996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder

ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder

1bc5dccbf0083a620ae1181c717fea75e4af5e5cChristian Maeder#include <security/pam_modules.h>

7bf4436b6f9987b070033a323757b206c898c1beChristian Maeder#include <syslog.h>

e9249d3ecd51a2b6a966a58669953e58d703adc6Till Mossakowski#include <fcntl.h>

ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder#include <ini_configobj.h>

410ff490af511ffa09b52e4de631d36a154b9730Christian Maeder#include "util/util.h"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#include "util/strtonum.h"

ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder#include "util/child_common.h"

1842453990fed8a1bd7a5ac792d7982c1d2bfcd5Christian Maeder#include "providers/data_provider.h"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#include "providers/dp_backend.h"

ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder#include "providers/ad/ad_access.h"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#include "providers/ad/ad_common.h"

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder#include "providers/ad/ad_domain_info.h"

54ea981a0503c396c2923a1c06421c6235baf27fChristian Maeder#include "providers/ad/ad_gpo.h"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#include "providers/ldap/sdap_access.h"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#include "providers/ldap/sdap_async.h"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#include "providers/ldap/sdap.h"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#include "providers/ldap/sdap_idmap.h"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#include "util/util_sss_idmap.h"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#include <ndr.h>

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#include <gen_ndr/security.h>

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder

ad270004874ce1d0697fb30d7309f180553bb315Christian Maeder

410ff490af511ffa09b52e4de631d36a154b9730Christian Maeder#define AD_AT_DN "distinguishedName"

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder#define AD_AT_UAC "userAccountControl"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#define AD_AT_CONFIG_NC "configurationNamingContext"

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder#define AD_AT_GPLINK "gPLink"

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder#define AD_AT_GPOPTIONS "gpOptions"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define AD_AT_NT_SEC_DESC "nTSecurityDescriptor"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define AD_AT_CN "cn"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define AD_AT_FILE_SYS_PATH "gPCFileSysPath"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define AD_AT_MACHINE_EXT_NAMES "gPCMachineExtensionNames"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define AD_AT_FUNC_VERSION "gPCFunctionalityVersion"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define AD_AT_FLAGS "flags"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define UAC_WORKSTATION_TRUST_ACCOUNT 0x00001000

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define AD_AGP_GUID "edacfd8f-ffb3-11d1-b41d-00a0c968f939"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define AD_AUTHENTICATED_USERS_SID "S-1-5-11"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define SMB_STANDARD_URI "smb://"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define BUFSIZE 65536

f1b14608f0f3db464c3aded480e49522d73b08e5Christian Maeder

9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder#define RIGHTS_SECTION "Privilege Rights"

f1b14608f0f3db464c3aded480e49522d73b08e5Christian Maeder#define ALLOW_LOGON_INTERACTIVE "SeInteractiveLogonRight"

f1b14608f0f3db464c3aded480e49522d73b08e5Christian Maeder#define DENY_LOGON_INTERACTIVE "SeDenyInteractiveLogonRight"

f1b14608f0f3db464c3aded480e49522d73b08e5Christian Maeder#define ALLOW_LOGON_REMOTE_INTERACTIVE "SeRemoteInteractiveLogonRight"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#define DENY_LOGON_REMOTE_INTERACTIVE "SeDenyRemoteInteractiveLogonRight"

9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder#define ALLOW_LOGON_NETWORK "SeNetworkLogonRight"

f1b14608f0f3db464c3aded480e49522d73b08e5Christian Maeder#define DENY_LOGON_NETWORK "SeDenyNetworkLogonRight"

f1b14608f0f3db464c3aded480e49522d73b08e5Christian Maeder#define ALLOW_LOGON_BATCH "SeBatchLogonRight"

f1b14608f0f3db464c3aded480e49522d73b08e5Christian Maeder#define DENY_LOGON_BATCH "SeDenyBatchLogonRight"

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder#define ALLOW_LOGON_SERVICE "SeServiceLogonRight"

7688e20f844fe88f75c04016841ebb5e5e3d927fChristian Maeder#define DENY_LOGON_SERVICE "SeDenyServiceLogonRight"

be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder#define GP_EXT_GUID_SECURITY "{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"

be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder#define GP_EXT_GUID_SECURITY_SUFFIX "/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf"

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder#ifndef SSSD_LIBEXEC_PATH

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder#error "SSSD_LIBEXEC_PATH not defined"

be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder#else

be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder#define GPO_CHILD SSSD_LIBEXEC_PATH"/gpo_child"

be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder#endif

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maederint gpo_child_debug_fd = -1;

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maederstruct gp_som {

7688e20f844fe88f75c04016841ebb5e5e3d927fChristian Maeder const char *som_dn;

be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder struct gp_gplink **gplink_list;

be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder int num_gplinks;

be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder};

8528053a6a766c3614276df0f59fb2a2e8ab6d18Christian Maeder

0d0047d6eb457b56ff10987569769a420754a56fChristian Maederstruct gp_gplink {

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder const char *gpo_dn;

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder bool enforced;

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder};

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maederstruct gp_gpo {

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder struct security_descriptor *gpo_sd;

d11391a2447a2005329a95b5d770f24e62bf5b63Christian Maeder const char *gpo_dn;

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder const char *gpo_guid;

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder const char *smb_server;

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder const char *smb_share;

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder const char *smb_path;

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder const char **gpo_cse_guids;

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder int num_gpo_cse_guids;

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder int gpo_func_version;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder int gpo_flags;

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder bool send_to_child;

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder const char *policy_filename;

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder};

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maederenum ace_eval_status {

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder AD_GPO_ACE_DENIED,

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder AD_GPO_ACE_ALLOWED,

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder AD_GPO_ACE_NEUTRAL

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder};

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maederstruct tevent_req *ad_gpo_process_som_send(TALLOC_CTX *mem_ctx,

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder struct tevent_context *ev,

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder struct sdap_id_conn_ctx *conn,

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder struct ldb_context *ldb_ctx,

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder struct sdap_id_op *sdap_op,

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder struct sdap_options *opts,

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder int timeout,

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder const char *target_dn,

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder const char *domain_name);

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maederint ad_gpo_process_som_recv(struct tevent_req *req,

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder TALLOC_CTX *mem_ctx,

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder struct gp_som ***som_list);

81337d455794a0b50fae10b53d0ed85d9e8f2fafChristian Maeder

412aa5e819f3cd18f0be10b5571661036515b151Christian Maederstruct tevent_req *ad_gpo_process_gpo_send(TALLOC_CTX *mem_ctx,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder struct tevent_context *ev,

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder struct sdap_id_op *sdap_op,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder struct sdap_options *opts,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder char *server_hostname,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder int timeout,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder struct gp_som **som_list);

46947810076241f06f3e2919edb2289ed84d6c15Christian Maederint ad_gpo_process_gpo_recv(struct tevent_req *req,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder TALLOC_CTX *mem_ctx,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder struct gp_gpo ***candidate_gpos,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder int *num_candidate_gpos);

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder

46947810076241f06f3e2919edb2289ed84d6c15Christian Maederstruct tevent_req *ad_gpo_process_cse_send(TALLOC_CTX *mem_ctx,

bd986fa9d0f451b8166efdb9027c153d101aa65bChristian Maeder struct tevent_context *ev,

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder bool send_to_child,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder struct sss_domain_info *domain,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder const char *gpo_guid,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder const char *smb_server,

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder const char *smb_share,

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder const char *smb_path,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder const char *smb_cse_suffix,

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder int cached_gpt_version,

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder int gpo_timeout_option);

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maederint ad_gpo_process_cse_recv(struct tevent_req *req);

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder#define GPO_LOGIN "login"

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder#define GPO_SU "su"

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder#define GPO_SU_L "su-l"

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder#define GPO_GDM_FINGERPRINT "gdm-fingerprint"

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder#define GPO_GDM_PASSWORD "gdm-password"

