s4:dsdb/acl_read: enable acl checking on search by default (bug #8620)

[metze/samba/wip.git] / source4 / dsdb / samdb / ldb_modules / acl.c

diff --git a/source4/dsdb/samdb/ldb_modules/acl.c b/source4/dsdb/samdb/ldb_modules/acl.c
index 0c4131f810e7979358fa2efb6efdf92a9ba7c975..853fa20902e0cfd3f3ada6db091d9927b3802ae2 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/acl.c
+++ b/source4/dsdb/samdb/ldb_modules/acl.c
@@ -49,7 +49,7 @@ struct extended_access_check_attribute {
 };
 
 struct acl_private {
-       bool acl_perform;
+       bool acl_search;
        const char **password_attrs;
        void *cached_schema_ptr;
        uint64_t cached_schema_metadata_usn;
@@ -100,8 +100,8 @@ static int acl_module_init(struct ldb_module *module)
                return ldb_oom(ldb);
        }
 
-       data->acl_perform = lpcfg_parm_bool(ldb_get_opaque(ldb, "loadparm"),
-                                        NULL, "acl", "perform", false);
+       data->acl_search = lpcfg_parm_bool(ldb_get_opaque(ldb, "loadparm"),
+                                       NULL, "acl", "search", true);
        ldb_module_set_private(module, data);
 
        mem_ctx = talloc_new(module);
@@ -1024,8 +1024,21 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req)
                                                         req->op.mod.message->elements[i].name);
 
                if (ldb_attr_cmp("nTSecurityDescriptor", req->op.mod.message->elements[i].name) == 0) {
+                       uint32_t sd_flags = dsdb_request_sd_flags(req, NULL);
+                       uint32_t access_mask = 0;
+
+                       if (sd_flags & (SECINFO_OWNER|SECINFO_GROUP)) {
+                               access_mask |= SEC_STD_WRITE_OWNER;
+                       }
+                       if (sd_flags & SECINFO_DACL) {
+                               access_mask |= SEC_STD_WRITE_DAC;
+                       }
+                       if (sd_flags & SECINFO_SACL) {
+                               access_mask |= SEC_FLAG_SYSTEM_SECURITY;
+                       }
+
                        status = sec_access_check_ds(sd, acl_user_token(module),
-                                            SEC_STD_WRITE_DAC,
+                                            access_mask,
                                             &access_granted,
                                             NULL,
                                             sid);
@@ -1396,6 +1409,15 @@ static int acl_search_update_confidential_attrs(struct acl_context *ac,
        struct dsdb_attribute *a;
        uint32_t n = 0;
 
+       if (data->acl_search) {
+               /*
+                * if acl:search is activated we
+                * the acl_read module protects
+                * confidential attributes.
+                */
+               return LDB_SUCCESS;
+       }
+
        if ((ac->schema == data->cached_schema_ptr) &&
            (ac->schema->loaded_usn == data->cached_schema_loaded_usn) &&
            (ac->schema->metadata_usn == data->cached_schema_metadata_usn))