4 Copyright (C) Simo Sorce 2006-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2007
6 Copyright (C) Nadezhda Ivanova 2009
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 * Component: DS Security descriptor module
28 * - Calculate the security descriptor of a newly created object
29 * - Perform sd recalculation on a move operation
30 * - Handle sd modification invariants
32 * Author: Nadezhda Ivanova
36 #include "ldb_module.h"
37 #include "dlinklist.h"
38 #include "dsdb/samdb/samdb.h"
39 #include "librpc/ndr/libndr.h"
40 #include "librpc/gen_ndr/ndr_security.h"
41 #include "libcli/security/security.h"
42 #include "auth/auth.h"
43 #include "param/param.h"
46 struct descriptor_data {
50 struct descriptor_context {
51 struct ldb_module *module;
52 struct ldb_request *req;
53 struct ldb_reply *search_res;
54 struct ldb_reply *search_oc_res;
55 struct ldb_val *parentsd_val;
56 struct ldb_val *sd_val;
57 int (*step_fn)(struct descriptor_context *);
60 struct dom_sid *get_default_ag(TALLOC_CTX *mem_ctx,
62 struct security_token *token,
63 struct ldb_context *ldb)
65 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
66 struct ldb_dn *root_base_dn = ldb_get_root_basedn(ldb);
67 struct ldb_dn *schema_base_dn = ldb_get_schema_basedn(ldb);
68 struct ldb_dn *config_base_dn = ldb_get_config_basedn(ldb);
69 const struct dom_sid *domain_sid = samdb_domain_sid(ldb);
70 struct dom_sid *da_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_ADMINS);
71 struct dom_sid *ea_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_ENTERPRISE_ADMINS);
72 struct dom_sid *sa_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_SCHEMA_ADMINS);
73 struct dom_sid *dag_sid;
75 if (ldb_dn_compare_base(schema_base_dn, dn) == 0){
76 if (security_token_has_sid(token, sa_sid))
77 dag_sid = dom_sid_dup(mem_ctx, sa_sid);
78 else if (security_token_has_sid(token, ea_sid))
79 dag_sid = dom_sid_dup(mem_ctx, ea_sid);
80 else if (security_token_has_sid(token, da_sid))
81 dag_sid = dom_sid_dup(mem_ctx, da_sid);
85 else if (ldb_dn_compare_base(config_base_dn, dn) == 0){
86 if (security_token_has_sid(token, ea_sid))
87 dag_sid = dom_sid_dup(mem_ctx, ea_sid);
88 else if (security_token_has_sid(token, da_sid))
89 dag_sid = dom_sid_dup(mem_ctx, da_sid);
93 else if (ldb_dn_compare_base(root_base_dn, dn) == 0){
94 if (security_token_has_sid(token, da_sid))
95 dag_sid = dom_sid_dup(mem_ctx, da_sid);
96 else if (security_token_has_sid(token, ea_sid))
97 dag_sid = dom_sid_dup(mem_ctx, ea_sid);
104 talloc_free(tmp_ctx);
108 static struct security_descriptor *get_sd_unpacked(struct ldb_module *module, TALLOC_CTX *mem_ctx,
109 const struct dsdb_class *objectclass)
111 struct ldb_context *ldb = ldb_module_get_ctx(module);
112 struct security_descriptor *sd;
113 const struct dom_sid *domain_sid = samdb_domain_sid(ldb);
115 if (!objectclass->defaultSecurityDescriptor || !domain_sid) {
119 sd = sddl_decode(mem_ctx,
120 objectclass->defaultSecurityDescriptor,
125 static struct dom_sid *get_default_group(TALLOC_CTX *mem_ctx,
126 struct ldb_context *ldb,
129 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008) {
