         switch (ares->type) {
1226         case LDB_REPLY_ENTRY:
1227                 if (ac->allowedAttributes
1228                     || ac->allowedChildClasses
1229                     || ac->allowedChildClassesEffective
1230                     || ac->allowedAttributesEffective
1231                     || ac->sDRightsEffective) {
1232                         ret = dsdb_module_search_dn(ac->module, ac, &acl_res, ares->message->dn,
1233                                                     acl_attrs, 0);
1234                         if (ret != LDB_SUCCESS) {
1235                                 return ldb_module_done(ac->req, NULL, NULL, ret);
1236                         }
1237                         if (ac->allowedAttributes || ac->allowedAttributesEffective) {
1238                                 ret = acl_allowedAttributes(ac->module, ac->schema, acl_res->msgs[0], ares->message, ac);
1239                                 if (ret != LDB_SUCCESS) {
1240                                         return ldb_module_done(ac->req, NULL, NULL, ret);
1241                                 }
1242                         }
1243                         if (ac->allowedChildClasses) {
1244                                 ret = acl_childClasses(ac->module, ac->schema, acl_res->msgs[0],
1245                                                        ares->message, "allowedChildClasses");
1246                                 if (ret != LDB_SUCCESS) {
1247                                         return ldb_module_done(ac->req, NULL, NULL, ret);
1248                                 }
1249                         }
1250                         if (ac->allowedChildClassesEffective) {
1251                                 ret = acl_childClassesEffective(ac->module, ac->schema,
1252                                                                 acl_res->msgs[0], ares->message, ac);
1253                                 if (ret != LDB_SUCCESS) {
1254                                         return ldb_module_done(ac->req, NULL, NULL, ret);
1255                                 }
1256                         }
1257                         if (ac->sDRightsEffective) {
1258                                 ret = acl_sDRightsEffective(ac->module,
1259                                                             acl_res->msgs[0], ares->message, ac);
1260                                 if (ret != LDB_SUCCESS) {
1261                                         return ldb_module_done(ac->req, NULL, NULL, ret);
1262                                 }
1263                         }
1264                 }
1265                 if (data && data->password_attrs) {
1266                         if (!ac->am_system) {
1267                                 for (i = 0; data->password_attrs[i]; i++) {
1268                                         ldb_msg_remove_attr(ares->message, data->password_attrs[i]);
1269                                 }
1270                         }
1271                 }
1272                 return ldb_module_send_entry(ac->req, ares->message, ares->controls);
1273
1274         case LDB_REPLY_REFERRAL:
1275                 return ldb_module_send_referral(ac->req, ares->referral);
1276
1277         case LDB_REPLY_DONE:
1278                 return ldb_module_done(ac->req, ares->controls,
1279                                        ares->response, LDB_SUCCESS);
1280
1281         }
1282         return LDB_SUCCESS;
1283 }
1284
1285 static int acl_search(struct ldb_module *module, struct ldb_request *req)
1286 {
1287         struct ldb_context *ldb;
1288         struct acl_context *ac;
1289         struct ldb_request *down_req;
1290         struct acl_private *data;
1291         int ret, i;
1292
1293         ldb = ldb_module_get_ctx(module);
1294
1295         ac = talloc_zero(req, struct acl_context);
1296         if (ac == NULL) {
1297                 return ldb_oom(ldb);
1298         }
1299         data = talloc_get_type(ldb_module_get_private(module), struct acl_private);
1300
1301         ac->module = module;
1302         ac->req = req;
1303         ac->am_system = dsdb_module_am_system(module);
1304         ac->allowedAttributes = ldb_attr_in_list(req->op.search.attrs, "allowedAttributes");
1305         ac->allowedAttributesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedAttributesEffective");
1306         ac->allowedChildClasses = ldb_attr_in_list(req->op.search.attrs, "allowedChildClasses");
1307         ac->allowedChildClassesEffective = ldb_attr_in_list(req->op.search.attrs, "allowedChildClassesEffective");
1308         ac->sDRightsEffective = ldb_attr_in_list(req->op.search.attrs, "sDRightsEffective");
1309         ac->schema = dsdb_get_schema(ldb, ac);
1310
1311         /* replace any attributes in the parse tree that are private,
1312            so we don't allow a search for 'userPassword=penguin',
1313            just as we would not allow that attribute to be returned */
1314         if (ac->am_system) {
1315                 /* FIXME: We should copy the tree and keep the original unmodified. */
1316                 /* remove password attributes */
1317                 if (data && data->password_attrs) {
1318                         for (i = 0; data->password_attrs[i]; i++) {
1319                                 ldb_parse_tree_attr_replace(req->op.search.tree,
1320                                                             data->password_attrs[i],
1321                                                             "kludgeACLredactedattribute");
1322                         }
1323                 }
1324         }
1325         ret = ldb_build_search_req_ex(&down_req,
1326                                       ldb, ac,
1327                                       req->op.search.base,
1328                                       req->op.search.scope,
1329                                       req->op.search.tree,
1330                                       req->op.search.attrs,
1331                                       req->controls,
1332                                       ac, acl_search_callback,
1333                                       req);
1334         if (ret != LDB_SUCCESS) {
1335                 return ret;
1336         }
1337         /* perform the search */
1338         return ldb_next_request(module, down_req);
1339 }
1340
1341 _PUBLIC_ const struct ldb_module_ops ldb_acl_module_ops = {
1342         .name              = "acl",
1343         .search            = acl_search,
1344         .add               = acl_add,
1345         .modify            = acl_modify,
1346         .del               = acl_delete,
1347         .rename            = acl_rename,
1348         .init_context      = acl_module_init
1349 };