lib/secdesc.c

ソースコードを見る。

関数
size_t	sec_desc_size (SEC_DESC *psd)
BOOL	sec_desc_equal (SEC_DESC *s1, SEC_DESC *s2)
SEC_DESC_BUF *	sec_desc_merge (TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb)
SEC_DESC *	make_sec_desc (TALLOC_CTX *ctx, uint16 revision, uint16 type, const DOM_SID *owner_sid, const DOM_SID *group_sid, SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size)
SEC_DESC *	dup_sec_desc (TALLOC_CTX *ctx, const SEC_DESC *src)
SEC_DESC *	make_standard_sec_desc (TALLOC_CTX *ctx, const DOM_SID *owner_sid, const DOM_SID *group_sid, SEC_ACL *dacl, size_t *sd_size)
SEC_DESC_BUF *	make_sec_desc_buf (TALLOC_CTX *ctx, size_t len, SEC_DESC *sec_desc)
SEC_DESC_BUF *	dup_sec_desc_buf (TALLOC_CTX *ctx, SEC_DESC_BUF *src)
NTSTATUS	sec_desc_add_sid (TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, uint32 mask, size_t *sd_size)
NTSTATUS	sec_desc_mod_sid (SEC_DESC *sd, DOM_SID *sid, uint32 mask)
NTSTATUS	sec_desc_del_sid (TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, size_t *sd_size)
SEC_DESC_BUF *	se_create_child_secdesc (TALLOC_CTX *ctx, SEC_DESC *parent_ctr, BOOL child_container)
void	init_sec_access (SEC_ACCESS *t, uint32 mask)
変数
generic_mapping	file_generic_mapping

---

関数

size_t sec_desc_size

(

SEC_DESC *

psd

)

secdesc.c の 39 行で定義されています。

参照先 security_descriptor_info::dacl・security_descriptor_info::group_sid・security_descriptor_info::owner_sid・security_descriptor_info::sacl・sid_size()・security_acl_info::size.

参照元 _svcctl_query_service_sec()・get_share_security()・init_srv_q_net_share_add()・nt_printing_getsec()・nt_printing_setsec()・regfio_write_key()・set_share_security()・sk_record_data_size()・smb_io_relsecdesc()・spoolss_size_printer_info_2()・spoolss_size_printer_info_3()・srv_io_share_info502_str().

{
        size_t offset;

        if (!psd) return 0;

        offset = SEC_DESC_HEADER_SIZE;

        /* don't align */

        if (psd->owner_sid != NULL)
                offset += sid_size(psd->owner_sid);

        if (psd->group_sid != NULL)
                offset += sid_size(psd->group_sid);

        if (psd->sacl != NULL)
                offset += psd->sacl->size;

        if (psd->dacl != NULL)
                offset += psd->dacl->size;

        return offset;
}

BOOL sec_desc_equal	(	SEC_DESC *	s1,
		SEC_DESC *	s2
	)

secdesc.c の 68 行で定義されています。

参照先 security_descriptor_info::dacl・security_descriptor_info::group_sid・security_descriptor_info::owner_sid・security_descriptor_info::revision・security_descriptor_info::sacl・sec_acl_equal()・sid_equal()・sid_to_string()・security_descriptor_info::type.

参照元 _srv_net_share_set_info()・compare_printer_secdesc()・find_sk_record_by_sec_desc()・update_printer_sec().

{
        /* Trivial case */

        if (!s1 && !s2) {
                goto done;
        }

        if (!s1 || !s2) {
                return False;
        }

        /* Check top level stuff */

        if (s1->revision != s2->revision) {
                DEBUG(10, ("sec_desc_equal(): revision differs (%d != %d)\n",
                           s1->revision, s2->revision));
                return False;
        }

        if (s1->type!= s2->type) {
                DEBUG(10, ("sec_desc_equal(): type differs (%d != %d)\n",
                           s1->type, s2->type));
                return False;
        }

        /* Check owner and group */

        if (!sid_equal(s1->owner_sid, s2->owner_sid)) {
                fstring str1, str2;

                sid_to_string(str1, s1->owner_sid);
                sid_to_string(str2, s2->owner_sid);

                DEBUG(10, ("sec_desc_equal(): owner differs (%s != %s)\n",
                           str1, str2));
                return False;
        }

        if (!sid_equal(s1->group_sid, s2->group_sid)) {
                fstring str1, str2;

                sid_to_string(str1, s1->group_sid);
                sid_to_string(str2, s2->group_sid);

                DEBUG(10, ("sec_desc_equal(): group differs (%s != %s)\n",
                           str1, str2));
                return False;
        }

        /* Check ACLs present in one but not the other */

        if ((s1->dacl && !s2->dacl) || (!s1->dacl && s2->dacl) ||
            (s1->sacl && !s2->sacl) || (!s1->sacl && s2->sacl)) {
                DEBUG(10, ("sec_desc_equal(): dacl or sacl not present\n"));
                return False;
        }

        /* Sigh - we have to do it the hard way by iterating over all
           the ACEs in the ACLs */

        if (!sec_acl_equal(s1->dacl, s2->dacl) ||
            !sec_acl_equal(s1->sacl, s2->sacl)) {
                DEBUG(10, ("sec_desc_equal(): dacl/sacl list not equal\n"));
                return False;
        }

 done:
        DEBUG(10, ("sec_desc_equal(): secdescs are identical\n"));
        return True;
}

SEC_DESC_BUF* sec_desc_merge	(	TALLOC_CTX *	ctx,
		SEC_DESC_BUF *	new_sdb,
		SEC_DESC_BUF *	old_sdb
	)

secdesc.c の 145 行で定義されています。

参照先 security_descriptor_info::dacl・security_descriptor_info::group_sid・make_sec_desc()・make_sec_desc_buf()・security_descriptor_info::owner_sid・security_descriptor_info::revision・sec_desc_buf_info::sec・security_descriptor_info::type.

参照元 update_printer_sec().

{
        DOM_SID *owner_sid, *group_sid;
        SEC_DESC_BUF *return_sdb;
        SEC_ACL *dacl, *sacl;
        SEC_DESC *psd = NULL;
        uint16 secdesc_type;
        size_t secdesc_size;

        /* Copy over owner and group sids.  There seems to be no flag for
           this so just check the pointer values. */

        owner_sid = new_sdb->sec->owner_sid ? new_sdb->sec->owner_sid :
                old_sdb->sec->owner_sid;

        group_sid = new_sdb->sec->group_sid ? new_sdb->sec->group_sid :
                old_sdb->sec->group_sid;
        
        secdesc_type = new_sdb->sec->type;

        /* Ignore changes to the system ACL.  This has the effect of making
           changes through the security tab audit button not sticking. 
           Perhaps in future Samba could implement these settings somehow. */

        sacl = NULL;
        secdesc_type &= ~SEC_DESC_SACL_PRESENT;

        /* Copy across discretionary ACL */

        if (secdesc_type & SEC_DESC_DACL_PRESENT) {
                dacl = new_sdb->sec->dacl;
        } else {
                dacl = old_sdb->sec->dacl;
        }

        /* Create new security descriptor from bits */

        psd = make_sec_desc(ctx, new_sdb->sec->revision, secdesc_type,
                            owner_sid, group_sid, sacl, dacl, &secdesc_size);

        return_sdb = make_sec_desc_buf(ctx, secdesc_size, psd);

        return(return_sdb);
}

SEC_DESC* make_sec_desc	(	TALLOC_CTX *	ctx,
		uint16	revision,
		uint16	type,
		const DOM_SID *	owner_sid,
		const DOM_SID *	group_sid,
		SEC_ACL *	sacl,
		SEC_ACL *	dacl,
		size_t *	sd_size
	)

secdesc.c の 194 行で定義されています。

参照先 security_descriptor_info::dacl・dup_sec_acl()・security_descriptor_info::group_sid・security_descriptor_info::off_dacl・security_descriptor_info::off_grp_sid・security_descriptor_info::off_owner_sid・security_descriptor_info::off_sacl・security_descriptor_info::owner_sid・security_descriptor_info::revision・security_descriptor_info::sacl・sid_dup_talloc()・sid_size()・security_acl_info::size・security_descriptor_info::type.

参照元 afs_to_nt_acl()・construct_default_printer_sdb()・construct_registry_sd()・construct_scm_sd()・construct_service_sd()・dup_sec_desc()・get_share_security_default()・lsa_get_generic_sd()・make_default_reg_sd()・make_samr_object_sd()・make_standard_sec_desc()・nt_printing_getsec()・nt_printing_setsec()・owner_set()・parse_acl_string()・parse_usershare_acl()・py_to_SECDESC()・rpccli_reg_create_key_ex()・samr_make_sam_obj_sd()・sec_desc_add_sid()・sec_desc_del_sid()・sec_desc_merge()・sec_desc_parse()・smb_get_nt_acl_nfs4().

