1 /*
2 * Unix SMB/CIFS implementation.
3 * Group Policy Object Support
4 * Copyright (C) Guenther Deschner 2005-2008
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "system/filesys.h"
22 #include "librpc/gen_ndr/ndr_misc.h"
23 #include "../librpc/gen_ndr/ndr_security.h"
24 #include "../libgpo/gpo.h"
25 #include "../libcli/security/security.h"
26 #include "registry.h"
27 #include "libgpo/gpo_proto.h"
28 #include "libgpo/gpext/gpext.h"
29
30 #if 0
31 #define DEFAULT_DOMAIN_POLICY "Default Domain Policy"
32 #define DEFAULT_DOMAIN_CONTROLLERS_POLICY "Default Domain Controllers Policy"
33 #endif
34
35 /* should we store a parsed guid ? */
36 struct gp_table {
37 const char *name;
38 const char *guid_string;
39 };
40
41 #if 0 /* unused */
42 static struct gp_table gpo_default_policy[] = {
43 { DEFAULT_DOMAIN_POLICY,
44 "31B2F340-016D-11D2-945F-00C04FB984F9" },
45 { DEFAULT_DOMAIN_CONTROLLERS_POLICY,
46 "6AC1786C-016F-11D2-945F-00C04fB984F9" },
47 { NULL, NULL }
48 };
49 #endif
50
51 /* the following is seen in gPCMachineExtensionNames / gPCUserExtensionNames */
52
53 static struct gp_table gpo_cse_extensions[] = {
54 /* used to be "Administrative Templates Extension" */
55 /* "Registry Settings"
56 (http://support.microsoft.com/kb/216357/EN-US/) */
57 { "Registry Settings",
58 GP_EXT_GUID_REGISTRY },
59 { "Microsoft Disc Quota",
60 "3610EDA5-77EF-11D2-8DC5-00C04FA31A66" },
61 { "EFS recovery",
62 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
63 { "Folder Redirection",
64 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
65 { "IP Security",
66 "E437BC1C-AA7D-11D2-A382-00C04F991E27" },
67 { "Internet Explorer Branding",
68 "A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B" },
69 { "QoS Packet Scheduler",
70 "426031c0-0b47-4852-b0ca-ac3d37bfcb39" },
71 { "Scripts",
72 GP_EXT_GUID_SCRIPTS },
73 { "Security",
74 GP_EXT_GUID_SECURITY },
75 { "Software Installation",
76 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
77 { "Wireless Group Policy",
78 "0ACDD40C-75AC-BAA0-BF6DE7E7FE63" },
79 { "Application Management",
80 "C6DC5466-785A-11D2-84D0-00C04FB169F7" },
81 { "unknown",
82 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
83 { NULL, NULL }
84 };
85
86 /* guess work */
87 static struct gp_table gpo_cse_snapin_extensions[] = {
88 { "Administrative Templates",
89 "0F6B957D-509E-11D1-A7CC-0000F87571E3" },
90 { "Certificates",
91 "53D6AB1D-2488-11D1-A28C-00C04FB94F17" },
92 { "EFS recovery policy processing",
93 "B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A" },
94 { "Folder Redirection policy processing",
95 "25537BA6-77A8-11D2-9B6C-0000F8080861" },
96 { "Folder Redirection",
97 "88E729D6-BDC1-11D1-BD2A-00C04FB9603F" },
98 { "Registry policy processing",
99 "35378EAC-683F-11D2-A89A-00C04FBBCFA2" },
100 { "Remote Installation Services",
101 "3060E8CE-7020-11D2-842D-00C04FA372D4" },
102 { "Security Settings",
103 "803E14A0-B4FB-11D0-A0D0-00A0C90F574B" },
104 { "Security policy processing",