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder#define GPO_GDM_SMARTCARD "gdm-smartcard"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#define GPO_KDM "kdm"

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder#define GPO_SSHD "sshd"

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder#define GPO_FTP "ftp"

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder#define GPO_SAMBA "samba"

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder#define GPO_CROND "crond"

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder#define GPO_SUDO "sudo"

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder#define GPO_SUDO_I "sudo-i"

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maederstruct gpo_map_option_entry {

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder enum gpo_map_type gpo_map_type;

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder enum ad_basic_opt ad_basic_opt;

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder const char **gpo_map_defaults;

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder const char *allow_key;

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder const char *deny_key;

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder};

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maederconst char *gpo_map_interactive_defaults[] =

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder {GPO_LOGIN, GPO_SU, GPO_SU_L,

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder GPO_GDM_FINGERPRINT, GPO_GDM_PASSWORD, GPO_GDM_SMARTCARD, GPO_KDM, NULL};

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maederconst char *gpo_map_remote_interactive_defaults[] = {GPO_SSHD, NULL};

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maederconst char *gpo_map_network_defaults[] = {GPO_FTP, GPO_SAMBA, NULL};

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maederconst char *gpo_map_batch_defaults[] = {GPO_CROND, NULL};

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maederconst char *gpo_map_service_defaults[] = {NULL};

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maederconst char *gpo_map_permit_defaults[] = {GPO_SUDO, GPO_SUDO_I, NULL};

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maederconst char *gpo_map_deny_defaults[] = {NULL};

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maederstruct gpo_map_option_entry gpo_map_option_entries[] = {

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder {GPO_MAP_INTERACTIVE, AD_GPO_MAP_INTERACTIVE, gpo_map_interactive_defaults,

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder ALLOW_LOGON_INTERACTIVE, DENY_LOGON_INTERACTIVE},

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder {GPO_MAP_REMOTE_INTERACTIVE, AD_GPO_MAP_REMOTE_INTERACTIVE,

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder gpo_map_remote_interactive_defaults,

7297175957c5ad3c0498032190b1dee9ec5fb873Christian Maeder ALLOW_LOGON_REMOTE_INTERACTIVE, DENY_LOGON_REMOTE_INTERACTIVE},

792df0347edab377785d98c63e2be8e2ce0a8bdeChristian Maeder {GPO_MAP_NETWORK, AD_GPO_MAP_NETWORK, gpo_map_network_defaults,

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder ALLOW_LOGON_NETWORK, DENY_LOGON_NETWORK},

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder {GPO_MAP_BATCH, AD_GPO_MAP_BATCH, gpo_map_batch_defaults,

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder ALLOW_LOGON_BATCH, DENY_LOGON_BATCH},

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder {GPO_MAP_SERVICE, AD_GPO_MAP_SERVICE, gpo_map_service_defaults,

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder ALLOW_LOGON_SERVICE, DENY_LOGON_SERVICE},

3f9fabb8ac5cfd9234431ecf19b51ff3e985595aChristian Maeder {GPO_MAP_PERMIT, AD_GPO_MAP_PERMIT, gpo_map_permit_defaults, NULL, NULL},

3f9fabb8ac5cfd9234431ecf19b51ff3e985595aChristian Maeder {GPO_MAP_DENY, AD_GPO_MAP_DENY, gpo_map_deny_defaults, NULL, NULL},

de66af0f4b27f08f81c7ca9c573ef9cdf7ca7a07Christian Maeder};

c30cfe2a6ab063befdfb47449bc286caee6d8fc3Christian Maeder

c30cfe2a6ab063befdfb47449bc286caee6d8fc3Christian Maederconst char* gpo_map_type_string(int gpo_map_type)

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder{

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder switch(gpo_map_type) {

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder case GPO_MAP_INTERACTIVE: return "Interactive";

df098122ddc81fe1cb033a151f7305c1dda2dc81Christian Maeder case GPO_MAP_REMOTE_INTERACTIVE: return "Remote Interactive";

df098122ddc81fe1cb033a151f7305c1dda2dc81Christian Maeder case GPO_MAP_NETWORK: return "Network";

df098122ddc81fe1cb033a151f7305c1dda2dc81Christian Maeder case GPO_MAP_BATCH: return "Batch";

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder case GPO_MAP_SERVICE: return "Service";

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder case GPO_MAP_PERMIT: return "Permitted";

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder case GPO_MAP_DENY: return "Denied";

1c8c2b04b40b5c054da07b8d059e5ef29d4dbc32Christian Maeder }

df098122ddc81fe1cb033a151f7305c1dda2dc81Christian Maeder return NULL;

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder}

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder

c0380b947eef252db81ee562246bb732555427f4Till Mossakowskistatic inline bool

2afae0880da7ca73c9376fd4d653ab19833fe858Christian Maederad_gpo_service_in_list(char **list, size_t nlist, const char *str)

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder{

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder size_t i;

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder for (i = 0; i < nlist; i++) {

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder if (strcasecmp(list[i], str) == 0) {

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder break;

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder }

9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder }

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder

c0380b947eef252db81ee562246bb732555427f4Till Mossakowski return (i < nlist) ? true : false;

2afae0880da7ca73c9376fd4d653ab19833fe858Christian Maeder}

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maederad_gpo_parse_map_option_helper(enum gpo_map_type gpo_map_type,

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder hash_key_t key,

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder hash_table_t *options_table)

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder{

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder hash_value_t val;

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder int hret;

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder int ret;

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder hret = hash_lookup(options_table, &key, &val);

9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder if (hret != HASH_SUCCESS && hret != HASH_ERROR_KEY_NOT_FOUND) {

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder DEBUG(SSSDBG_OP_FAILURE, "Error checking hash table: [%s]\n",

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder hash_error_string(hret));

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder ret = EINVAL;

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder goto done;

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski } else if (hret == HASH_SUCCESS) {

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder /* handle unexpected case where mapping for key already exists */

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski if (val.i == gpo_map_type) {

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder /* mapping for key exists for same map type; no error */

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder DEBUG(SSSDBG_TRACE_FUNC,

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder "PAM service %s maps to %s multiple times\n", key.str,

9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder gpo_map_type_string(gpo_map_type));

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski ret = EOK;

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder } else {

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder /* mapping for key exists for different map type; error! */

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE,

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder "PAM service %s maps to both %s and %s\n", key.str,

9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder gpo_map_type_string(val.i), gpo_map_type_string(gpo_map_type));

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder ret = EINVAL;

9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder }

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder goto done;

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder } else {

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder /* handle expected case where mapping for key doesn't already exist */

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder val.type = HASH_VALUE_INT;

e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski val.i = gpo_map_type;

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder

24f14a27a838087b661c2e66fdec4e436ddbd832Christian Maeder hret = hash_enter(options_table, &key, &val);

24f14a27a838087b661c2e66fdec4e436ddbd832Christian Maeder if (hret != HASH_SUCCESS) {

24f14a27a838087b661c2e66fdec4e436ddbd832Christian Maeder DEBUG(SSSDBG_OP_FAILURE, "Error checking hash table: [%s]\n",

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder hash_error_string(hret));

6b00a9239fe7c804524099ca3d25f4ffc6079ceeChristian Maeder ret = EIO;

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder goto done;

b9804822fb178b0fc27ce967a6a8cedc42c5bf90Christian Maeder }

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder ret = EOK;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder }

b9804822fb178b0fc27ce967a6a8cedc42c5bf90Christian Maeder

283fdbf051a1cbcfe003ffdcb434564495106f13Christian Maederdone:

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder return ret;

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder}

283fdbf051a1cbcfe003ffdcb434564495106f13Christian Maeder

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maederad_gpo_parse_map_option(TALLOC_CTX *mem_ctx,

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder enum gpo_map_type gpo_map_type,

283fdbf051a1cbcfe003ffdcb434564495106f13Christian Maeder hash_table_t *options_table,