{
        SEC_DESC *dst;
        uint32 offset     = 0;

        *sd_size = 0;

        if(( dst = TALLOC_ZERO_P(ctx, SEC_DESC)) == NULL)
                return NULL;

        dst->revision = revision;
        dst->type = type;

        if (sacl)
                dst->type |= SEC_DESC_SACL_PRESENT;
        if (dacl)
                dst->type |= SEC_DESC_DACL_PRESENT;

        dst->off_owner_sid = 0;
        dst->off_grp_sid   = 0;
        dst->off_sacl      = 0;
        dst->off_dacl      = 0;

        if(owner_sid && ((dst->owner_sid = sid_dup_talloc(ctx,owner_sid)) == NULL))
                goto error_exit;

        if(group_sid && ((dst->group_sid = sid_dup_talloc(ctx,group_sid)) == NULL))
                goto error_exit;

        if(sacl && ((dst->sacl = dup_sec_acl(ctx, sacl)) == NULL))
                goto error_exit;

        if(dacl && ((dst->dacl = dup_sec_acl(ctx, dacl)) == NULL))
                goto error_exit;

        offset = SEC_DESC_HEADER_SIZE;

        /*
         * Work out the linearization sizes.
         */

        if (dst->sacl != NULL) {
                dst->off_sacl = offset;
                offset += dst->sacl->size;
        }
        if (dst->dacl != NULL) {
                dst->off_dacl = offset;
                offset += dst->dacl->size;
        }

        if (dst->owner_sid != NULL) {
                dst->off_owner_sid = offset;
                offset += sid_size(dst->owner_sid);
        }

        if (dst->group_sid != NULL) {
                dst->off_grp_sid = offset;
                offset += sid_size(dst->group_sid);
        }

        *sd_size = (size_t)offset;
        return dst;

error_exit:

        *sd_size = 0;
        return NULL;
}

SEC_DESC* dup_sec_desc	(	TALLOC_CTX *	ctx,
		const SEC_DESC *	src
	)

secdesc.c の 269 行で定義されています。

参照先 security_descriptor_info::dacl・security_descriptor_info::group_sid・make_sec_desc()・security_descriptor_info::owner_sid・security_descriptor_info::revision・security_descriptor_info::sacl・security_descriptor_info::type.

参照元 cac_RegGetKeySecurity()・construct_printer_info_2()・construct_printer_info_3()・copy_registry_tree()・get_nt_acl_no_snum()・get_share_info()・make_sec_desc_buf()・rpc_printer_migrate_security_internals()・rpccli_srvsvc_net_share_enum()・rpccli_srvsvc_net_share_get_info()・spoolss_notify_security_desc()・svcctl_get_secdesc().

{
        size_t dummy;

        if(src == NULL)
                return NULL;

        return make_sec_desc( ctx, src->revision, src->type,
                                src->owner_sid, src->group_sid, src->sacl,
                                src->dacl, &dummy);
}

SEC_DESC* make_standard_sec_desc	(	TALLOC_CTX *	ctx,
		const DOM_SID *	owner_sid,
		const DOM_SID *	group_sid,
		SEC_ACL *	dacl,
		size_t *	sd_size
	)

secdesc.c の 285 行で定義されています。

参照先 make_sec_desc().

参照元 get_nt_acl()・get_null_nt_acl().

{
        return make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE,
                             owner_sid, group_sid, NULL, dacl, sd_size);
}

SEC_DESC_BUF* make_sec_desc_buf	(	TALLOC_CTX *	ctx,
		size_t	len,
		SEC_DESC *	sec_desc
	)

secdesc.c の 296 行で定義されています。

参照先 dup_sec_desc()・sec_desc_buf_info::len・sec_desc_buf_info::max_len・sec_desc_buf_info::ptr・sec_desc_buf_info::sec.

参照元 _lsa_query_secobj()・_samr_query_sec_obj()・construct_default_printer_sdb()・dup_sec_desc_buf()・init_srv_share_info_1501()・nt_printing_getsec()・nt_printing_setsec()・rpccli_reg_create_key_ex()・rpccli_reg_set_key_sec()・sec_desc_merge().