105 "827D319E-6EAC-11D2-A4EA-00C04F79F83A" },
106 { "unknown",
107 "3060E8D0-7020-11D2-842D-00C04FA372D4" },
108 { "unknown2",
109 "53D6AB1B-2488-11D1-A28C-00C04FB94F17" },
110 { NULL, NULL }
111 };
112
113 /****************************************************************
114 ****************************************************************/
115
name_to_guid_string(const char * name,struct gp_table * table)116 static const char *name_to_guid_string(const char *name,
117 struct gp_table *table)
118 {
119 int i;
120
121 for (i = 0; table[i].name; i++) {
122 if (strequal(name, table[i].name)) {
123 return table[i].guid_string;
124 }
125 }
126
127 return NULL;
128 }
129
130 /****************************************************************
131 ****************************************************************/
132
guid_string_to_name(const char * guid_string,struct gp_table * table)133 static const char *guid_string_to_name(const char *guid_string,
134 struct gp_table *table)
135 {
136 int i;
137
138 for (i = 0; table[i].guid_string; i++) {
139 if (strequal(guid_string, table[i].guid_string)) {
140 return table[i].name;
141 }
142 }
143
144 return NULL;
145 }
146
147 /****************************************************************
148 ****************************************************************/
149
snapin_guid_string_to_name(const char * guid_string,struct gp_table * table)150 static const char *snapin_guid_string_to_name(const char *guid_string,
151 struct gp_table *table)
152 {
153 int i;
154 for (i = 0; table[i].guid_string; i++) {
155 if (strequal(guid_string, table[i].guid_string)) {
156 return table[i].name;
157 }
158 }
159 return NULL;
160 }
161
162 #if 0 /* unused */
163 static const char *default_gpo_name_to_guid_string(const char *name)
164 {
165 return name_to_guid_string(name, gpo_default_policy);
166 }
167
168 static const char *default_gpo_guid_string_to_name(const char *guid)
169 {
170 return guid_string_to_name(guid, gpo_default_policy);
171 }
172 #endif
173
174 /****************************************************************
175 ****************************************************************/
176
cse_gpo_guid_string_to_name(const char * guid)177 const char *cse_gpo_guid_string_to_name(const char *guid)
178 {
179 return guid_string_to_name(guid, gpo_cse_extensions);
180 }
181
182 /****************************************************************
183 ****************************************************************/
184
cse_gpo_name_to_guid_string(const char * name)185 const char *cse_gpo_name_to_guid_string(const char *name)
186 {
187 return name_to_guid_string(name, gpo_cse_extensions);
188 }
189
190 /****************************************************************
191 ****************************************************************/
192
cse_snapin_gpo_guid_string_to_name(const char * guid)193 const char *cse_snapin_gpo_guid_string_to_name(const char *guid)
194 {
195 return snapin_guid_string_to_name(guid, gpo_cse_snapin_extensions);
196 }
197
198 /****************************************************************
199 ****************************************************************/
200
dump_gp_ext(struct GP_EXT * gp_ext,int debuglevel)201 void dump_gp_ext(struct GP_EXT *gp_ext, int debuglevel)
202 {
203 int lvl = debuglevel;
204 int i;
205
206 if (gp_ext == NULL) {
207 return;
208 }
209
210 DEBUG(lvl,("\t---------------------\n\n"));
211 DEBUGADD(lvl,("\tname:\t\t\t%s\n", gp_ext->gp_extension));
212
213 for (i=0; i< gp_ext->num_exts; i++) {
214
215 DEBUGADD(lvl,("\textension:\t\t\t%s\n",
216 gp_ext->extensions_guid[i]));
217 DEBUGADD(lvl,("\textension (name):\t\t\t%s\n",
218 gp_ext->extensions[i]));
219
220 DEBUGADD(lvl,("\tsnapin:\t\t\t%s\n",
221 gp_ext->snapins_guid[i]));
222 DEBUGADD(lvl,("\tsnapin (name):\t\t\t%s\n",
223 gp_ext->snapins[i]));
224 }
225 }
226
227 #ifdef HAVE_LDAP
228
229 /****************************************************************
230 ****************************************************************/
231
dump_gpo(const struct GROUP_POLICY_OBJECT * gpo,int debuglevel)232 void dump_gpo(const struct GROUP_POLICY_OBJECT *gpo,
233 int debuglevel)
234 {
235 int lvl = debuglevel;
236 TALLOC_CTX *frame = talloc_stackframe();
237
238 if (gpo == NULL) {
239 goto out;
240 }
241
242 DEBUG(lvl,("---------------------\n\n"));
243
244 DEBUGADD(lvl,("name:\t\t\t%s\n", gpo->name));
245 DEBUGADD(lvl,("displayname:\t\t%s\n", gpo->display_name));
246 DEBUGADD(lvl,("version:\t\t%d (0x%08x)\n", gpo->version, gpo->version));
247 DEBUGADD(lvl,("version_user:\t\t%d (0x%04x)\n",
248 GPO_VERSION_USER(gpo->version),
249 GPO_VERSION_USER(gpo->version)));
250 DEBUGADD(lvl,("version_machine:\t%d (0x%04x)\n",
251 GPO_VERSION_MACHINE(gpo->version),
252 GPO_VERSION_MACHINE(gpo->version)));
253 DEBUGADD(lvl,("filesyspath:\t\t%s\n", gpo->file_sys_path));
254 DEBUGADD(lvl,("dspath:\t\t%s\n", gpo->ds_path));
255
256 DEBUGADD(lvl,("options:\t\t%d ", gpo->options));
257 switch (gpo->options) {
258 case GPFLAGS_ALL_ENABLED:
259 DEBUGADD(lvl,("GPFLAGS_ALL_ENABLED\n"));
260 break;
261 case GPFLAGS_USER_SETTINGS_DISABLED:
262 DEBUGADD(lvl,("GPFLAGS_USER_SETTINGS_DISABLED\n"));
263 break;
264 case GPFLAGS_MACHINE_SETTINGS_DISABLED:
265 DEBUGADD(lvl,("GPFLAGS_MACHINE_SETTINGS_DISABLED\n"));
266 break;
267 case GPFLAGS_ALL_DISABLED:
268 DEBUGADD(lvl,("GPFLAGS_ALL_DISABLED\n"));
269 break;
270 default:
271 DEBUGADD(lvl,("unknown option: %d\n", gpo->options));
272 break;
273 }
274
275 DEBUGADD(lvl,("link:\t\t\t%s\n", gpo->link));
276 DEBUGADD(lvl,("link_type:\t\t%d ", gpo->link_type));
277 switch (gpo->link_type) {
278 case GP_LINK_UNKOWN:
279 DEBUGADD(lvl,("GP_LINK_UNKOWN\n"));
280 break;
281 case GP_LINK_OU:
282 DEBUGADD(lvl,("GP_LINK_OU\n"));
283 break;
284 case GP_LINK_DOMAIN:
285 DEBUGADD(lvl,("GP_LINK_DOMAIN\n"));
286 break;
287 case GP_LINK_SITE:
288 DEBUGADD(lvl,("GP_LINK_SITE\n"));
289 break;
290 case GP_LINK_MACHINE:
291 DEBUGADD(lvl,("GP_LINK_MACHINE\n"));
292 break;
293 default:
294 break;
295 }