136 static struct security_descriptor *descr_handle_sd_flags(TALLOC_CTX *mem_ctx,
137 struct security_descriptor *new_sd,
138 struct security_descriptor *old_sd,
141 struct security_descriptor *final_sd;
142 /* if there is no control or control == 0 modify everything */
147 final_sd = talloc_zero(mem_ctx, struct security_descriptor);
148 final_sd->revision = SECURITY_DESCRIPTOR_REVISION_1;
149 final_sd->type = SEC_DESC_SELF_RELATIVE;
151 if (sd_flags & (SECINFO_OWNER)) {
152 final_sd->owner_sid = talloc_memdup(mem_ctx, new_sd->owner_sid, sizeof(struct dom_sid));
153 final_sd->type |= new_sd->type & SEC_DESC_OWNER_DEFAULTED;
156 final_sd->owner_sid = talloc_memdup(mem_ctx, old_sd->owner_sid, sizeof(struct dom_sid));
157 final_sd->type |= old_sd->type & SEC_DESC_OWNER_DEFAULTED;
160 if (sd_flags & (SECINFO_GROUP)) {
161 final_sd->group_sid = talloc_memdup(mem_ctx, new_sd->group_sid, sizeof(struct dom_sid));
162 final_sd->type |= new_sd->type & SEC_DESC_GROUP_DEFAULTED;
165 final_sd->group_sid = talloc_memdup(mem_ctx, old_sd->group_sid, sizeof(struct dom_sid));
166 final_sd->type |= old_sd->type & SEC_DESC_GROUP_DEFAULTED;
169 if (sd_flags & (SECINFO_SACL)) {
170 final_sd->sacl = security_acl_dup(mem_ctx,new_sd->sacl);
171 final_sd->type |= new_sd->type & (SEC_DESC_SACL_PRESENT |
172 SEC_DESC_SACL_DEFAULTED|SEC_DESC_SACL_AUTO_INHERIT_REQ |
173 SEC_DESC_SACL_AUTO_INHERITED|SEC_DESC_SACL_PROTECTED |
174 SEC_DESC_SERVER_SECURITY);
177 final_sd->sacl = security_acl_dup(mem_ctx,old_sd->sacl);
178 final_sd->type |= old_sd->type & (SEC_DESC_SACL_PRESENT |
179 SEC_DESC_SACL_DEFAULTED|SEC_DESC_SACL_AUTO_INHERIT_REQ |
180 SEC_DESC_SACL_AUTO_INHERITED|SEC_DESC_SACL_PROTECTED |
181 SEC_DESC_SERVER_SECURITY);
184 if (sd_flags & (SECINFO_DACL)) {
185 final_sd->dacl = security_acl_dup(mem_ctx,new_sd->dacl);
186 final_sd->type |= new_sd->type & (SEC_DESC_DACL_PRESENT |
187 SEC_DESC_DACL_DEFAULTED|SEC_DESC_DACL_AUTO_INHERIT_REQ |
188 SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_PROTECTED |
189 SEC_DESC_DACL_TRUSTED);
192 final_sd->dacl = security_acl_dup(mem_ctx,old_sd->dacl);
193 final_sd->type |= old_sd->type & (SEC_DESC_DACL_PRESENT |
194 SEC_DESC_DACL_DEFAULTED|SEC_DESC_DACL_AUTO_INHERIT_REQ |
195 SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_PROTECTED |
196 SEC_DESC_DACL_TRUSTED);
198 /* not so sure about this */
199 final_sd->type |= new_sd->type & SEC_DESC_RM_CONTROL_VALID;
203 static DATA_BLOB *get_new_descriptor(struct ldb_module *module,
206 const struct dsdb_class *objectclass,
207 const struct ldb_val *parent,
208 struct ldb_val *object,
209 struct ldb_val *old_sd,
212 struct security_descriptor *user_descriptor = NULL, *parent_descriptor = NULL;
213 struct security_descriptor *old_descriptor = NULL;
214 struct security_descriptor *new_sd, *final_sd;
215 DATA_BLOB *linear_sd;
216 enum ndr_err_code ndr_err;
217 struct ldb_context *ldb = ldb_module_get_ctx(module);
218 struct auth_session_info *session_info
219 = ldb_get_opaque(ldb, "sessionInfo");
220 const struct dom_sid *domain_sid = samdb_domain_sid(ldb);
222 struct dom_sid *default_owner;
223 struct dom_sid *default_group;
226 user_descriptor = talloc(mem_ctx, struct security_descriptor);
227 if (!user_descriptor) {
230 ndr_err = ndr_pull_struct_blob(object, user_descriptor, NULL,
232 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
234 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
235 talloc_free(user_descriptor);
239 user_descriptor = get_sd_unpacked(module, mem_ctx, objectclass);
243 old_descriptor = talloc(mem_ctx, struct security_descriptor);
244 if (!old_descriptor) {
247 ndr_err = ndr_pull_struct_blob(old_sd, old_descriptor, NULL,
249 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
251 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
252 talloc_free(old_descriptor);
258 parent_descriptor = talloc(mem_ctx, struct security_descriptor);
259 if (!parent_descriptor) {
262 ndr_err = ndr_pull_struct_blob(parent, parent_descriptor, NULL,
264 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
266 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
267 talloc_free(parent_descriptor);
272 default_owner = get_default_ag(mem_ctx, dn,
273 session_info->security_token, ldb);
274 default_group = get_default_group(mem_ctx, ldb, default_owner);
275 new_sd = create_security_descriptor(mem_ctx, parent_descriptor, user_descriptor, true,
276 NULL, SEC_DACL_AUTO_INHERIT|SEC_SACL_AUTO_INHERIT,
277 session_info->security_token,
278 default_owner, default_group,
279 map_generic_rights_ds);
283 final_sd = descr_handle_sd_flags(mem_ctx, new_sd, old_descriptor, sd_flags);
289 if (final_sd->dacl) {
290 final_sd->dacl->revision = SECURITY_ACL_REVISION_ADS;
292 if (final_sd->sacl) {
293 final_sd->sacl->revision = SECURITY_ACL_REVISION_ADS;
296 sddl_sd = sddl_encode(mem_ctx, final_sd, domain_sid);
297 DEBUG(10, ("Object %s created with desriptor %s\n\n", ldb_dn_get_linearized(dn), sddl_sd));
299 linear_sd = talloc(mem_ctx, DATA_BLOB);
304 ndr_err = ndr_push_struct_blob(linear_sd, mem_ctx,
305 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
307 (ndr_push_flags_fn_t)ndr_push_security_descriptor);
308 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
315 static DATA_BLOB *descr_get_descriptor_to_show(struct ldb_module *module,
320 struct security_descriptor *old_sd, *final_sd;
321 DATA_BLOB *linear_sd;
322 enum ndr_err_code ndr_err;
323 struct ldb_context *ldb = ldb_module_get_ctx(module);
325 old_sd = talloc(mem_ctx, struct security_descriptor);
329 ndr_err = ndr_pull_struct_blob(sd, old_sd, NULL,
331 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
333 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
338 final_sd = descr_handle_sd_flags(mem_ctx, old_sd, NULL, sd_flags);
344 linear_sd = talloc(mem_ctx, DATA_BLOB);
349 ndr_err = ndr_push_struct_blob(linear_sd, mem_ctx,
350 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
352 (ndr_push_flags_fn_t)ndr_push_security_descriptor);
353 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
360 static struct descriptor_context *descriptor_init_context(struct ldb_module *module,
361 struct ldb_request *req)
363 struct ldb_context *ldb;
364 struct descriptor_context *ac;
366 ldb = ldb_module_get_ctx(module);
368 ac = talloc_zero(req, struct descriptor_context);