{
        SEC_DESC_BUF *dst;

        if((dst = TALLOC_ZERO_P(ctx, SEC_DESC_BUF)) == NULL)
                return NULL;

        /* max buffer size (allocated size) */
        dst->max_len = (uint32)len;
        dst->len = (uint32)len;
        
        if(sec_desc && ((dst->sec = dup_sec_desc(ctx, sec_desc)) == NULL)) {
                return NULL;
        }

        dst->ptr = 0x1;

        return dst;
}

SEC_DESC_BUF* dup_sec_desc_buf	(	TALLOC_CTX *	ctx,
		SEC_DESC_BUF *	src
	)

secdesc.c の 320 行で定義されています。

参照先 sec_desc_buf_info::len・make_sec_desc_buf()・sec_desc_buf_info::sec.

参照元 rpccli_samr_query_sec_obj().

{
        if(src == NULL)
                return NULL;

        return make_sec_desc_buf( ctx, src->len, src->sec);
}

NTSTATUS sec_desc_add_sid	(	TALLOC_CTX *	ctx,
		SEC_DESC **	psd,
		DOM_SID *	sid,
		uint32	mask,
		size_t *	sd_size
	)

secdesc.c の 332 行で定義されています。

参照先 security_acl_info::aces・security_descriptor_info::dacl・make_sec_acl()・make_sec_desc()・security_acl_info::num_aces・security_acl_info::revision・sec_ace_add_sid()・status・type.

{
        SEC_DESC *sd   = 0;
        SEC_ACL  *dacl = 0;
        SEC_ACE  *ace  = 0;
        NTSTATUS  status;

        if (!ctx || !psd || !sid || !sd_size)
                return NT_STATUS_INVALID_PARAMETER;

        *sd_size = 0;

        status = sec_ace_add_sid(ctx, &ace, psd[0]->dacl->aces, &psd[0]->dacl->num_aces, sid, mask);
        
        if (!NT_STATUS_IS_OK(status))
                return status;

        if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace)))
                return NT_STATUS_UNSUCCESSFUL;
        
        if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid, 
                psd[0]->group_sid, psd[0]->sacl, dacl, sd_size)))
                return NT_STATUS_UNSUCCESSFUL;

        *psd = sd;
         sd  = 0;
        return NT_STATUS_OK;
}

NTSTATUS sec_desc_mod_sid	(	SEC_DESC *	sd,
		DOM_SID *	sid,
		uint32	mask
	)

secdesc.c の 365 行で定義されています。

参照先 security_acl_info::aces・security_descriptor_info::dacl・security_acl_info::num_aces・sec_ace_mod_sid()・status.

{
        NTSTATUS status;

        if (!sd || !sid)
                return NT_STATUS_INVALID_PARAMETER;

        status = sec_ace_mod_sid(sd->dacl->aces, sd->dacl->num_aces, sid, mask);

        if (!NT_STATUS_IS_OK(status))
                return status;
        
        return NT_STATUS_OK;
}

NTSTATUS sec_desc_del_sid	(	TALLOC_CTX *	ctx,
		SEC_DESC **	psd,
		DOM_SID *	sid,
		size_t *	sd_size
	)

secdesc.c の 384 行で定義されています。

参照先 security_acl_info::aces・security_descriptor_info::dacl・make_sec_acl()・make_sec_desc()・security_acl_info::num_aces・security_acl_info::revision・sec_ace_del_sid()・status・type.

{
        SEC_DESC *sd   = 0;
        SEC_ACL  *dacl = 0;
        SEC_ACE  *ace  = 0;
        NTSTATUS  status;

        if (!ctx || !psd[0] || !sid || !sd_size)
                return NT_STATUS_INVALID_PARAMETER;

        *sd_size = 0;
        
        status = sec_ace_del_sid(ctx, &ace, psd[0]->dacl->aces, &psd[0]->dacl->num_aces, sid);

        if (!NT_STATUS_IS_OK(status))
                return status;

        if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace)))
                return NT_STATUS_UNSUCCESSFUL;
        
        if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid, 
                psd[0]->group_sid, psd[0]->sacl, dacl, sd_size)))
                return NT_STATUS_UNSUCCESSFUL;

        *psd = sd;
         sd  = 0;
        return NT_STATUS_OK;
}

SEC_DESC_BUF* se_create_child_secdesc	(	TALLOC_CTX *	ctx,
		SEC_DESC *	parent_ctr,
		BOOL	child_container
	)

secdesc.c の 417 行で定義されています。

参照先 security_acl_info::aces・security_descriptor_info::dacl・security_acl_info::num_aces・size.

参照元 print_access_check().