296
297 DEBUGADD(lvl,("machine_extensions:\t%s\n", gpo->machine_extensions));
298
299 if (gpo->machine_extensions) {
300
301 struct GP_EXT *gp_ext = NULL;
302
303 if (!ads_parse_gp_ext(frame, gpo->machine_extensions,
304 &gp_ext)) {
305 goto out;
306 }
307 dump_gp_ext(gp_ext, lvl);
308 }
309
310 DEBUGADD(lvl,("user_extensions:\t%s\n", gpo->user_extensions));
311
312 if (gpo->user_extensions) {
313
314 struct GP_EXT *gp_ext = NULL;
315
316 if (!ads_parse_gp_ext(frame, gpo->user_extensions,
317 &gp_ext)) {
318 goto out;
319 }
320 dump_gp_ext(gp_ext, lvl);
321 }
322 if (gpo->security_descriptor) {
323 DEBUGADD(lvl,("security descriptor:\n"));
324
325 NDR_PRINT_DEBUG(security_descriptor, gpo->security_descriptor);
326 }
327 out:
328 talloc_free(frame);
329 }
330
331 /****************************************************************
332 ****************************************************************/
333
dump_gpo_list(const struct GROUP_POLICY_OBJECT * gpo_list,int debuglevel)334 void dump_gpo_list(const struct GROUP_POLICY_OBJECT *gpo_list,
335 int debuglevel)
336 {
337 const struct GROUP_POLICY_OBJECT *gpo = NULL;
338
339 for (gpo = gpo_list; gpo; gpo = gpo->next) {
340 dump_gpo(gpo, debuglevel);
341 }
342 }
343
344 /****************************************************************
345 ****************************************************************/
346
dump_gplink(const struct GP_LINK * gp_link)347 void dump_gplink(const struct GP_LINK *gp_link)
348 {
349 int i;
350 int lvl = 10;
351
352 if (gp_link == NULL) {
353 return;
354 }
355
356 DEBUG(lvl,("---------------------\n\n"));
357
358 DEBUGADD(lvl,("gplink: %s\n", gp_link->gp_link));
359 DEBUGADD(lvl,("gpopts: %d ", gp_link->gp_opts));
360 switch (gp_link->gp_opts) {
361 case GPOPTIONS_INHERIT:
362 DEBUGADD(lvl,("GPOPTIONS_INHERIT\n"));
363 break;
364 case GPOPTIONS_BLOCK_INHERITANCE:
365 DEBUGADD(lvl,("GPOPTIONS_BLOCK_INHERITANCE\n"));
366 break;
367 default:
368 break;
369 }
370
371 DEBUGADD(lvl,("num links: %d\n", gp_link->num_links));
372
373 for (i = 0; i < gp_link->num_links; i++) {
374
375 DEBUGADD(lvl,("---------------------\n\n"));
376
377 DEBUGADD(lvl,("link: #%d\n", i + 1));
378 DEBUGADD(lvl,("name: %s\n", gp_link->link_names[i]));
379
380 DEBUGADD(lvl,("opt: %d ", gp_link->link_opts[i]));
381 if (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED) {
382 DEBUGADD(lvl,("GPO_LINK_OPT_ENFORCED "));
383 }
384 if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) {
385 DEBUGADD(lvl,("GPO_LINK_OPT_DISABLED"));
386 }
387 DEBUGADD(lvl,("\n"));
388 }
389 }
390
391 #endif /* HAVE_LDAP */
392
393 /****************************************************************
394 ****************************************************************/
395
gpo_get_gp_ext_from_gpo(TALLOC_CTX * mem_ctx,uint32_t flags,const struct GROUP_POLICY_OBJECT * gpo,struct GP_EXT ** gp_ext)396 bool gpo_get_gp_ext_from_gpo(TALLOC_CTX *mem_ctx,
397 uint32_t flags,
398 const struct GROUP_POLICY_OBJECT *gpo,
399 struct GP_EXT **gp_ext)
