samba.git/libcli/security/access_check.c, branch master

libcli: Modernize a DEBUG

2024-12-17T12:30:30+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Pavel Filipenský

libcli: Make handling implicit_owner_rights bit easier to read

2024-12-17T12:30:30+00:00

The first time I came across this I missed the "FALL_THROUGH" and had
to look closely at what happens. I had expected
IMPLICIT_OWNER_READ_CONTROL_AND_WRITE_DAC_RIGHTS to grant two rights,
which to me is now more obvious. It was correct before, but to me this
is now more obvious. YMMV.

Signed-off-by: Volker Lendecke 
Reviewed-by: Pavel Filipenský

libcli/security: Make ‘replace_sid’ parameter const

2024-02-08T02:48:44+00:00

Signed-off-by: Jo Sutton 
Reviewed-by: Andrew Bartlett

libcli:security: Use SELF SID constant

2023-09-27T02:43:28+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

libcli/security: access_check handles CALLBACK_OBJECT types

2023-09-26T23:45:36+00:00

These are like an object type if the callback (i.e. condtional ACE
conditions) succeeds, otherwise they are ignored.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: se_access_check uses new callback checks

2023-09-26T23:45:36+00:00

With the last caller of check_callback_ace_access() gone, so is that
function.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: sec_access_check_ds uses new callback ACE checks

2023-09-26T23:45:36+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: access_check with MAXIMUM_ALLOWED checks callbacks

2023-09-26T23:45:36+00:00

To help clarify the logic, we make new functions that separate the
deny and allow cases, which helps keep track of what 'yes' and 'no'
mean and which incorporate the logic of token->evaluate_claims
handling, which determines when we want to run a conditional ACE, when
we want to ignore it, and when we want to take offence. In the case
when we decide to run it, we then need to decide whether to apply it
or ignore it based on the result. This last bit differs between allow
and deny aces, hence the two functions.

These functions will replace check_callback_ace_access() over the next
few commits.

In the case where token->evaluate_claims is
CLAIMS_EVALUATION_INVALID_STATE and the DACL contains a conditional
ACE, the maximum allowed is 0, as if it was a "deny everything" ACE.

This is an unexpected case. Most likely the evaluate_claims state
will be NEVER or ALWAYS. In the NEVER case the conditional ACE is
skipped, as would have happened in all cases before 4.20, while in the
ALWAYS case the conditional ACE is run and applied if successful.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

libcli/security: Hook in ability to disable conditional ACE evaluation

2023-09-26T23:45:36+00:00

Signed-off-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

libcli/security: conditional ace access checks for file server

2023-09-26T23:45:35+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett