source4/dsdb/samdb/ldb_modules/acl_read.c

   1 /*
   2   ldb database library
   3
   4   Copyright (C) Simo Sorce 2006-2008
   5   Copyright (C) Nadezhda Ivanova 2010
   6
   7   This program is free software; you can redistribute it and/or modify
   8   it under the terms of the GNU General Public License as published by
   9   the Free Software Foundation; either version 3 of the License, or
  10   (at your option) any later version.
  11
  12   This program is distributed in the hope that it will be useful,
  13   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15   GNU General Public License for more details.
  16
  17   You should have received a copy of the GNU General Public License
  18   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 /*
  22  *  Name: ldb
  23  *
  24  *  Component: ldb ACL Read module
  25  *
  26  *  Description: Module that performs authorisation access checks on read requests
  27  *               Only DACL checks implemented at this point
  28  *
  29  *  Author: Nadezhda Ivanova
  30  */
  31
  32 #include "includes.h"
  33 #include "ldb_module.h"
  34 #include "auth/auth.h"
  35 #include "libcli/security/security.h"
  36 #include "dsdb/samdb/samdb.h"
  37 #include "librpc/gen_ndr/ndr_security.h"
  38 #include "param/param.h"
  39 #include "dsdb/samdb/ldb_modules/util.h"
  40
  41
  42 struct aclread_context {
  43         struct ldb_module *module;
  44         struct ldb_request *req;
  45         const char * const *attrs;
  46         const struct dsdb_schema *schema;
  47         bool sd;
  48         bool instance_type;
  49         bool object_sid;
  50 };
  51
  52 struct aclread_private {
  53         bool enabled;
  54 };
  55
  56 static int aclread_callback(struct ldb_request *req, struct ldb_reply *ares)
  57 {
  58          struct ldb_context *ldb;
  59          struct aclread_context *ac;
  60          struct ldb_result *acl_res;
  61          struct ldb_message_element *parent;
  62          static const char *acl_attrs[] = {
  63                  "nTSecurityDescriptor",
  64                  "objectSid",
  65                  "insyanceType",
  66                  NULL
  67          };
  68          int ret;
  69          unsigned int i;
  70          struct security_descriptor *sd;
  71          struct dom_sid *sid = NULL;
  72          TALLOC_CTX *tmp_ctx;
  73          uint32_t instanceType;
  74
  75          ac = talloc_get_type(req->context, struct aclread_context);
  76          ldb = ldb_module_get_ctx(ac->module);
  77          if (!ares) {
  78                  return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR );
  79          }
  80          if (ares->error != LDB_SUCCESS) {
  81                  return ldb_module_done(ac->req, ares->controls,
  82                                         ares->response, ares->error);
  83          }
  84          tmp_ctx = talloc_new(ac);
  85          switch (ares->type) {
  86          case LDB_REPLY_ENTRY:
  87                  ret = dsdb_get_sd_from_ldb_message(ldb, tmp_ctx, ares->message, &sd);
  88                  if (ret != LDB_SUCCESS) {
  89                          DEBUG(10, ("acl_read: cannot get descriptor\n"));
  90                          ret = LDB_ERR_OPERATIONS_ERROR;
  91                          goto fail;
  92                  }
  93                  sid = samdb_result_dom_sid(tmp_ctx, ares->message, "objectSid");
  94                  /* get the object instance type */
  95                  instanceType = ldb_msg_find_attr_as_uint(ares->message,
  96                                                          "instanceType", 0);
  97                  if (!ldb_dn_is_null(ares->message->dn) && !(instanceType & INSTANCE_TYPE_IS_NC_HEAD))
  98                  {
  99                         /* the object has a parent, so we have to check for visibility */
 100                         struct ldb_dn *parent_dn = ldb_dn_get_parent(tmp_ctx, ares->message->dn);
 101                         ret = dsdb_module_check_access_on_dn(ac->module,
 102                                                              tmp_ctx,
 103                                                              parent_dn,
 104                                                              SEC_ADS_LIST,
 105                                                              NULL);
 106                         if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
 107                                 talloc_free(tmp_ctx);
 108                                 return LDB_SUCCESS;
 109                         } else if (ret != LDB_SUCCESS) {
 110                                 goto fail;
 111                         }
 112                  }
 113                  /* for every element in the message check RP */
 114                  i = 0;
 115                  while (i < ares->message->num_elements) {
 116                          const struct dsdb_attribute *attr;
 117                          attr =  dsdb_attribute_by_lDAPDisplayName(ac->schema,
 118                                                                    ares->message->elements[i].name);
 119                          if (!attr) {
 120                                  DEBUG(2, ("acl_read: cannot find attribute %s in schema\n",
 121                                            ares->message->elements[i].name));
 122                                  ret = LDB_ERR_OPERATIONS_ERROR;
 123                                  goto fail;
 124                          }
 125                          /* nTSecurityDescriptor is a special case */
 126                          if (ldb_attr_cmp("nTSecurityDescriptor",
 127                                           ares->message->elements[i].name) == 0) {
 128                                  if (ac->sd) {
 129                                          ldb_msg_remove_attr(ares->message, ares->message->elements[i].name);
 130                                          ret = LDB_SUCCESS;
 131                                  }
 132                                  ret = acl_check_access_on_attribute(ac->module,
 133                                                                      tmp_ctx,
 134                                                                      sd,
 135                                                                      sid,
 136                                                                      SEC_FLAG_SYSTEM_SECURITY|SEC_STD_READ_CONTROL,
 137                                                                      attr);
 138                          } else {
 139                                  ret = acl_check_access_on_attribute(ac->module,
 140                                                                      tmp_ctx,
 141                                                                      sd,
 142                                                                      sid,
 143                                                                      SEC_ADS_READ_PROP,
 144                                                                      attr);
 145                          }
 146                          if (ret == LDB_SUCCESS) {
 147                                  i++;
 148                          } else if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
 149                                  /* do not return this entry if attribute is
 150                                             part of the search filter */
 151                                  if (dsdb_attr_in_parse_tree(ac->req->op.search.tree,
 152                                                              ares->message->elements[i].name)) {
 153                                          talloc_free(tmp_ctx);
 154                                          return LDB_SUCCESS;
 155                                  }
 156                                  ldb_msg_remove_attr(ares->message, ares->message->elements[i].name);
 157                          } else {
 158                                  goto fail;
 159                          }
 160                  }
 161                  if (ac->instance_type) {
 162                          ldb_msg_remove_attr(ares->message, "instanceType");
 163                  }
 164                  if (ac->object_sid) {
 165                          ldb_msg_remove_attr(ares->message, "objectSid");
 166                  }
 167                  talloc_free(tmp_ctx);
 168                  return ldb_module_send_entry(ac->req, ares->message, ares->controls);
 169          case LDB_REPLY_REFERRAL:
 170                  return ldb_module_send_referral(ac->req, ares->referral);
 171          case LDB_REPLY_DONE:
 172                  return ldb_module_done(ac->req, ares->controls,
 173                                         ares->response, LDB_SUCCESS);
 174
 175          }
 176          return LDB_SUCCESS;
 177 fail:
 178          talloc_free(tmp_ctx);
 179          return ldb_module_done(ac->req, NULL, NULL, ret);
 180 }
 181
 182
 183 static int aclread_search(struct ldb_module *module, struct ldb_request *req)
 184 {
 185         struct ldb_context *ldb;
 186         int ret;
 187         struct aclread_context *ac;
 188         struct ldb_request *down_req;
 189         struct ldb_control *as_system = ldb_request_get_control(req, LDB_CONTROL_AS_SYSTEM_OID);
 190         struct ldb_result *res;
 191         struct aclread_private *p;
 192         bool is_untrusted = ldb_req_is_untrusted(req);
 193         const char * const *attrs = NULL;
 194         uint32_t instanceType;
 195         static const char *acl_attrs[] = {
 196                  "instanceType",
 197                  NULL
 198         };
 199
 200         ldb = ldb_module_get_ctx(module);
 201         p = talloc_get_type(ldb_module_get_private(module), struct aclread_private);
 202
 203         /* skip access checks if we are system or system control is supplied
 204          * or this is not LDAP server request */
 205         if (!p || !p->enabled ||
 206             dsdb_module_am_system(module)
 207             || as_system || !is_untrusted) {
 208                 return ldb_next_request(module, req);
 209         }
 210         /* no checks on special dn */
 211         if (ldb_dn_is_special(req->op.search.base)) {
 212                 return ldb_next_request(module, req);
 213         }
 214
 215         /* check accessibility of base */
 216         if (!ldb_dn_is_null(req->op.search.base)) {
 217                 ret = dsdb_module_search_dn(module, req, &res, req->op.search.base,
 218                                             acl_attrs,
 219                                             DSDB_FLAG_NEXT_MODULE |
 220                                             DSDB_SEARCH_SHOW_DELETED);
 221                 if (ret != LDB_SUCCESS) {
 222                         return ldb_error(ldb, ret,
 223                                          "acl_read: Error retrieving instanceType for base.");
 224                 }
 225                 instanceType = ldb_msg_find_attr_as_uint(res->msgs[0],
 226                                                          "instanceType", 0);
 227                 if (instanceType != 0 && !(instanceType & INSTANCE_TYPE_IS_NC_HEAD))
 228                 {
 229                         /* the object has a parent, so we have to check for visibility */
 230                         struct ldb_dn *parent_dn = ldb_dn_get_parent(req, req->op.search.base);
 231                         ret = dsdb_module_check_access_on_dn(module,
 232                                                              req,
 233                                                              parent_dn,
 234                                                              SEC_ADS_LIST,
 235                                                              NULL);
 236                         if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
 237                                 return ldb_module_done(req, NULL, NULL, LDB_ERR_NO_SUCH_OBJECT);
 238                         } else if (ret != LDB_SUCCESS) {
 239                                 return ldb_module_done(req, NULL, NULL, ret);
 240                         }
 241                 }
 242         }
 243         ac = talloc_zero(req, struct aclread_context);
 244         if (ac == NULL) {
 245                 return ldb_oom(ldb);
 246         }
 247         ac->module = module;
 248         ac->req = req;
 249         ac->schema = dsdb_get_schema(ldb, req);
 250         if (!ac->schema) {
 251                 return ldb_operr(ldb);
 252         }
 253         ac->sd = !(ldb_attr_in_list(req->op.search.attrs, "nTSecurityDescriptor"));
 254         if (req->op.search.attrs && !ldb_attr_in_list(req->op.search.attrs, "*")) {
 255                 if (!ldb_attr_in_list(req->op.search.attrs, "instanceType")) {
 256                         ac->instance_type = true;
 257                         attrs = ldb_attr_list_copy_add(ac, req->op.search.attrs, "instanceType");
 258                 } else {
 259                         attrs = req->op.search.attrs;
 260                 }
 261                 if (!ldb_attr_in_list(req->op.search.attrs, "objectSid")) {
 262                         ac->object_sid = true;
 263                         attrs = ldb_attr_list_copy_add(ac, attrs, "objectSid");
 264                 }
 265         }
 266
 267         if (ac->sd) {
 268                 /* avoid replacing all attributes with nTSecurityDescriptor
 269                  * if attribute list is empty */
 270                 if (!attrs) {
 271                         attrs = ldb_attr_list_copy_add(ac, attrs, "*");
 272                 }
 273                 attrs = ldb_attr_list_copy_add(ac, attrs, "nTSecurityDescriptor");
 274         }
 275         ac->attrs = req->op.search.attrs;
 276         ret = ldb_build_search_req_ex(&down_req,
 277                                       ldb, ac,
 278                                       req->op.search.base,
 279                                       req->op.search.scope,
 280                                       req->op.search.tree,
 281                                       attrs,
 282                                       req->controls,
 283                                       ac, aclread_callback,
 284                                       req);
 285
 286         if (ret != LDB_SUCCESS) {
 287                 return LDB_ERR_OPERATIONS_ERROR;
 288         }
 289
 290         return ldb_next_request(module, down_req);
 291 }
 292
 293 static int aclread_init(struct ldb_module *module)
 294 {
 295         struct ldb_context *ldb = ldb_module_get_ctx(module);
 296         struct aclread_private *p = talloc_zero(module, struct aclread_private);
 297         if (p == NULL) {
 298                 return ldb_module_oom(module);
 299         }
 300         p->enabled = lpcfg_parm_bool(ldb_get_opaque(ldb, "loadparm"), NULL, "acl", "search", false);
 301         ldb_module_set_private(module, p);
 302         return ldb_next_init(module);
 303 }
 304
 305 static const struct ldb_module_ops ldb_aclread_module_ops = {
 306         .name              = "aclread",
 307         .search            = aclread_search,
 308         .init_context      = aclread_init
 309 };
 310
 311 int ldb_aclread_module_init(const char *version)
 312 {
 313         LDB_MODULE_CHECK_VERSION(version);
 314         return ldb_register_module(&ldb_aclread_module_ops);
 315 }