{
        SEC_DESC_BUF *sdb;
        SEC_DESC *sd;
        SEC_ACL *new_dacl, *the_acl;
        SEC_ACE *new_ace_list = NULL;
        unsigned int new_ace_list_ndx = 0, i;
        size_t size;

        /* Currently we only process the dacl when creating the child.  The
           sacl should also be processed but this is left out as sacls are
           not implemented in Samba at the moment.*/

        the_acl = parent_ctr->dacl;

        if (the_acl->num_aces) {
                if (!(new_ace_list = TALLOC_ARRAY(ctx, SEC_ACE, the_acl->num_aces))) 
                        return NULL;
        } else {
                new_ace_list = NULL;
        }

        for (i = 0; i < the_acl->num_aces; i++) {
                SEC_ACE *ace = &the_acl->aces[i];
                SEC_ACE *new_ace = &new_ace_list[new_ace_list_ndx];
                uint8 new_flags = 0;
                BOOL inherit = False;
                fstring sid_str;

                /* The OBJECT_INHERIT_ACE flag causes the ACE to be
                   inherited by non-container children objects.  Container
                   children objects will inherit it as an INHERIT_ONLY
                   ACE. */

                if (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) {

                        if (!child_container) {
                                new_flags |= SEC_ACE_FLAG_OBJECT_INHERIT;
                        } else {
                                new_flags |= SEC_ACE_FLAG_INHERIT_ONLY;
                        }

                        inherit = True;
                }

                /* The CONAINER_INHERIT_ACE flag means all child container
                   objects will inherit and use the ACE. */

                if (ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
                        if (!child_container) {
                                inherit = False;
                        } else {
                                new_flags |= SEC_ACE_FLAG_CONTAINER_INHERIT;
                        }
                }

                /* The INHERIT_ONLY_ACE is not used by the se_access_check()
                   function for the parent container, but is inherited by
                   all child objects as a normal ACE. */

                if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
                        /* Move along, nothing to see here */
                }

                /* The SEC_ACE_FLAG_NO_PROPAGATE_INHERIT flag means the ACE
                   is inherited by child objects but not grandchildren
                   objects.  We clear the object inherit and container
                   inherit flags in the inherited ACE. */

                if (ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) {
                        new_flags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT |
                                       SEC_ACE_FLAG_CONTAINER_INHERIT);
                }

                /* Add ACE to ACE list */

                if (!inherit)
                        continue;

                init_sec_access(&new_ace->access_mask, ace->access_mask);
                init_sec_ace(new_ace, &ace->trustee, ace->type,
                             new_ace->access_mask, new_flags);

                sid_to_string(sid_str, &ace->trustee);

                DEBUG(5, ("se_create_child_secdesc(): %s:%d/0x%02x/0x%08x "
                          " inherited as %s:%d/0x%02x/0x%08x\n", sid_str,
                          ace->type, ace->flags, ace->access_mask,
                          sid_str, new_ace->type, new_ace->flags,
                          new_ace->access_mask));

                new_ace_list_ndx++;
        }

        /* Create child security descriptor to return */
        
        new_dacl = make_sec_acl(ctx, ACL_REVISION, new_ace_list_ndx, new_ace_list);

        /* Use the existing user and group sids.  I don't think this is
           correct.  Perhaps the user and group should be passed in as
           parameters by the caller? */

        sd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE,
                           parent_ctr->owner_sid,
                           parent_ctr->group_sid,
                           parent_ctr->sacl,
                           new_dacl, &size);

        sdb = make_sec_desc_buf(ctx, size, sd);

        return sdb;
}

void init_sec_access	(	SEC_ACCESS *	t,
		uint32	mask
	)

secdesc.c の 535 行で定義されています。

参照元 afs_to_nt_acl()・construct_default_printer_sdb()・construct_registry_sd()・construct_scm_sd()・construct_service_sd()・get_nt_acl()・get_share_security_default()・lsa_get_generic_sd()・make_default_reg_sd()・make_samr_object_sd()・map_canon_ace_perms()・parse_usershare_acl()・samr_make_sam_obj_sd()・smbacl4_nfs42win().

{
        *t = mask;
}

---

変数

struct generic_mapping file_generic_mapping

初期値:

 {
        FILE_GENERIC_READ,
        FILE_GENERIC_WRITE,
        FILE_GENERIC_EXECUTE,
        FILE_GENERIC_ALL
}

secdesc.c の 28 行で定義されています。

参照元 create_canon_ace_lists()・get_share_security_default()・map_generic_share_sd_bits()・open_file_ntcreate()・parse_usershare_acl().

---