400 {
401 ZERO_STRUCTP(*gp_ext);
402
403 if (flags & GPO_INFO_FLAG_MACHINE) {
404
405 if (gpo->machine_extensions) {
406
407 if (!ads_parse_gp_ext(mem_ctx, gpo->machine_extensions,
408 gp_ext)) {
409 return false;
410 }
411 }
412 } else {
413
414 if (gpo->user_extensions) {
415
416 if (!ads_parse_gp_ext(mem_ctx, gpo->user_extensions,
417 gp_ext)) {
418 return false;
419 }
420 }
421 }
422
423 return true;
424 }
425
426 /****************************************************************
427 ****************************************************************/
428
gpo_process_gpo_list(TALLOC_CTX * mem_ctx,const struct security_token * token,const struct GROUP_POLICY_OBJECT * deleted_gpo_list,const struct GROUP_POLICY_OBJECT * changed_gpo_list,const char * extensions_guid_filter,uint32_t flags)429 NTSTATUS gpo_process_gpo_list(TALLOC_CTX *mem_ctx,
430 const struct security_token *token,
431 const struct GROUP_POLICY_OBJECT *deleted_gpo_list,
432 const struct GROUP_POLICY_OBJECT *changed_gpo_list,
433 const char *extensions_guid_filter,
434 uint32_t flags)
435 {
436 NTSTATUS status = NT_STATUS_OK;
437 struct registry_key *root_key = NULL;
438 struct gp_registry_context *reg_ctx = NULL;
439 WERROR werr;
440
441 /* get the key here */
442 if (flags & GPO_LIST_FLAG_MACHINE) {
443 werr = gp_init_reg_ctx(mem_ctx, KEY_HKLM, REG_KEY_WRITE,
444 get_system_token(),
445 ®_ctx);
446 } else {
447 werr = gp_init_reg_ctx(mem_ctx, KEY_HKCU, REG_KEY_WRITE,
448 token,
449 ®_ctx);
450 }
451 if (!W_ERROR_IS_OK(werr)) {
452 talloc_free(reg_ctx);
453 return werror_to_ntstatus(werr);
454 }
455
456 root_key = reg_ctx->curr_key;
457
458 status = gpext_process_extension(mem_ctx,
459 flags, token, root_key,
460 deleted_gpo_list,
461 changed_gpo_list,
462 extensions_guid_filter);
463 talloc_free(reg_ctx);
464 talloc_free(root_key);
465 gpext_free_gp_extensions();
466
467 return status;
468 }
469
470
471 /****************************************************************
472 check whether the version number in a GROUP_POLICY_OBJECT match those of the
473 locally stored version. If not, fetch the required policy via CIFS
474 ****************************************************************/
475
check_refresh_gpo(ADS_STRUCT * ads,TALLOC_CTX * mem_ctx,const char * cache_dir,uint32_t flags,const struct GROUP_POLICY_OBJECT * gpo)476 NTSTATUS check_refresh_gpo(ADS_STRUCT *ads,
477 TALLOC_CTX *mem_ctx,
478 const char *cache_dir,
479 uint32_t flags,
480 const struct GROUP_POLICY_OBJECT *gpo)
481 {
482 NTSTATUS result;
483 char *server = NULL;
484 char *share = NULL;
485 char *nt_path = NULL;
486 char *unix_path = NULL;
487 uint32_t sysvol_gpt_version = 0;
488 char *display_name = NULL;
489
490 result = gpo_explode_filesyspath(mem_ctx, cache_dir, gpo->file_sys_path,
491 &server, &share, &nt_path, &unix_path);
492
493 if (!NT_STATUS_IS_OK(result)) {
494 goto out;
495 }
496
497 result = gpo_get_sysvol_gpt_version(mem_ctx,
498 unix_path,
499 &sysvol_gpt_version,
500 &display_name);
