sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-24 13:57:43 +03:00
Code

libcli/security: add security_descriptor_for_client() helper function

Browse Source 
This prepares a possibly stripped security descriptor for a client.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
This commit is contained in:
Stefan Metzmacher 2015-03-26 14:39:35 +01:00 committed by Günther Deschner
parent 77f0763c84
commit 2dcef48f24
2 changed files with 75 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
libcli/security/security_descriptor.c
View File

@ -182,6 +182,76 @@ struct security_descriptor *security_descriptor_copy(TALLOC_CTX *mem_ctx,
return NULL;
}
NTSTATUS security_descriptor_for_client(TALLOC_CTX *mem_ctx,
const struct security_descriptor *ssd,
uint32_t sec_info,
uint32_t access_granted,
struct security_descriptor **_csd)
{
struct security_descriptor *csd = NULL;
uint32_t access_required = 0;
*_csd = NULL;
if (sec_info & (SECINFO_OWNER|SECINFO_GROUP)) {
access_required |= SEC_STD_READ_CONTROL;
}
if (sec_info & SECINFO_DACL) {
access_required |= SEC_STD_READ_CONTROL;
}
if (sec_info & SECINFO_SACL) {
access_required |= SEC_FLAG_SYSTEM_SECURITY;
}
if (access_required & (~access_granted)) {
return NT_STATUS_ACCESS_DENIED;
}
/*
* make a copy...
*/
csd = security_descriptor_copy(mem_ctx, ssd);
if (csd == NULL) {
return NT_STATUS_NO_MEMORY;
}
/*
* ... and remove everthing not wanted
*/
if (!(sec_info & SECINFO_OWNER)) {
TALLOC_FREE(csd->owner_sid);
csd->type &= ~SEC_DESC_OWNER_DEFAULTED;
}
if (!(sec_info & SECINFO_GROUP)) {
TALLOC_FREE(csd->group_sid);
csd->type &= ~SEC_DESC_GROUP_DEFAULTED;
}
if (!(sec_info & SECINFO_DACL)) {
TALLOC_FREE(csd->dacl);
csd->type &= ~(
SEC_DESC_DACL_PRESENT |
SEC_DESC_DACL_DEFAULTED|
SEC_DESC_DACL_AUTO_INHERIT_REQ |
SEC_DESC_DACL_AUTO_INHERITED |
SEC_DESC_DACL_PROTECTED |
SEC_DESC_DACL_TRUSTED);
}
if (!(sec_info & SECINFO_SACL)) {
TALLOC_FREE(csd->sacl);
csd->type &= ~(
SEC_DESC_SACL_PRESENT |
SEC_DESC_SACL_DEFAULTED |
SEC_DESC_SACL_AUTO_INHERIT_REQ |
SEC_DESC_SACL_AUTO_INHERITED |
SEC_DESC_SACL_PROTECTED |
SEC_DESC_SERVER_SECURITY);
}
*_csd = csd;
return NT_STATUS_OK;
}
/*
add an ACE to an ACL of a security_descriptor
*/

5
libcli/security/security_descriptor.h
View File

@ -26,6 +26,11 @@
struct security_descriptor *security_descriptor_initialise(TALLOC_CTX *mem_ctx);
struct security_descriptor *security_descriptor_copy(TALLOC_CTX *mem_ctx,
const struct security_descriptor *osd);
NTSTATUS security_descriptor_for_client(TALLOC_CTX *mem_ctx,
const struct security_descriptor *ssd,
uint32_t sec_info,
uint32_t access_granted,
struct security_descriptor **_csd);
NTSTATUS security_descriptor_sacl_add(struct security_descriptor *sd,
const struct security_ace *ace);
NTSTATUS security_descriptor_dacl_add(struct security_descriptor *sd,