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder char *conf_str,

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder const char **defaults)

c0380b947eef252db81ee562246bb732555427f4Till Mossakowski{

5b68f1141555736e0b7ddbe14218bcabcc44636fChristian Maeder TALLOC_CTX *tmp_ctx;

e24d81c69aecd41abb2f4969519c9e7126b1d687Christian Maeder errno_t ret;

27c2593d35d1013f630271ca2d1b566307aa4fb4Christian Maeder char **conf_list = NULL;

2afae0880da7ca73c9376fd4d653ab19833fe858Christian Maeder int conf_list_size = 0;

5b68f1141555736e0b7ddbe14218bcabcc44636fChristian Maeder char **add_list = NULL;

b9804822fb178b0fc27ce967a6a8cedc42c5bf90Christian Maeder char **remove_list = NULL;

9dfa1c020a030abdbcfce17b18000cc4e1f28462Christian Maeder int ai = 0, ri = 0;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder int i;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder hash_key_t key;

1bc5dccbf0083a620ae1181c717fea75e4af5e5cChristian Maeder

1bc5dccbf0083a620ae1181c717fea75e4af5e5cChristian Maeder tmp_ctx = talloc_new(NULL);

1bc5dccbf0083a620ae1181c717fea75e4af5e5cChristian Maeder if (tmp_ctx == NULL) {

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder ret = ENOMEM;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder goto done;

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski }

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder

c0380b947eef252db81ee562246bb732555427f4Till Mossakowski DEBUG(SSSDBG_TRACE_ALL, "gpo_map_type: %s\n",

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder gpo_map_type_string(gpo_map_type));

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder if (conf_str) {

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder ret = split_on_separator(tmp_ctx, conf_str, ',', true, true,

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder &conf_list, &conf_list_size);

9dfa1c020a030abdbcfce17b18000cc4e1f28462Christian Maeder if (ret != EOK) {

9dfa1c020a030abdbcfce17b18000cc4e1f28462Christian Maeder DEBUG(SSSDBG_OP_FAILURE,

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder "Cannot parse list of service names %s: %d\n", conf_str, ret);

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder ret = EINVAL;

c0380b947eef252db81ee562246bb732555427f4Till Mossakowski goto done;

c0380b947eef252db81ee562246bb732555427f4Till Mossakowski }

a05cad7f2f387b795a71a3aaec543c78e1b89d38Christian Maeder

37d0b201b8ba5d6056691e3055dd803e7928e163Christian Maeder add_list = talloc_zero_array(tmp_ctx, char *, conf_list_size);

9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder remove_list = talloc_zero_array(tmp_ctx, char *, conf_list_size);

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder if (add_list == NULL || remove_list == NULL) {

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder ret = ENOMEM;

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder goto done;

9d34a8049237647d0188ee2ec88db2dc45f1f848Till Mossakowski }

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder }

27c2593d35d1013f630271ca2d1b566307aa4fb4Christian Maeder

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder for (i = 0; i < conf_list_size; i++) {

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder switch (conf_list[i][0]) {

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder case '+':

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder add_list[ai] = conf_list[i] + 1;

9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder ai++;

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder continue;

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder case '-':

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder remove_list[ri] = conf_list[i] + 1;

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder ri++;

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder continue;

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder default:

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "ad_gpo_map values must start with"

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder "either '+' (for adding service) or '-' (for removing service), "

283fdbf051a1cbcfe003ffdcb434564495106f13Christian Maeder "got '%s'\n",

a4cb1786d23060c8521a88f08f9909589fa83a12Christian Maeder conf_list[i]);

283fdbf051a1cbcfe003ffdcb434564495106f13Christian Maeder ret = EINVAL;

e379124f467e5d0ef7d3c0ca238bff0521f70831Till Mossakowski goto done;

63fb549acb4eddfd045bb55da66c1fd4ff5b1ac5Christian Maeder }

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder }

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder /* Start by adding explicitly added services ('+') to hashtable */

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder for (i = 0; i < ai; i++) {

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder /* if the service is explicitly configured to be removed, skip it */

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder if (ad_gpo_service_in_list(remove_list, ri, add_list[i])) {

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder continue;

ef2affdc0cdf3acd5c051597c04ab9b08a346a7dChristian Maeder }

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder key.type = HASH_KEY_STRING;

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder key.str = (char *)add_list[i];

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder ret = ad_gpo_parse_map_option_helper(gpo_map_type, key, options_table);

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder if (ret != EOK) {

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder DEBUG(SSSDBG_OP_FAILURE, "Invalid configuration: %d\n", ret);

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder goto done;

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder }

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder DEBUG(SSSDBG_TRACE_ALL, "Explicitly added service: %s\n", key.str);

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder }

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder /* Add defaults to hashtable */

c5653d37b37dcc025ff6dd1eada95ae67116e699Christian Maeder for (i = 0; defaults[i]; i++) {

cc4537e2e13b93e08fc8391d3abb8e412cb71b80Christian Maeder /* if the service is explicitly configured to be removed, skip it */

13d0d9a3df7f3998f3c18c2fccbf2e3bbacbd4b5Christian Maeder if (ad_gpo_service_in_list(remove_list, ri, defaults[i])) {

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder continue;

412aa5e819f3cd18f0be10b5571661036515b151Christian Maeder }

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder key.type = HASH_KEY_STRING;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder key.str = talloc_strdup(mem_ctx, defaults[i]);

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder ret = ad_gpo_parse_map_option_helper(gpo_map_type, key, options_table);

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder if (ret != EOK) {

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder DEBUG(SSSDBG_OP_FAILURE, "Invalid configuration: %d\n", ret);

083a5256468076d5a9bfeb22a6e97076c224252eChristian Maeder goto done;

06afcb70f335c6de74007dc5d6bb19a7d06de457Christian Maeder }

06afcb70f335c6de74007dc5d6bb19a7d06de457Christian Maeder

06afcb70f335c6de74007dc5d6bb19a7d06de457Christian Maeder DEBUG(SSSDBG_TRACE_ALL, "Default service (not explicitly removed): %s\n",

13d0d9a3df7f3998f3c18c2fccbf2e3bbacbd4b5Christian Maeder key.str);

278af20bd154d99e884bdf8c66d35d36699643c9Christian Maeder }

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder ret = EOK;

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maederdone:

d210b655b5f93a0fff2eefbb94c072d450cef3b4Till Mossakowski talloc_free(tmp_ctx);

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder return ret;

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder}

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder

ba5c87b3f4a921f0932a08de48a3aedd3ca4d25bTill Mossakowskiad_gpo_parse_map_options(struct ad_access_ctx *access_ctx)

ba5c87b3f4a921f0932a08de48a3aedd3ca4d25bTill Mossakowski{

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder char *gpo_default_right_config;

7d5f239f3f1c1397e5d80caea12929bdf8abe2d8Christian Maeder enum gpo_map_type gpo_default_right;

e3c9174a782e90f965a0b080c22861c3ef5af12dTill Mossakowski errno_t ret;

ba5c87b3f4a921f0932a08de48a3aedd3ca4d25bTill Mossakowski int i;

ba5c87b3f4a921f0932a08de48a3aedd3ca4d25bTill Mossakowski

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder for (i = 0; i < GPO_MAP_NUM_OPTS; i++) {

b3dca469a9e267d6d71acfdeca7bf284d0581dc7Till Mossakowski

b3dca469a9e267d6d71acfdeca7bf284d0581dc7Till Mossakowski struct gpo_map_option_entry entry = gpo_map_option_entries[i];

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder

ba5c87b3f4a921f0932a08de48a3aedd3ca4d25bTill Mossakowski char *entry_config = dp_opt_get_string(access_ctx->ad_options,

be3f5e3e69900ececafea5b010a8400f26af5362Christian Maeder entry.ad_basic_opt);

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder

ba5c87b3f4a921f0932a08de48a3aedd3ca4d25bTill Mossakowski ret = ad_gpo_parse_map_option(access_ctx, entry.gpo_map_type,

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder access_ctx->gpo_map_options_table,

ba5c87b3f4a921f0932a08de48a3aedd3ca4d25bTill Mossakowski entry_config, entry.gpo_map_defaults);

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder

ba5c87b3f4a921f0932a08de48a3aedd3ca4d25bTill Mossakowski if (ret != EOK) {

c40822a6238ef14ebd3df830204c2790a68c8076Christian Maeder DEBUG(SSSDBG_OP_FAILURE, "Invalid configuration: %d\n", ret);

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder ret = EINVAL;

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder goto fail;

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder }

9192fdd8f0e682ac0f0183dd854d5210fbfa4ec5Christian Maeder }

ba5c87b3f4a921f0932a08de48a3aedd3ca4d25bTill Mossakowski

c30cfe2a6ab063befdfb47449bc286caee6d8fc3Christian Maeder /* default right (applicable for services without any mapping) */

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder gpo_default_right_config =

b3dca469a9e267d6d71acfdeca7bf284d0581dc7Till Mossakowski dp_opt_get_string(access_ctx->ad_options, AD_GPO_DEFAULT_RIGHT);

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder DEBUG(SSSDBG_TRACE_ALL, "gpo_default_right_config: %s\n",

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder gpo_default_right_config);

5b1394673f35f4d23cfe08175841ab414a39678eMarkus Roggenbach

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder /* if default right not set in config, set them to DENY */

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder if (gpo_default_right_config == NULL) {

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder gpo_default_right = GPO_MAP_DENY;

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder } else if (strncasecmp(gpo_default_right_config, "interactive",

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder strlen("interactive")) == 0) {

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder gpo_default_right = GPO_MAP_INTERACTIVE;

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder } else if (strncasecmp(gpo_default_right_config, "remote_interactive",

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder strlen("remote_interactive")) == 0) {

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder gpo_default_right = GPO_MAP_REMOTE_INTERACTIVE;

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder } else if (strncasecmp(gpo_default_right_config, "network",

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder strlen("network")) == 0) {

c5bc8d60f7c753f81746828329d9e92db1ab7abaChristian Maeder gpo_default_right = GPO_MAP_NETWORK;

22250d2b3c9f86fe19cba665d71c301de03db142Christian Maeder } else if (strncasecmp(gpo_default_right_config, "batch",

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder strlen("batch")) == 0) {

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder gpo_default_right = GPO_MAP_BATCH;

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder } else if (strncasecmp(gpo_default_right_config, "service",

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder strlen("service")) == 0) {

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder gpo_default_right = GPO_MAP_SERVICE;

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder } else if (strncasecmp(gpo_default_right_config, "permit",

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder strlen("permit")) == 0) {

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder gpo_default_right = GPO_MAP_PERMIT;

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder } else if (strncasecmp(gpo_default_right_config, "deny",

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder strlen("deny")) == 0) {

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder gpo_default_right = GPO_MAP_DENY;

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder } else {

5a87ed846cc38cb0e3adf8f736d95614d3e724a3Christian Maeder ret = EINVAL;

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder goto fail;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder }

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder DEBUG(SSSDBG_TRACE_ALL, "gpo_default_right: %d\n", gpo_default_right);

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder access_ctx->gpo_default_right = gpo_default_right;

1805f9816e3414ab184fb8546ab1abc6241f04cdChristian Maeder

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maederfail:

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder return ret;

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder}

2701083ab584807a8dec6f2c8bc03237a25d9809Christian Maeder

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder

1805f9816e3414ab184fb8546ab1abc6241f04cdChristian Maederstatic bool

1805f9816e3414ab184fb8546ab1abc6241f04cdChristian Maederad_gpo_dom_sid_equal(const struct dom_sid *sid1, const struct dom_sid *sid2)

1805f9816e3414ab184fb8546ab1abc6241f04cdChristian Maeder{

1805f9816e3414ab184fb8546ab1abc6241f04cdChristian Maeder int i;

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder

1805f9816e3414ab184fb8546ab1abc6241f04cdChristian Maeder if (sid1 == sid2) {

9efe0bf51725355f7a8be26dd44bb6a69212e7beChristian Maeder return true;

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder }

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder

1805f9816e3414ab184fb8546ab1abc6241f04cdChristian Maeder if (!sid1 || !sid2) {

1805f9816e3414ab184fb8546ab1abc6241f04cdChristian Maeder return false;

1805f9816e3414ab184fb8546ab1abc6241f04cdChristian Maeder }

1805f9816e3414ab184fb8546ab1abc6241f04cdChristian Maeder

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder if (sid1->sid_rev_num != sid2->sid_rev_num) {

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder return false;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder }

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder for (i = 0; i < 6; i++) {

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder if (sid1->id_auth[i] != sid2->id_auth[i]) {

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder return false;

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder }

2701083ab584807a8dec6f2c8bc03237a25d9809Christian Maeder }

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder

2701083ab584807a8dec6f2c8bc03237a25d9809Christian Maeder if (sid1->num_auths != sid2->num_auths) {

627ed7abdbae641636a2d0f2510c0d450f5ee915Christian Maeder return false;

2701083ab584807a8dec6f2c8bc03237a25d9809Christian Maeder }

2701083ab584807a8dec6f2c8bc03237a25d9809Christian Maeder

2701083ab584807a8dec6f2c8bc03237a25d9809Christian Maeder for (i = 0; i < sid1->num_auths; i++) {

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder if (sid1->sub_auths[i] != sid2->sub_auths[i]) {

2701083ab584807a8dec6f2c8bc03237a25d9809Christian Maeder return false;

52aad0502f0ddd332a28ae3fcd3327fa66d002f7Till Mossakowski }

52aad0502f0ddd332a28ae3fcd3327fa66d002f7Till Mossakowski }

52aad0502f0ddd332a28ae3fcd3327fa66d002f7Till Mossakowski

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder return true;

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder}

52aad0502f0ddd332a28ae3fcd3327fa66d002f7Till Mossakowski

52aad0502f0ddd332a28ae3fcd3327fa66d002f7Till Mossakowski

52aad0502f0ddd332a28ae3fcd3327fa66d002f7Till Mossakowskistatic errno_t

2701083ab584807a8dec6f2c8bc03237a25d9809Christian Maederad_gpo_get_sids(TALLOC_CTX *mem_ctx,

2701083ab584807a8dec6f2c8bc03237a25d9809Christian Maeder const char *user,

52aad0502f0ddd332a28ae3fcd3327fa66d002f7Till Mossakowski struct sss_domain_info *domain,

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder const char **_user_sid,

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder const char ***_group_sids,

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder int *_group_size)

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder{

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder TALLOC_CTX *tmp_ctx = NULL;

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder struct ldb_result *res;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder int ret = 0;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder int i = 0;

de66af0f4b27f08f81c7ca9c573ef9cdf7ca7a07Christian Maeder int num_group_sids = 0;

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder const char *user_sid = NULL;

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder const char *group_sid = NULL;

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder const char **group_sids = NULL;

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder tmp_ctx = talloc_new(NULL);

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder if (tmp_ctx == NULL) {

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder ret = ENOMEM;

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder goto done;

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder }

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder /* first result from sysdb_initgroups is user_sid; rest are group_sids */

62607bfd8541a700d18aee4f9cdb037aded5ab0bChristian Maeder ret = sysdb_initgroups(tmp_ctx, domain, user, &res);

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder if (ret != EOK) {

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder DEBUG(SSSDBG_OP_FAILURE,

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder "sysdb_initgroups failed: [%d](%s)\n",

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder ret, sss_strerror(ret));

1bc5dccbf0083a620ae1181c717fea75e4af5e5cChristian Maeder return ret;

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder }

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder if (res->count == 0) {

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder ret = ENOENT;

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder DEBUG(SSSDBG_OP_FAILURE,

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder "sysdb_initgroups returned empty result\n");

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder return ret;

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder }

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder

de66af0f4b27f08f81c7ca9c573ef9cdf7ca7a07Christian Maeder user_sid = ldb_msg_find_attr_as_string(res->msgs[0], SYSDB_SID_STR, NULL);

de66af0f4b27f08f81c7ca9c573ef9cdf7ca7a07Christian Maeder num_group_sids = (res->count) - 1;

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder

12368e292c1abf7eaf975f20ee30ef7820ac5dd5Christian Maeder /* include space for AD_AUTHENTICATED_USERS_SID and NULL */

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder group_sids = talloc_array(tmp_ctx, const char *, num_group_sids + 1 + 1);

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder if (group_sids == NULL) {

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder ret = ENOMEM;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder goto done;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder }

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder

37d0b201b8ba5d6056691e3055dd803e7928e163Christian Maeder for (i = 0; i < num_group_sids; i++) {

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder group_sid = ldb_msg_find_attr_as_string(res->msgs[i+1],

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder SYSDB_SID_STR, NULL);

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder if (group_sid == NULL) {

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder continue;

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder }

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder

1bc5dccbf0083a620ae1181c717fea75e4af5e5cChristian Maeder group_sids[i] = talloc_steal(group_sids, group_sid);

1bc5dccbf0083a620ae1181c717fea75e4af5e5cChristian Maeder if (group_sids[i] == NULL) {

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder ret = ENOMEM;

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder goto done;

7bf4436b6f9987b070033a323757b206c898c1beChristian Maeder }

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder }

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder group_sids[i++] = talloc_strdup(group_sids, AD_AUTHENTICATED_USERS_SID);

0c2a90cbfb63865ff485c3fbe20a14589a5914beTill Mossakowski group_sids[i] = NULL;

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder *_group_size = num_group_sids + 1;

79ee6b8eb396ed31807784a4bb1c9cc2ce094835Till Mossakowski *_group_sids = talloc_steal(mem_ctx, group_sids);

79ee6b8eb396ed31807784a4bb1c9cc2ce094835Till Mossakowski *_user_sid = talloc_steal(mem_ctx, user_sid);

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder return EOK;

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder done:

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder talloc_free(tmp_ctx);

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder return ret;

37d0b201b8ba5d6056691e3055dd803e7928e163Christian Maeder}

37d0b201b8ba5d6056691e3055dd803e7928e163Christian Maeder

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maederstatic errno_t

f8fe1f095d5b7fd96bde0784289b001446e60d0bChristian Maederad_gpo_ace_includes_client_sid(const char *user_sid,

f8fe1f095d5b7fd96bde0784289b001446e60d0bChristian Maeder const char **group_sids,

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder int group_size,

f8fe1f095d5b7fd96bde0784289b001446e60d0bChristian Maeder struct dom_sid ace_dom_sid,

f8fe1f095d5b7fd96bde0784289b001446e60d0bChristian Maeder struct sss_idmap_ctx *idmap_ctx,

f8fe1f095d5b7fd96bde0784289b001446e60d0bChristian Maeder bool *_included)

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder{

f8fe1f095d5b7fd96bde0784289b001446e60d0bChristian Maeder int i = 0;

f8fe1f095d5b7fd96bde0784289b001446e60d0bChristian Maeder struct dom_sid *user_dom_sid;

ecf557c0b4f953106755a239da2c0b168064d3f4Christian Maeder struct dom_sid *group_dom_sid;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder enum idmap_error_code err;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder bool included = false;

083a5256468076d5a9bfeb22a6e97076c224252eChristian Maeder

083a5256468076d5a9bfeb22a6e97076c224252eChristian Maeder err = sss_idmap_sid_to_smb_sid(idmap_ctx, user_sid, &user_dom_sid);

083a5256468076d5a9bfeb22a6e97076c224252eChristian Maeder if (err != IDMAP_SUCCESS) {

a89e661aad28f1b39f4fc9f9f9a4d46074234123Christian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "Failed to initialize idmap context.\n");

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder return EFAULT;

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder }

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder

a89e661aad28f1b39f4fc9f9f9a4d46074234123Christian Maeder included = ad_gpo_dom_sid_equal(&ace_dom_sid, user_dom_sid);

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder sss_idmap_free_smb_sid(idmap_ctx, user_dom_sid);

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder if (included) {

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder *_included = true;

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder return EOK;

f8fe1f095d5b7fd96bde0784289b001446e60d0bChristian Maeder }

c5653d37b37dcc025ff6dd1eada95ae67116e699Christian Maeder

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder for (i = 0; i < group_size; i++) {

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder err = sss_idmap_sid_to_smb_sid(idmap_ctx, group_sids[i], &group_dom_sid);

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder if (err != IDMAP_SUCCESS) {

f8fe1f095d5b7fd96bde0784289b001446e60d0bChristian Maeder DEBUG(SSSDBG_CRIT_FAILURE, "Failed to initialize idmap context.\n");

f8fe1f095d5b7fd96bde0784289b001446e60d0bChristian Maeder return EFAULT;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder }

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder included = ad_gpo_dom_sid_equal(&ace_dom_sid, group_dom_sid);

c528d35d975276f43d31dec4db9b4e1bf08e1fe2Christian Maeder sss_idmap_free_smb_sid(idmap_ctx, group_dom_sid);

c528d35d975276f43d31dec4db9b4e1bf08e1fe2Christian Maeder if (included) {

c528d35d975276f43d31dec4db9b4e1bf08e1fe2Christian Maeder *_included = true;

c528d35d975276f43d31dec4db9b4e1bf08e1fe2Christian Maeder return EOK;

c528d35d975276f43d31dec4db9b4e1bf08e1fe2Christian Maeder }

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder }

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder

691ca0c9c7b21d58170be61c9c58899c5594fb2fChristian Maeder *_included = false;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder return EOK;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder}

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maederstatic enum ace_eval_status ad_gpo_evaluate_ace(struct security_ace *ace,

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder struct sss_idmap_ctx *idmap_ctx,

691ca0c9c7b21d58170be61c9c58899c5594fb2fChristian Maeder const char *user_sid,

691ca0c9c7b21d58170be61c9c58899c5594fb2fChristian Maeder const char **group_sids,

c5653d37b37dcc025ff6dd1eada95ae67116e699Christian Maeder int group_size)

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder{

691ca0c9c7b21d58170be61c9c58899c5594fb2fChristian Maeder bool agp_included = false;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder bool included = false;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder int ret = 0;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder struct security_ace_object object;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder struct GUID ext_right_agp_guid;

13d0d9a3df7f3998f3c18c2fccbf2e3bbacbd4b5Christian Maeder

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder return AD_GPO_ACE_NEUTRAL;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder }

c5653d37b37dcc025ff6dd1eada95ae67116e699Christian Maeder

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder ret = ad_gpo_ace_includes_client_sid(user_sid, group_sids, group_size,

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder ace->trustee, idmap_ctx, &included);

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder

cdcca7a63a02d363730ee1060e2500343da76afaChristian Maeder if (ret != EOK) {

cdcca7a63a02d363730ee1060e2500343da76afaChristian Maeder return AD_GPO_ACE_DENIED;

cdcca7a63a02d363730ee1060e2500343da76afaChristian Maeder }

cdcca7a63a02d363730ee1060e2500343da76afaChristian Maeder

cdcca7a63a02d363730ee1060e2500343da76afaChristian Maeder if (!included) {

cdcca7a63a02d363730ee1060e2500343da76afaChristian Maeder return AD_GPO_ACE_NEUTRAL;

cdcca7a63a02d363730ee1060e2500343da76afaChristian Maeder }

cdcca7a63a02d363730ee1060e2500343da76afaChristian Maeder

cdcca7a63a02d363730ee1060e2500343da76afaChristian Maeder object = ace->object.object;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder GUID_from_string(AD_AGP_GUID, &ext_right_agp_guid);

c5653d37b37dcc025ff6dd1eada95ae67116e699Christian Maeder

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder if (object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) {

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder if (GUID_equal(&object.type.type, &ext_right_agp_guid)) {

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder agp_included = true;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder }

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder } else {

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder agp_included = false;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder }

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder if (ace->access_mask & SEC_ADS_CONTROL_ACCESS) {

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder if (agp_included) {

c5653d37b37dcc025ff6dd1eada95ae67116e699Christian Maeder if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {

1d10e9a6a3b03c7aa4306ff936ccaeacf474059aChristian Maeder return AD_GPO_ACE_ALLOWED;

1d10e9a6a3b03c7aa4306ff936ccaeacf474059aChristian Maeder } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT) {

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder return AD_GPO_ACE_DENIED;

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder }

3d774b4dfa0e459c1a3b08b4aa32c85aa4875362Christian Maeder }

1d10e9a6a3b03c7aa4306ff936ccaeacf474059aChristian Maeder }

1d10e9a6a3b03c7aa4306ff936ccaeacf474059aChristian Maeder

1d10e9a6a3b03c7aa4306ff936ccaeacf474059aChristian Maeder return AD_GPO_ACE_DENIED;

1d10e9a6a3b03c7aa4306ff936ccaeacf474059aChristian Maeder}

1d10e9a6a3b03c7aa4306ff936ccaeacf474059aChristian Maeder

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowskistatic errno_t ad_gpo_evaluate_dacl(struct security_acl *dacl,

3476beb5baf84bef7cc7d627b130de9d48700399Christian Maeder struct sss_idmap_ctx *idmap_ctx,

3476beb5baf84bef7cc7d627b130de9d48700399Christian Maeder const char *user_sid,

3476beb5baf84bef7cc7d627b130de9d48700399Christian Maeder const char **group_sids,

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski int group_size,

0dcb86310998e097d3b15608f980f0a89a11a322Christian Maeder bool *_dacl_access_allowed)

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski{

dbbcdfeafa68c87e0b2be0096788844e2be08345Christian Maeder uint32_t num_aces = 0;

410ff490af511ffa09b52e4de631d36a154b9730Christian Maeder enum ace_eval_status ace_status;

410ff490af511ffa09b52e4de631d36a154b9730Christian Maeder int i = 0;

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder struct security_ace *ace = NULL;

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder num_aces = dacl->num_aces;

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder /*

0dcb86310998e097d3b15608f980f0a89a11a322Christian Maeder if (num_aces == 0) {

0dcb86310998e097d3b15608f980f0a89a11a322Christian Maeder *_dacl_access_allowed = false;

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski return EOK;

88ece6e49930670e8fd3ee79c89a2e918d2fbd0cChristian Maeder }

3476beb5baf84bef7cc7d627b130de9d48700399Christian Maeder

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski for (i = 0; i < dacl->num_aces; i ++) {

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder ace = &dacl->aces[i];

7297175957c5ad3c0498032190b1dee9ec5fb873Christian Maeder

7297175957c5ad3c0498032190b1dee9ec5fb873Christian Maeder ace_status = ad_gpo_evaluate_ace(ace, idmap_ctx, user_sid,

7297175957c5ad3c0498032190b1dee9ec5fb873Christian Maeder group_sids, group_size);

64601796d2f62ffe61e9a5340dc569dd41dc2244Christian Maeder

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder switch (ace_status) {

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder case AD_GPO_ACE_NEUTRAL:

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder continue;

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder case AD_GPO_ACE_ALLOWED:

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder *_dacl_access_allowed = true;

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder return EOK;

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder case AD_GPO_ACE_DENIED:

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder *_dacl_access_allowed = false;

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder return EOK;

88ece6e49930670e8fd3ee79c89a2e918d2fbd0cChristian Maeder }

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski }

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder *_dacl_access_allowed = false;

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder return EOK;

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski}

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maederstatic errno_t

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maederad_gpo_filter_gpos_by_dacl(TALLOC_CTX *mem_ctx,

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski const char *user,

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski struct sss_domain_info *domain,

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder struct sss_idmap_ctx *idmap_ctx,

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski struct gp_gpo **candidate_gpos,

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder int num_candidate_gpos,

d8220f52119f85832e72228b82543fa638449eecChristian Maeder struct gp_gpo ***_dacl_filtered_gpos,

3cb09c6460a2262e392c759e363bf645f913a47aChristian Maeder int *_num_dacl_filtered_gpos)

1bc5dccbf0083a620ae1181c717fea75e4af5e5cChristian Maeder{

1bc5dccbf0083a620ae1181c717fea75e4af5e5cChristian Maeder TALLOC_CTX *tmp_ctx = NULL;

88ece6e49930670e8fd3ee79c89a2e918d2fbd0cChristian Maeder int i = 0;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder int ret = 0;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder struct gp_gpo *candidate_gpo = NULL;

89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder struct security_descriptor *sd = NULL;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder struct security_acl *dacl = NULL;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder const char *user_sid = NULL;

ed20c3b1e992d174a2cbb2077e61817527f8e061Christian Maeder const char **group_sids = NULL;

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder int group_size = 0;

f9690de9acb57e279b8ad5792d71b48ffbb807e7Christian Maeder int gpo_dn_idx = 0;

f9690de9acb57e279b8ad5792d71b48ffbb807e7Christian Maeder bool access_allowed = false;

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder struct gp_gpo **dacl_filtered_gpos = NULL;

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder

ed20c3b1e992d174a2cbb2077e61817527f8e061Christian Maeder tmp_ctx = talloc_new(NULL);

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder if (tmp_ctx == NULL) {

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder ret = ENOMEM;

6010f37233a15cb25960c86afaa4a23bbaa6a86cChristian Maeder goto done;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder }

1bc5dccbf0083a620ae1181c717fea75e4af5e5cChristian Maeder

4c7f058cdd19ce67b2b5d4b7f69703d0f8a21e38Christian Maeder ret = ad_gpo_get_sids(tmp_ctx, user, domain, &user_sid,

64601796d2f62ffe61e9a5340dc569dd41dc2244Christian Maeder &group_sids, &group_size);

58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski if (ret != EOK) {

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder ret = ERR_NO_SIDS;

64601796d2f62ffe61e9a5340dc569dd41dc2244Christian Maeder DEBUG(SSSDBG_OP_FAILURE,

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder "Unable to retrieve SIDs: [%d](%s)\n", ret, sss_strerror(ret));

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder goto done;

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder }

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder dacl_filtered_gpos = talloc_array(tmp_ctx,

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder struct gp_gpo *,

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder num_candidate_gpos + 1);

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder if (dacl_filtered_gpos == NULL) {

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder ret = ENOMEM;

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder goto done;

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder }

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder

ef2affdc0cdf3acd5c051597c04ab9b08a346a7dChristian Maeder for (i = 0; i < num_candidate_gpos; i++) {

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder access_allowed = false;

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder candidate_gpo = candidate_gpos[i];

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder sd = candidate_gpo->gpo_sd;

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder dacl = candidate_gpo->gpo_sd->dacl;

95c27038582e8a2ce24923bee69ef15931b8b87bChristian Maeder

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder DEBUG(SSSDBG_TRACE_ALL, "examining dacl candidate_gpo_guid:%s\n",

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder candidate_gpo->gpo_guid);

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder /* gpo_func_version must be set to version 2 */

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder if (candidate_gpo->gpo_func_version != 2) {

587fb54160b66128cf17e4c9bca7494a7f2c3c4aChristian Maeder DEBUG(SSSDBG_TRACE_ALL,

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder "GPO not applicable to target per security filtering\n");

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder continue;

6157bf81d295795067c177aa870fedff83cbe750Christian Maeder }

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder

a80f2865b6b40a922bcccfce0cb0d047edc33e3aChristian Maeder /* gpo_flags value of 2 means that GPO's computer portion is disabled */

587fb54160b66128cf17e4c9bca7494a7f2c3c4aChristian Maeder if (candidate_gpo->gpo_flags == 2) {

22dd6d9af47163ee081d6c505d0a13dbf40ba87aChristian Maeder DEBUG(SSSDBG_TRACE_ALL,

7297175957c5ad3c0498032190b1dee9ec5fb873Christian Maeder "GPO not applicable to target per security filtering\n");

b03274844ecd270f9e9331f51cc4236a33e2e671Christian Maeder continue;

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder }

0d0047d6eb457b56ff10987569769a420754a56fChristian Maeder

95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder /*

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder

dbbcdfeafa68c87e0b2be0096788844e2be08345Christian Maeder if ((!(sd->type & SEC_DESC_DACL_PRESENT)) || (dacl == NULL)) {

dbbcdfeafa68c87e0b2be0096788844e2be08345Christian Maeder DEBUG(SSSDBG_TRACE_ALL, "DACL is not present\n");

dbbcdfeafa68c87e0b2be0096788844e2be08345Christian Maeder access_allowed = true;

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder break;

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder }

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder ret = ad_gpo_evaluate_dacl(dacl, idmap_ctx, user_sid, group_sids,

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder group_size, &access_allowed);

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder if (ret != EOK) {

4a8f990902448d0562fbe1a98ce685ddbd531d38Christian Maeder DEBUG(SSSDBG_MINOR_FAILURE, "Could not determine if GPO is applicable\n");

4a8f990902448d0562fbe1a98ce685ddbd531d38Christian Maeder continue;

4a8f990902448d0562fbe1a98ce685ddbd531d38Christian Maeder }

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder

6b00a9239fe7c804524099ca3d25f4ffc6079ceeChristian Maeder if (access_allowed) {

6b00a9239fe7c804524099ca3d25f4ffc6079ceeChristian Maeder DEBUG(SSSDBG_TRACE_ALL,

4a8f990902448d0562fbe1a98ce685ddbd531d38Christian Maeder "GPO applicable to target per security filtering\n");

6b00a9239fe7c804524099ca3d25f4ffc6079ceeChristian Maeder dacl_filtered_gpos[gpo_dn_idx] = talloc_steal(dacl_filtered_gpos,

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder candidate_gpo);

6b00a9239fe7c804524099ca3d25f4ffc6079ceeChristian Maeder gpo_dn_idx++;

4a8f990902448d0562fbe1a98ce685ddbd531d38Christian Maeder } else {

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder DEBUG(SSSDBG_TRACE_ALL,

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder "GPO not applicable to target per security filtering\n");

46947810076241f06f3e2919edb2289ed84d6c15Christian Maeder continue;

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder }

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder }

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder

996a56a455d65cfac4ddedd44fd90cfc1ea849aeChristian Maeder dacl_filtered_gpos[gpo_dn_idx] = NULL;

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder *_dacl_filtered_gpos = talloc_steal(mem_ctx, dacl_filtered_gpos);

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder *_num_dacl_filtered_gpos = gpo_dn_idx;

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder

1af66b491a6164e07ac202abfa0d06c6c2462d64Christian Maeder ret = EOK;

6b00a9239fe7c804524099ca3d25f4ffc6079ceeChristian Maeder

done:

talloc_free(tmp_ctx);

return ret;

}

static bool

ad_gpo_includes_cse_guid(const char *cse_guid,

const char **gpo_cse_guids,

int num_gpo_cse_guids)

{

int i = 0;

const char *gpo_cse_guid = NULL;

for (i = 0; i < num_gpo_cse_guids; i++) {

gpo_cse_guid = gpo_cse_guids[i];

if (strcmp(gpo_cse_guid, cse_guid) == 0) {

return true;

}

}

return false;

}

static errno_t

ad_gpo_filter_gpos_by_cse_guid(TALLOC_CTX *mem_ctx,

const char *cse_guid,

struct gp_gpo **dacl_filtered_gpos,

int num_dacl_filtered_gpos,

struct gp_gpo ***_cse_filtered_gpos,

int *_num_cse_filtered_gpos)

{

TALLOC_CTX *tmp_ctx = NULL;

int i = 0;

int ret = 0;

struct gp_gpo *dacl_filtered_gpo = NULL;

int gpo_dn_idx = 0;

struct gp_gpo **cse_filtered_gpos = NULL;

bool included;

tmp_ctx = talloc_new(NULL);

if (tmp_ctx == NULL) {

ret = ENOMEM;

goto done;

}

cse_filtered_gpos = talloc_array(tmp_ctx,

struct gp_gpo *,

num_dacl_filtered_gpos + 1);

if (cse_filtered_gpos == NULL) {

ret = ENOMEM;

goto done;

}

for (i = 0; i < num_dacl_filtered_gpos; i++) {

dacl_filtered_gpo = dacl_filtered_gpos[i];

DEBUG(SSSDBG_TRACE_ALL, "examining cse candidate_gpo_guid: %s\n",

dacl_filtered_gpo->gpo_guid);

included = ad_gpo_includes_cse_guid(cse_guid,

dacl_filtered_gpo->gpo_cse_guids,

dacl_filtered_gpo->num_gpo_cse_guids);

if (included) {

DEBUG(SSSDBG_TRACE_ALL,

"GPO applicable to target per cse_guid filtering\n");

cse_filtered_gpos[gpo_dn_idx] = talloc_steal(cse_filtered_gpos,

dacl_filtered_gpo);

dacl_filtered_gpos[i] = NULL;

gpo_dn_idx++;

} else {

DEBUG(SSSDBG_TRACE_ALL,

"GPO not applicable to target per cse_guid filtering\n");

continue;

}

}

cse_filtered_gpos[gpo_dn_idx] = NULL;

*_cse_filtered_gpos = talloc_steal(mem_ctx, cse_filtered_gpos);

*_num_cse_filtered_gpos = gpo_dn_idx;

ret = EOK;

done:

talloc_free(tmp_ctx);

return ret;

}

static bool

check_rights(char **privilege_sids,

int privilege_size,

const char *user_sid,

const char **group_sids,

int group_size)

{

int i, j;

for (i = 0; i < privilege_size; i++) {

if (strcmp(user_sid, privilege_sids[i]) == 0) {

return true;

}

for (j = 0; j < group_size; j++) {

if (strcmp(group_sids[j], privilege_sids[i]) == 0) {

return true;

}

}

}

return false;

}

static errno_t

ad_gpo_extract_policy_setting(TALLOC_CTX *mem_ctx,

struct ini_cfgobj *ini_config,

const char *policy_setting_key,

char **_policy_setting_value)

{

struct value_obj *vobj = NULL;

int ret;

const char *policy_setting_value;

ret = ini_get_config_valueobj(RIGHTS_SECTION, policy_setting_key, ini_config,

INI_GET_FIRST_VALUE, &vobj);

if (ret != 0) {

DEBUG(SSSDBG_CRIT_FAILURE,

"ini_get_config_valueobj failed [%d][%s]\n", ret, strerror(ret));

goto done;

}

if (vobj == NULL) {

DEBUG(SSSDBG_TRACE_ALL, "section/name not found: [%s][%s]\n",

RIGHTS_SECTION, policy_setting_key);

ret = ENOENT;

goto done;

}

policy_setting_value = ini_get_string_config_value(vobj, &ret);

if (ret != 0) {

DEBUG(SSSDBG_CRIT_FAILURE,

"ini_get_string_config_value failed [%d][%s]\n",

ret, strerror(ret));

goto done;

}

if (policy_setting_value[0]) {

*_policy_setting_value = talloc_strdup(mem_ctx, policy_setting_value);

if (!*_policy_setting_value) {

ret = ENOMEM;

goto done;

}

} else {

/* This is an explicitly empty policy setting.