501 if (!NT_STATUS_IS_OK(result) &&
502 !NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_FILE)) {
503 DEBUG(10,("check_refresh_gpo: "
504 "failed to get local gpt version: %s\n",
505 nt_errstr(result)));
506 goto out;
507 }
508
509 DEBUG(10,("check_refresh_gpo: versions gpo %d sysvol %d\n",
510 gpo->version, sysvol_gpt_version));
511
512 /* FIXME: handle GPO_INFO_FLAG_FORCED_REFRESH from flags */
513
514 while (gpo->version > sysvol_gpt_version) {
515
516 DEBUG(1,("check_refresh_gpo: need to refresh GPO\n"));
517
518 result = gpo_fetch_files(mem_ctx, ads, cache_dir, gpo);
519 if (!NT_STATUS_IS_OK(result)) {
520 goto out;
521 }
522
523 result = gpo_get_sysvol_gpt_version(mem_ctx,
524 unix_path,
525 &sysvol_gpt_version,
526 &display_name);
527 if (!NT_STATUS_IS_OK(result)) {
528 DEBUG(10,("check_refresh_gpo: "
529 "failed to get local gpt version: %s\n",
530 nt_errstr(result)));
531 goto out;
532 }
533
534 if (gpo->version == sysvol_gpt_version) {
535 break;
536 }
537 }
538
539 DEBUG(10,("Name:\t\t\t%s (%s)\n", gpo->display_name, gpo->name));
540 DEBUGADD(10,("sysvol GPT version:\t%d (user: %d, machine: %d)\n",
541 sysvol_gpt_version,
542 GPO_VERSION_USER(sysvol_gpt_version),
543 GPO_VERSION_MACHINE(sysvol_gpt_version)));
544 DEBUGADD(10,("LDAP GPO version:\t%d (user: %d, machine: %d)\n",
545 gpo->version,
546 GPO_VERSION_USER(gpo->version),
547 GPO_VERSION_MACHINE(gpo->version)));
548 DEBUGADD(10,("LDAP GPO link:\t\t%s\n", gpo->link));
549
550 result = NT_STATUS_OK;
551
552 out:
553 return result;
554
555 }
556
557 /****************************************************************
558 check whether the version numbers in the gpo_list match the locally stored, if
559 not, go and get each required GPO via CIFS
560 ****************************************************************/
561
check_refresh_gpo_list(ADS_STRUCT * ads,TALLOC_CTX * mem_ctx,const char * cache_dir,uint32_t flags,const struct GROUP_POLICY_OBJECT * gpo_list)562 NTSTATUS check_refresh_gpo_list(ADS_STRUCT *ads,
563 TALLOC_CTX *mem_ctx,
564 const char *cache_dir,
565 uint32_t flags,
566 const struct GROUP_POLICY_OBJECT *gpo_list)
567 {
568 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
569 const struct GROUP_POLICY_OBJECT *gpo;
570
571 if (!gpo_list) {
572 return NT_STATUS_INVALID_PARAMETER;
573 }
574
575 for (gpo = gpo_list; gpo; gpo = gpo->next) {
576
577 result = check_refresh_gpo(ads, mem_ctx, cache_dir, flags, gpo);
578 if (!NT_STATUS_IS_OK(result)) {
579 goto out;
580 }
581 }
582
583 result = NT_STATUS_OK;
584
585 out:
586 /* FIXME close cli connection */
587
588 return result;
589 }
590
591 /****************************************************************
592 ****************************************************************/
593
gpo_get_unix_path(TALLOC_CTX * mem_ctx,const char * cache_dir,const struct GROUP_POLICY_OBJECT * gpo,char ** unix_path)594 NTSTATUS gpo_get_unix_path(TALLOC_CTX *mem_ctx,
595 const char *cache_dir,
596 const struct GROUP_POLICY_OBJECT *gpo,
597 char **unix_path)
598 {
599 char *server, *share, *nt_path;
600 return gpo_explode_filesyspath(mem_ctx, cache_dir, gpo->file_sys_path,
601 &server, &share, &nt_path, unix_path);
602 }
603
604 /****************************************************************
605 ****************************************************************/
606
gpo_flag_str(TALLOC_CTX * ctx,uint32_t flags)607 char *gpo_flag_str(TALLOC_CTX *ctx, uint32_t flags)
608 {
609 char *str = NULL;
610
611 if (flags == 0) {
612 return NULL;
613 }
614
615 str = talloc_strdup(ctx, "");
616 if (!str) {
617 return NULL;
618 }
619
620 if (flags & GPO_INFO_FLAG_SLOWLINK)
621 str = talloc_strdup_append(str, "GPO_INFO_FLAG_SLOWLINK ");
622 if (flags & GPO_INFO_FLAG_VERBOSE)
623 str = talloc_strdup_append(str, "GPO_INFO_FLAG_VERBOSE ");
624 if (flags & GPO_INFO_FLAG_SAFEMODE_BOOT)
625 str = talloc_strdup_append(str, "GPO_INFO_FLAG_SAFEMODE_BOOT ");
626 if (flags & GPO_INFO_FLAG_NOCHANGES)
627 str = talloc_strdup_append(str, "GPO_INFO_FLAG_NOCHANGES ");
628 if (flags & GPO_INFO_FLAG_MACHINE)
629 str = talloc_strdup_append(str, "GPO_INFO_FLAG_MACHINE ");
630 if (flags & GPO_INFO_FLAG_LOGRSOP_TRANSITION)
631 str = talloc_strdup_append(str, "GPO_INFO_FLAG_LOGRSOP_TRANSITION ");
632 if (flags & GPO_INFO_FLAG_LINKTRANSITION)
633 str = talloc_strdup_append(str, "GPO_INFO_FLAG_LINKTRANSITION ");
634 if (flags & GPO_INFO_FLAG_FORCED_REFRESH)
635 str = talloc_strdup_append(str, "GPO_INFO_FLAG_FORCED_REFRESH ");
636 if (flags & GPO_INFO_FLAG_BACKGROUND)
637 str = talloc_strdup_append(str, "GPO_INFO_FLAG_BACKGROUND ");
638
639 return str;
640 }
641
642 /****************************************************************
643 ****************************************************************/
644
gp_find_file(TALLOC_CTX * mem_ctx,uint32_t flags,const char * filename,const char * suffix,const char ** filename_out)645 NTSTATUS gp_find_file(TALLOC_CTX *mem_ctx,
646 uint32_t flags,
647 const char *filename,
648 const char *suffix,
649 const char **filename_out)
650 {
651 const char *tmp = NULL;
652 struct stat sbuf;
653 const char *path = NULL;
654
655 if (flags & GPO_LIST_FLAG_MACHINE) {
656 path = "Machine";
657 } else {
658 path = "User";
659 }
660
661 tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
662 path, suffix);
663 NT_STATUS_HAVE_NO_MEMORY(tmp);
664
665 if (stat(tmp, &sbuf) == 0) {
666 *filename_out = tmp;
667 return NT_STATUS_OK;
668 }
669
670 path = talloc_strdup_upper(mem_ctx, path);
671 NT_STATUS_HAVE_NO_MEMORY(path);
672
673 tmp = talloc_asprintf(mem_ctx, "%s/%s/%s", filename,
674 path, suffix);
675 NT_STATUS_HAVE_NO_MEMORY(tmp);
676
677 if (stat(tmp, &sbuf) == 0) {
678 *filename_out = tmp;
679 return NT_STATUS_OK;
680 }
681
682 return NT_STATUS_NO_SUCH_FILE;
683 }
684
685 /****************************************************************
686 ****************************************************************/
687
