#include "librpc/gen_ndr/ndr_security.h"
#include "param/param.h"
#include "dsdb/samdb/ldb_modules/util.h"
+#include "dsdb/samdb/ldb_modules/schema.h"
#include "lib/util/tsort.h"
struct extended_access_check_attribute {
return ldb_operr(ldb_module_get_ctx(module));
}
-int acl_check_access_on_class(struct ldb_module *module,
- const struct dsdb_schema *schema,
- TALLOC_CTX *mem_ctx,
- struct security_descriptor *sd,
- struct dom_sid *rp_sid,
- uint32_t access,
- const char *class_name)
-{
- int ret;
- NTSTATUS status;
- uint32_t access_granted;
- struct object_tree *root = NULL;
- struct object_tree *new_node = NULL;
- const struct GUID *guid;
- TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
- struct security_token *token = acl_user_token(module);
- if (class_name) {
- guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
- if (!guid) {
- DEBUG(10, ("acl_search: cannot find class %s\n",
- class_name));
- goto fail;
- }
- if (!insert_in_object_tree(tmp_ctx,
- guid, access,
- &root, &new_node)) {
- DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
- goto fail;
- }
- }
- status = sec_access_check_ds(sd, token,
- access,
- &access_granted,
- root,
- rp_sid);
- if (!NT_STATUS_IS_OK(status)) {
- ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
- }
- else {
- ret = LDB_SUCCESS;
- }
- return ret;
-fail:
- return ldb_operr(ldb_module_get_ctx(module));
-}
-
-const struct GUID *get_oc_guid_from_message(struct ldb_module *module,
- const struct dsdb_schema *schema,
- struct ldb_message *msg)
-{
- struct ldb_message_element *oc_el;
-
- oc_el = ldb_msg_find_element(msg, "objectClass");
- if (!oc_el) {
- return NULL;
- }
-
- return class_schemaid_guid_by_lDAPDisplayName(schema,
- (char *)oc_el->values[oc_el->num_values-1].data);
-}
-
/* checks for validated writes */
int acl_check_extended_right(TALLOC_CTX *mem_ctx,
#include "librpc/ndr/libndr.h"
#include "librpc/gen_ndr/ndr_security.h"
#include "libcli/security/security.h"
+#include "dsdb/samdb/ldb_modules/schema.h"
#include "auth/auth.h"
#include "param/param.h"
#include "util.h"
#include "auth/auth.h"
#include "param/param.h"
#include "../libds/common/flags.h"
+#include "dsdb/samdb/ldb_modules/schema.h"
#include "util.h"
struct oc_context {
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+ Samba utility functions
+
+ Copyright (C) Andrew Tridgell 2009
+ Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "ldb.h"
+#include "ldb_module.h"
+#include "librpc/ndr/libndr.h"
+#include "dsdb/samdb/ldb_modules/util.h"
+#include "dsdb/samdb/samdb.h"
+#include "util.h"
+#include "libcli/security/security.h"
+#include "lib/ldb/include/ldb_private.h"
+
+const struct dsdb_class * get_last_structural_class(const struct dsdb_schema *schema,const struct ldb_message_element *element)
+{
+ const struct dsdb_class *last_class = NULL;
+ unsigned int i;
+
+ for (i = 0; i < element->num_values; i++){
+ const struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &element->values[i]);
+
+ if(tmp_class == NULL) {
+ continue;
+ }
+
+ if(tmp_class->objectClassCategory > 1) {
+ continue;
+ }
+
+ if (!last_class) {
+ last_class = tmp_class;
+ } else {
+ if (tmp_class->subClass_order > last_class->subClass_order)
+ last_class = tmp_class;
+ }
+ }
+
+ return last_class;
+}
+
+int acl_check_access_on_class(struct ldb_module *module,
+ const struct dsdb_schema *schema,
+ TALLOC_CTX *mem_ctx,
+ struct security_descriptor *sd,
+ struct dom_sid *rp_sid,
+ uint32_t access,
+ const char *class_name)
+{
+ int ret;
+ NTSTATUS status;