*_policy_setting_value = NULL;

}

ret = EOK;

done:

return ret;

}

static errno_t

ad_gpo_store_policy_settings(struct sss_domain_info *domain,

const char *filename)

{

struct ini_cfgfile *file_ctx = NULL;

struct ini_cfgobj *ini_config = NULL;

int ret;

int i;

char *allow_value = NULL;

char *deny_value = NULL;

const char *allow_key = NULL;

const char *deny_key = NULL;

TALLOC_CTX *tmp_ctx = NULL;

tmp_ctx = talloc_new(NULL);

if (tmp_ctx == NULL) {

ret = ENOMEM;

goto done;

}

ret = ini_config_create(&ini_config);

if (ret != 0) {

DEBUG(SSSDBG_CRIT_FAILURE,

"ini_config_create failed [%d][%s]\n", ret, strerror(ret));

goto done;

}

ret = ini_config_file_open(filename, 0, &file_ctx);

if (ret != 0) {

DEBUG(SSSDBG_CRIT_FAILURE,

"ini_config_file_open failed [%d][%s]\n", ret, strerror(ret));

goto done;

}

ret = ini_config_parse(file_ctx, INI_STOP_ON_NONE, 0, 0, ini_config);

if (ret != 0) {

DEBUG(SSSDBG_CRIT_FAILURE,

"ini_config_parse failed [%d][%s]\n", ret, strerror(ret));

goto done;

}

for (i = 0; i < GPO_MAP_NUM_OPTS; i++) {

struct gpo_map_option_entry entry = gpo_map_option_entries[i];

allow_key = entry.allow_key;

if (allow_key != NULL) {

DEBUG(SSSDBG_TRACE_ALL, "allow_key = %s\n", allow_key);

ret = ad_gpo_extract_policy_setting(tmp_ctx,

ini_config,

allow_key,

&allow_value);

if (ret != EOK && ret != ENOENT) {

DEBUG(SSSDBG_CRIT_FAILURE,

"ad_gpo_extract_policy_setting failed for %s [%d][%s]\n",

allow_key, ret, strerror(ret));

goto done;

} else if (ret != ENOENT) {

ret = sysdb_gpo_store_gpo_result_setting(domain,

allow_key,

allow_value);

if (ret != EOK) {

DEBUG(SSSDBG_CRIT_FAILURE,

"sysdb_gpo_store_gpo_result_setting failed for key:"

"'%s' value:'%s' [%d][%s]\n", allow_key, allow_value,

ret, sss_strerror(ret));

goto done;

}

}

}

deny_key = entry.deny_key;

if (deny_key != NULL) {

DEBUG(SSSDBG_TRACE_ALL, "deny_key = %s\n", deny_key);

ret = ad_gpo_extract_policy_setting(tmp_ctx,

ini_config,

deny_key,

&deny_value);

if (ret != EOK && ret != ENOENT) {

DEBUG(SSSDBG_CRIT_FAILURE,

"ad_gpo_extract_policy_setting failed for %s [%d][%s]\n",

deny_key, ret, strerror(ret));

goto done;

} else if (ret != ENOENT) {

ret = sysdb_gpo_store_gpo_result_setting(domain,

deny_key,

deny_value);

if (ret != EOK) {

DEBUG(SSSDBG_CRIT_FAILURE,

"sysdb_gpo_store_gpo_result_setting failed for key:"

"'%s' value:'%s' [%d][%s]\n", deny_key, deny_value,

ret, sss_strerror(ret));

goto done;

}

}

}

}

ret = EOK;

done:

if (ret != EOK) {

DEBUG(SSSDBG_CRIT_FAILURE, "Error encountered: %d.\n", ret);

}

ini_config_file_destroy(file_ctx);

ini_config_destroy(ini_config);

talloc_free(tmp_ctx);

return ret;

}

static errno_t

ad_gpo_access_check(TALLOC_CTX *mem_ctx,

enum gpo_access_control_mode gpo_mode,

enum gpo_map_type gpo_map_type,

const char *user,

struct sss_domain_info *domain,

char **allowed_sids,

int allowed_size,

char **denied_sids,

int denied_size)

{

const char *user_sid;

const char **group_sids;

int group_size = 0;

bool access_granted = false;

bool access_denied = false;

int ret;

int j;

DEBUG(SSSDBG_TRACE_FUNC, "RESULTANT POLICY:\n");

DEBUG(SSSDBG_TRACE_FUNC, "gpo_map_type: %s\n",

gpo_map_type_string(gpo_map_type));

DEBUG(SSSDBG_TRACE_FUNC, "allowed_size = %d\n", allowed_size);

for (j= 0; j < allowed_size; j++) {

DEBUG(SSSDBG_TRACE_FUNC, "allowed_sids[%d] = %s\n", j, allowed_sids[j]);

}

DEBUG(SSSDBG_TRACE_FUNC, "denied_size = %d\n", denied_size);

for (j= 0; j < denied_size; j++) {

DEBUG(SSSDBG_TRACE_FUNC, " denied_sids[%d] = %s\n", j, denied_sids[j]);

}

ret = ad_gpo_get_sids(mem_ctx, user, domain, &user_sid,

&group_sids, &group_size);

if (ret != EOK) {

ret = ERR_NO_SIDS;

DEBUG(SSSDBG_OP_FAILURE,

"Unable to retrieve SIDs: [%d](%s)\n", ret, sss_strerror(ret));

goto done;

}

DEBUG(SSSDBG_TRACE_FUNC, "CURRENT USER:\n");

DEBUG(SSSDBG_TRACE_FUNC, " user_sid = %s\n", user_sid);

for (j= 0; j < group_size; j++) {

DEBUG(SSSDBG_TRACE_FUNC, " group_sids[%d] = %s\n", j,

group_sids[j]);

}

if (allowed_size == 0) {

access_granted = true;

} else {

access_granted = check_rights(allowed_sids, allowed_size, user_sid,

group_sids, group_size);

}

DEBUG(SSSDBG_TRACE_FUNC, "POLICY DECISION:\n");

DEBUG(SSSDBG_TRACE_FUNC, " access_granted = %d\n", access_granted);

access_denied = check_rights(denied_sids, denied_size, user_sid,

group_sids, group_size);

DEBUG(SSSDBG_TRACE_FUNC, " access_denied = %d\n", access_denied);

if (access_granted && !access_denied) {

return EOK;

} else {

switch (gpo_mode) {

case GPO_ACCESS_CONTROL_ENFORCING:

return ERR_ACCESS_DENIED;

case GPO_ACCESS_CONTROL_PERMISSIVE:

DEBUG(SSSDBG_TRACE_FUNC, "access denied: permissive mode\n");

sss_log_ext(SSS_LOG_WARNING, LOG_AUTHPRIV, "Warning: user would " \

"have been denied GPO-based logon access if the " \

"ad_gpo_access_control option were set to enforcing " \

"mode.");

return EOK;

default:

return EINVAL;

}

}

done:

if (ret) {

DEBUG(SSSDBG_CRIT_FAILURE, "Error encountered: %d.\n", ret);

}

return ret;

}

#define GPO_CHILD_LOG_FILE "gpo_child"

static errno_t gpo_child_init(void)

{

return child_debug_init(GPO_CHILD_LOG_FILE, &gpo_child_debug_fd);

}

parse_policy_setting_value(TALLOC_CTX *mem_ctx,

struct sss_domain_info *domain,

const char *key,

char ***_sids_list,

int *_sids_list_size)

{

int ret;

int i;

const char *value;

int sids_list_size;

char **sids_list = NULL;

ret = sysdb_gpo_get_gpo_result_setting(mem_ctx, domain, key, &value);

if (ret == ENOENT) {

DEBUG(SSSDBG_TRACE_FUNC, "No previous GPO result\n");

value = NULL;

} else if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE,

"Cannot retrieve settings from sysdb for key: '%s' [%d][%s].\n",

key, ret, sss_strerror(ret));

goto done;

}

if (value == NULL) {