gp_get_machine_token(ADS_STRUCT * ads,TALLOC_CTX * mem_ctx,const char * dn,struct security_token ** token)688 ADS_STATUS gp_get_machine_token(ADS_STRUCT *ads,
689 TALLOC_CTX *mem_ctx,
690 const char *dn,
691 struct security_token **token)
692 {
693 #ifdef HAVE_ADS
694 struct security_token *ad_token = NULL;
695 ADS_STATUS status;
696 NTSTATUS ntstatus;
697
698 status = ads_get_sid_token(ads, mem_ctx, dn, &ad_token);
699 if (!ADS_ERR_OK(status)) {
700 return status;
701 }
702 ntstatus = merge_nt_token(mem_ctx, ad_token, get_system_token(),
703 token);
704 if (!NT_STATUS_IS_OK(ntstatus)) {
705 return ADS_ERROR_NT(ntstatus);
706 }
707 return ADS_SUCCESS;
708 #else
709 return ADS_ERROR_NT(NT_STATUS_NOT_SUPPORTED);
710 #endif
711 }
712
713 /****************************************************************
714 ****************************************************************/
715
gpo_copy(TALLOC_CTX * mem_ctx,const struct GROUP_POLICY_OBJECT * gpo_src,struct GROUP_POLICY_OBJECT ** gpo_dst)716 NTSTATUS gpo_copy(TALLOC_CTX *mem_ctx,
717 const struct GROUP_POLICY_OBJECT *gpo_src,
718 struct GROUP_POLICY_OBJECT **gpo_dst)
719 {
720 struct GROUP_POLICY_OBJECT *gpo;
721
722 gpo = talloc_zero(mem_ctx, struct GROUP_POLICY_OBJECT);
723 NT_STATUS_HAVE_NO_MEMORY(gpo);
724
725 gpo->options = gpo_src->options;
726 gpo->version = gpo_src->version;
727
728 gpo->ds_path = talloc_strdup(gpo, gpo_src->ds_path);
729 if (gpo->ds_path == NULL) {
730 TALLOC_FREE(gpo);
731 return NT_STATUS_NO_MEMORY;
732 }
733
734 gpo->file_sys_path = talloc_strdup(gpo, gpo_src->file_sys_path);
735 if (gpo->file_sys_path == NULL) {
736 TALLOC_FREE(gpo);
737 return NT_STATUS_NO_MEMORY;
738 }
739
740 gpo->display_name = talloc_strdup(gpo, gpo_src->display_name);
741 if (gpo->display_name == NULL) {
742 TALLOC_FREE(gpo);
743 return NT_STATUS_NO_MEMORY;
744 }
745
746 gpo->name = talloc_strdup(gpo, gpo_src->name);
747 if (gpo->name == NULL) {
748 TALLOC_FREE(gpo);
749 return NT_STATUS_NO_MEMORY;
750 }
751
752 gpo->link = talloc_strdup(gpo, gpo_src->link);
753 if (gpo->link == NULL) {
754 TALLOC_FREE(gpo);
755 return NT_STATUS_NO_MEMORY;
756 }
757
758 gpo->link_type = gpo_src->link_type;
759
760 if (gpo_src->user_extensions) {
761 gpo->user_extensions = talloc_strdup(gpo, gpo_src->user_extensions);
762 if (gpo->user_extensions == NULL) {
763 TALLOC_FREE(gpo);
764 return NT_STATUS_NO_MEMORY;
765 }
766 }
767
768 if (gpo_src->machine_extensions) {
769 gpo->machine_extensions = talloc_strdup(gpo, gpo_src->machine_extensions);
770 if (gpo->machine_extensions == NULL) {
771 TALLOC_FREE(gpo);
772 return NT_STATUS_NO_MEMORY;
773 }
774 }
775
776 if (gpo_src->security_descriptor == NULL) {
777 /* existing SD assumed */
778 TALLOC_FREE(gpo);
779 return NT_STATUS_INVALID_PARAMETER;
780 }
781 gpo->security_descriptor = security_descriptor_copy(gpo,
782 gpo_src->security_descriptor);
783 if (gpo->security_descriptor == NULL) {
784 TALLOC_FREE(gpo);
785 return NT_STATUS_NO_MEMORY;
786 }
787
788 gpo->next = gpo->prev = NULL;
789
790 *gpo_dst = gpo;
791
792 return NT_STATUS_OK;
793 }
794