370 ldb_set_errstring(ldb, "Out of Memory");
379 static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
381 struct ldb_context *ldb;
382 struct descriptor_context *ac;
385 ac = talloc_get_type(req->context, struct descriptor_context);
386 ldb = ldb_module_get_ctx(ac->module);
389 return ldb_module_done(ac->req, NULL, NULL,
390 LDB_ERR_OPERATIONS_ERROR);
392 if (ares->error != LDB_SUCCESS &&
393 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
394 return ldb_module_done(ac->req, ares->controls,
395 ares->response, ares->error);
398 ldb_reset_err_string(ldb);
400 switch (ares->type) {
401 case LDB_REPLY_ENTRY:
402 if (ac->search_res != NULL) {
403 ldb_set_errstring(ldb, "Too many results");
405 return ldb_module_done(ac->req, NULL, NULL,
406 LDB_ERR_OPERATIONS_ERROR);
409 ac->search_res = talloc_steal(ac, ares);
412 case LDB_REPLY_REFERRAL:
419 ret = ac->step_fn(ac);
420 if (ret != LDB_SUCCESS) {
421 return ldb_module_done(ac->req, NULL, NULL, ret);
429 static int get_search_oc_callback(struct ldb_request *req, struct ldb_reply *ares)
431 struct ldb_context *ldb;
432 struct descriptor_context *ac;
435 ac = talloc_get_type(req->context, struct descriptor_context);
436 ldb = ldb_module_get_ctx(ac->module);
439 return ldb_module_done(ac->req, NULL, NULL,
440 LDB_ERR_OPERATIONS_ERROR);
442 if (ares->error != LDB_SUCCESS &&
443 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
444 return ldb_module_done(ac->req, ares->controls,
445 ares->response, ares->error);
448 ldb_reset_err_string(ldb);
450 switch (ares->type) {
451 case LDB_REPLY_ENTRY:
452 if (ac->search_oc_res != NULL) {
453 ldb_set_errstring(ldb, "Too many results");
455 return ldb_module_done(ac->req, NULL, NULL,
456 LDB_ERR_OPERATIONS_ERROR);
459 ac->search_oc_res = talloc_steal(ac, ares);
462 case LDB_REPLY_REFERRAL:
469 ret = ac->step_fn(ac);
470 if (ret != LDB_SUCCESS) {
471 return ldb_module_done(ac->req, NULL, NULL, ret);
480 static int descriptor_op_callback(struct ldb_request *req, struct ldb_reply *ares)
482 struct descriptor_context *ac;
484 ac = talloc_get_type(req->context, struct descriptor_context);
487 return ldb_module_done(ac->req, NULL, NULL,
488 LDB_ERR_OPERATIONS_ERROR);
490 if (ares->error != LDB_SUCCESS) {
491 return ldb_module_done(ac->req, ares->controls,
492 ares->response, ares->error);
495 if (ares->type != LDB_REPLY_DONE) {
497 return ldb_module_done(ac->req, NULL, NULL,
498 LDB_ERR_OPERATIONS_ERROR);
501 return ldb_module_done(ac->req, ares->controls,
502 ares->response, ares->error);
505 static int descriptor_search_callback(struct ldb_request *req, struct ldb_reply *ares)
507 struct descriptor_context *ac;
508 struct ldb_control *sd_control;
509 struct ldb_val *sd_val = NULL;
510 struct ldb_message_element *sd_el;
513 uint32_t sd_flags = 0;
515 ac = talloc_get_type(req->context, struct descriptor_context);
518 ret = LDB_ERR_OPERATIONS_ERROR;
521 if (ares->error != LDB_SUCCESS) {
522 return ldb_module_done(ac->req, ares->controls,
523 ares->response, ares->error);
526 sd_control = ldb_request_get_control(ac->req, LDB_CONTROL_SD_FLAGS_OID);
528 struct ldb_sd_flags_control *sdctr = (struct ldb_sd_flags_control *)sd_control->data;
529 sd_flags = sdctr->secinfo_flags;
530 /* we only care for the last 4 bits */
531 sd_flags = sd_flags & 0x0000000F;
533 /* MS-ADTS 3.1.1.3.4.1.11 says that no bits
539 switch (ares->type) {
540 case LDB_REPLY_ENTRY:
542 sd_el = ldb_msg_find_element(ares->message, "nTSecurityDescriptor");
544 sd_val = sd_el->values;
548 show_sd = descr_get_descriptor_to_show(ac->module, ac->req,
551 ret = LDB_ERR_OPERATIONS_ERROR;
554 ldb_msg_remove_attr(ares->message, "nTSecurityDescriptor");
555 ret = ldb_msg_add_steal_value(ares->message, "nTSecurityDescriptor", show_sd);
556 if (ret != LDB_SUCCESS) {
560 return ldb_module_send_entry(ac->req, ares->message, ares->controls);
562 case LDB_REPLY_REFERRAL:
563 /* ignore referrals */
567 return ldb_module_done(ac->req, ares->controls,
568 ares->response, ares->error);
574 return ldb_module_done(ac->req, NULL, NULL, ret);
577 static int descriptor_do_mod(struct descriptor_context *ac)
579 struct ldb_context *ldb;
580 const struct dsdb_schema *schema;
581 struct ldb_request *mod_req;
582 struct ldb_message_element *objectclass_element, *tmp_element, *oldsd_el;
583 struct ldb_val *oldsd_val = NULL;
586 const struct dsdb_class *objectclass;
587 struct ldb_message *msg;
588 struct ldb_control *sd_control;
589 struct ldb_control *sd_control2;
591 uint32_t sd_flags = 0;
593 ldb = ldb_module_get_ctx(ac->module);
594 schema = dsdb_get_schema(ldb);
595 msg = ldb_msg_copy_shallow(ac, ac->req->op.mod.message);
596 objectclass_element = ldb_msg_find_element(ac->search_oc_res->message, "objectClass");
597 objectclass = get_last_structural_class(schema, objectclass_element);
600 ldb_asprintf_errstring(ldb, "No last structural objectclass found on %s",
601 ldb_dn_get_linearized(ac->search_oc_res->message->dn));
602 return LDB_ERR_OPERATIONS_ERROR;
604 sd_control = ldb_request_get_control(ac->req, LDB_CONTROL_SD_FLAGS_OID);
605 sd_control2 = ldb_request_get_control(ac->req, LDB_CONTROL_RECALCULATE_SD_OID);
607 struct ldb_sd_flags_control *sdctr = (struct ldb_sd_flags_control *)sd_control->data;
608 sd_flags = sdctr->secinfo_flags;
609 /* we only care for the last 4 bits */
610 sd_flags = sd_flags & 0x0000000F;
613 oldsd_el = ldb_msg_find_element(ac->search_oc_res->message, "nTSecurityDescriptor");
615 oldsd_val = oldsd_el->values;
618 sd = get_new_descriptor(ac->module, msg->dn, ac, objectclass,
619 ac->parentsd_val, ac->sd_val, oldsd_val, sd_flags);
621 tmp_element = ldb_msg_find_element(msg, "ntSecurityDescriptor");
622 flags = tmp_element->flags;
623 ldb_msg_remove_attr(msg, "nTSecurityDescriptor");
627 ret = ldb_msg_add_steal_value(msg, "nTSecurityDescriptor", sd);
628 if (ret != LDB_SUCCESS) {
631 tmp_element = ldb_msg_find_element(msg, "ntSecurityDescriptor");
633 tmp_element->flags = LDB_FLAG_MOD_REPLACE;
635 tmp_element->flags = flags;
638 ret = ldb_build_mod_req(&mod_req, ldb, ac,
641 ac, descriptor_op_callback,
643 if (ret != LDB_SUCCESS) {
646 /* mark it non-critical, so we don't get an error from the
647 backend, but mark that we've handled it */
649 sd_control->critical = 0;
652 return ldb_next_request(ac->module, mod_req);
655 static int descriptor_do_add(struct descriptor_context *ac)
657 struct ldb_context *ldb;
658 const struct dsdb_schema *schema;
659 struct ldb_request *add_req;
660 struct ldb_message_element *objectclass_element, *sd_element = NULL;
661 struct ldb_message *msg;
665 const struct dsdb_class *objectclass;
666 static const char *const attrs[] = { "objectClass", "nTSecurityDescriptor", NULL };
667 struct ldb_request *search_req;
669 ldb = ldb_module_get_ctx(ac->module);
670 schema = dsdb_get_schema(ldb);
671 mem_ctx = talloc_new(ac);
672 if (mem_ctx == NULL) {
673 return LDB_ERR_OPERATIONS_ERROR;
675 switch (ac->req->operation) {
677 msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
678 objectclass_element = ldb_msg_find_element(msg, "objectClass");
679 objectclass = get_last_structural_class(schema, objectclass_element);
682 ldb_asprintf_errstring(ldb, "No last structural objectclass found on %s", ldb_dn_get_linearized(msg->dn));
683 return LDB_ERR_OPERATIONS_ERROR;
687 msg = ldb_msg_copy_shallow(ac, ac->req->op.mod.message);
690 return LDB_ERR_OPERATIONS_ERROR;
694 /* get the security descriptor values*/
695 sd_element = ldb_msg_find_element(msg, "nTSecurityDescriptor");
697 ac->sd_val = talloc_memdup(ac, &sd_element->values[0], sizeof(struct ldb_val));
699 /* NC's have no parent */
700 if ((ldb_dn_compare(msg->dn, (ldb_get_schema_basedn(ldb))) == 0) ||
701 (ldb_dn_compare(msg->dn, (ldb_get_config_basedn(ldb))) == 0) ||
702 (ldb_dn_compare(msg->dn, (ldb_get_root_basedn(ldb))) == 0)) {
703 ac->parentsd_val = NULL;
704 } else if (ac->search_res != NULL) {
705 struct ldb_message_element *parent_element = ldb_msg_find_element(ac->search_res->message, "nTSecurityDescriptor");
706 if (parent_element) {
707 ac->parentsd_val = talloc_memdup(ac, &parent_element->values[0], sizeof(struct ldb_val));
711 if (ac->req->operation == LDB_ADD) {
712 /* get the parent descriptor and the one provided. If not provided, get the default.*/
713 /* convert to security descriptor and calculate */
714 sd = get_new_descriptor(ac->module, msg->dn, mem_ctx, objectclass,
715 ac->parentsd_val, ac->sd_val, NULL, 0);
717 ldb_msg_remove_attr(msg, "nTSecurityDescriptor");
721 ret = ldb_msg_add_steal_value(msg, "nTSecurityDescriptor", sd);
722 if (ret != LDB_SUCCESS) {
727 talloc_free(mem_ctx);
728 ret = ldb_msg_sanity_check(ldb, msg);
730 if (ret != LDB_SUCCESS) {
731 ldb_asprintf_errstring(ldb, "No last structural objectclass found on %s",
732 ldb_dn_get_linearized(msg->dn));
736 ret = ldb_build_add_req(&add_req, ldb, ac,
739 ac, descriptor_op_callback,
741 if (ret != LDB_SUCCESS) {
744 return ldb_next_request(ac->module, add_req);
746 ret = ldb_build_search_req(&search_req, ldb,
747 ac, msg->dn, LDB_SCOPE_BASE,
748 "(objectClass=*)", attrs,
750 ac, get_search_oc_callback,
752 if (ret != LDB_SUCCESS) {
755 ac->step_fn = descriptor_do_mod;
756 return ldb_next_request(ac->module, search_req);
760 static int descriptor_change(struct ldb_module *module, struct ldb_request *req)
762 struct ldb_context *ldb;
763 struct ldb_control *sd_control;
764 struct ldb_request *search_req;
765 struct descriptor_context *ac;
766 struct ldb_dn *parent_dn, *dn;
