sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Code

dsdb-acl: add acl_check_access_on_objectclass() helper

Browse Source 
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Stefan Metzmacher 2013-01-16 16:34:56 +01:00
parent 74bfec0269
commit 097fae2d1d
1 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
source4/dsdb/samdb/ldb_modules/acl_util.c
View File

@ -150,6 +150,45 @@ fail:
return ldb_operr(ldb_module_get_ctx(module));
}
int acl_check_access_on_objectclass(struct ldb_module *module,
TALLOC_CTX *mem_ctx,
struct security_descriptor *sd,
struct dom_sid *rp_sid,
uint32_t access_mask,
const struct dsdb_class *objectclass)
{
int ret;
NTSTATUS status;
uint32_t access_granted;
struct object_tree *root = NULL;
struct object_tree *new_node = NULL;
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
struct security_token *token = acl_user_token(module);
if (!insert_in_object_tree(tmp_ctx,
&objectclass->schemaIDGUID,
access_mask, &root,
&new_node)) {
DEBUG(10, ("acl_search: cannot add to object tree class schemaIDGUID\n"));
goto fail;
}
status = sec_access_check_ds(sd, token,
access_mask,
&access_granted,
root,
rp_sid);
if (!NT_STATUS_IS_OK(status)) {
ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
} else {
ret = LDB_SUCCESS;
}
talloc_free(tmp_ctx);
return ret;
fail:
talloc_free(tmp_ctx);
return ldb_operr(ldb_module_get_ctx(module));
}
/* checks for validated writes */
int acl_check_extended_right(TALLOC_CTX *mem_ctx,