+ uint32_t access_granted;
+ struct object_tree *root = NULL;
+ struct object_tree *new_node = NULL;
+ const struct GUID *guid;
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+ struct security_token *token = acl_user_token(module);
+ if (class_name) {
+ guid = class_schemaid_guid_by_lDAPDisplayName(schema, class_name);
+ if (!guid) {
+ DEBUG(10, ("acl_search: cannot find class %s\n",
+ class_name));
+ goto fail;
+ }
+ if (!insert_in_object_tree(tmp_ctx,
+ guid, access,
+ &root, &new_node)) {
+ DEBUG(10, ("acl_search: cannot add to object tree guid\n"));
+ goto fail;
+ }
+ }
+ status = sec_access_check_ds(sd, token,
+ access,
+ &access_granted,
+ root,
+ rp_sid);
+ if (!NT_STATUS_IS_OK(status)) {
+ ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+ }
+ else {
+ ret = LDB_SUCCESS;
+ }
+ return ret;
+fail:
+ return ldb_operr(ldb_module_get_ctx(module));
+}
+
+const struct GUID *get_oc_guid_from_message(struct ldb_module *module,
+ const struct dsdb_schema *schema,
+ struct ldb_message *msg)
+{
+ struct ldb_message_element *oc_el;
+
+ oc_el = ldb_msg_find_element(msg, "objectClass");
+ if (!oc_el) {
+ return NULL;
+ }
+
+ return class_schemaid_guid_by_lDAPDisplayName(schema,
+ (char *)oc_el->values[oc_el->num_values-1].data);
+}
+
+
return ret;
}
-const struct dsdb_class * get_last_structural_class(const struct dsdb_schema *schema,const struct ldb_message_element *element)
-{
- const struct dsdb_class *last_class = NULL;
- unsigned int i;
-
- for (i = 0; i < element->num_values; i++){
- const struct dsdb_class *tmp_class = dsdb_class_by_lDAPDisplayName_ldb_val(schema, &element->values[i]);
-
- if(tmp_class == NULL) {
- continue;
- }
-
- if(tmp_class->objectClassCategory > 1) {
- continue;
- }
-
- if (!last_class) {
- last_class = tmp_class;
- } else {
- if (tmp_class->subClass_order > last_class->subClass_order)
- last_class = tmp_class;
- }
- }
-
- return last_class;
-}
-
/*
check if a single valued link has multiple non-deleted values
bld.SAMBA_SUBSYSTEM('DSDB_MODULE_HELPERS',
source='util.c acl_util.c',
autoproto='util_proto.h',
- deps='ldb LIBNDR SAMDB_SCHEMA'
+ deps='ldb LIBNDR SAMDB_COMMON'
)
bld.SAMBA_SUBSYSTEM('DSDB_MODULE_HELPER_RIDALLOC',
deps='MESSAGING',
)
+bld.SAMBA_SUBSYSTEM('DSDB_MODULE_HELPER_SCHEMA',
+ source='schema.c',
+ autoproto='schema.h',
+ deps='SAMDB_SCHEMA'
+ )
+
bld.SAMBA_MODULE('ldb_samba_dsdb',
source='samba_dsdb.c',
subsystem='ldb',
subsystem='ldb',
init_function='LDB_MODULE(rootdse)',
internal_module=not bld.CONFIG_SET('USING_SYSTEM_LDB'),
- deps='talloc LIBEVENTS SAMDB'
+ deps='talloc LIBEVENTS SAMDB MESSAGING'
)
subsystem='ldb',
init_function='LDB_MODULE(objectclass)',
internal_module=not bld.CONFIG_SET('USING_SYSTEM_LDB'),
- deps='talloc LIBEVENTS LIBSECURITY NDR_SECURITY SAMDB DSDB_MODULE_HELPERS LIBSAMBA-UTIL'
+ deps='talloc LIBEVENTS LIBSECURITY NDR_SECURITY SAMDB DSDB_MODULE_HELPERS LIBSAMBA-UTIL DSDB_MODULE_HELPER_SCHEMA'
)
subsystem='ldb',
init_function='LDB_MODULE(descriptor)',
internal_module=not bld.CONFIG_SET('USING_SYSTEM_LDB'),
- deps='talloc LIBEVENTS LIBSECURITY NDR_SECURITY SAMDB DSDB_MODULE_HELPERS'
+ deps='talloc LIBEVENTS LIBSECURITY NDR_SECURITY SAMDB DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_SCHEMA'
)
subsystem='ldb',
init_function='LDB_MODULE(acl)',
internal_module=not bld.CONFIG_SET('USING_SYSTEM_LDB'),
- deps='talloc LIBEVENTS LIBSECURITY SAMDB DSDB_MODULE_HELPERS'
+ deps='talloc LIBEVENTS LIBSECURITY SAMDB DSDB_MODULE_HELPERS DSDB_MODULE_HELPER_SCHEMA'
)
git.samba.org / metze / samba / wip.git / commitdiff