767 struct ldb_message_element *sd_element;
769 static const char * const descr_attrs[] = { "nTSecurityDescriptor", NULL };
771 ldb = ldb_module_get_ctx(module);
773 switch (req->operation) {
775 dn = req->op.add.message->dn;
778 dn = req->op.mod.message->dn;
779 sd_element = ldb_msg_find_element(req->op.mod.message, "nTSecurityDescriptor");
780 /* This control allow forcing the recalculation of the SD */
781 sd_control = ldb_request_get_control(req, LDB_CONTROL_RECALCULATE_SD_OID);
782 if (!sd_element && !sd_control) {
783 return ldb_next_request(module, req);
787 return LDB_ERR_OPERATIONS_ERROR;
789 ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_change: %s\n", ldb_dn_get_linearized(dn));
791 if (ldb_dn_is_special(dn)) {
792 return ldb_next_request(module, req);
795 ac = descriptor_init_context(module, req);
797 return LDB_ERR_OPERATIONS_ERROR;
800 /* If there isn't a parent, just go on to the add processing */
801 if (ldb_dn_get_comp_num(dn) == 1) {
802 return descriptor_do_add(ac);
805 /* get copy of parent DN */
806 parent_dn = ldb_dn_get_parent(ac, dn);
807 if (parent_dn == NULL) {
809 return LDB_ERR_OPERATIONS_ERROR;
812 ret = ldb_build_search_req(&search_req, ldb,
813 ac, parent_dn, LDB_SCOPE_BASE,
814 "(objectClass=*)", descr_attrs,
816 ac, get_search_callback,
818 if (ret != LDB_SUCCESS) {
821 talloc_steal(search_req, parent_dn);
823 ac->step_fn = descriptor_do_add;
825 return ldb_next_request(ac->module, search_req);
828 static int descriptor_search(struct ldb_module *module, struct ldb_request *req)
831 struct ldb_context *ldb;
832 struct ldb_control *sd_control;
833 struct ldb_request *down_req;
834 struct descriptor_context *ac;
836 sd_control = ldb_request_get_control(req, LDB_CONTROL_SD_FLAGS_OID);
838 return ldb_next_request(module, req);
841 ldb = ldb_module_get_ctx(module);
842 ac = descriptor_init_context(module, req);
844 return LDB_ERR_OPERATIONS_ERROR;
847 ret = ldb_build_search_req_ex(&down_req, ldb, ac,
849 req->op.search.scope,
851 req->op.search.attrs,
853 ac, descriptor_search_callback,
855 if (ret != LDB_SUCCESS) {
858 /* mark it as handled */
860 sd_control->critical = 0;
863 return ldb_next_request(ac->module, down_req);
866 static int descriptor_rename(struct ldb_module *module, struct ldb_request *req)
868 struct ldb_context *ldb = ldb_module_get_ctx(module);
869 ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_rename: %s\n", ldb_dn_get_linearized(req->op.rename.olddn));
870 return ldb_next_request(module, req);
873 static int descriptor_init(struct ldb_module *module)
875 int ret = ldb_mod_register_control(module, LDB_CONTROL_SD_FLAGS_OID);
876 struct ldb_context *ldb = ldb_module_get_ctx(module);
877 if (ret != LDB_SUCCESS) {
878 ldb_debug(ldb, LDB_DEBUG_ERROR,
879 "descriptor: Unable to register control with rootdse!\n");
880 return LDB_ERR_OPERATIONS_ERROR;
882 return ldb_next_init(module);
886 _PUBLIC_ const struct ldb_module_ops ldb_descriptor_module_ops = {
887 .name = "descriptor",
888 .search = descriptor_search,
889 .add = descriptor_change,
890 .modify = descriptor_change,
891 .rename = descriptor_rename,
892 .init_context = descriptor_init