From 376d3bc005324dac1477e9149e7e2460e2889fdb Mon Sep 17 00:00:00 2001 From: REIM THOMAS Date: Jan 03 2020 23:30:20 +0000 Subject: [PATCH 1/5] GPO: Grant access if DACL is not present We falsely stopped GPO processing when Group Policy Container in AD did not contain a DACL or "DACL Present" bit was not set. Such GPOs are considered to be applicable according to MS-ADTS: https://msdn.microsoft.com/en-us/library/cc223518.aspx. Resolves: https://pagure.io/SSSD/sssd/issue/3324 Signed-off-by: REIM THOMAS --- diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c index 7442f27..df103d4 100644 --- a/src/providers/ad/ad_gpo.c +++ b/src/providers/ad/ad_gpo.c @@ -915,23 +915,22 @@ ad_gpo_filter_gpos_by_dacl(TALLOC_CTX *mem_ctx, continue; } - /* - * [MS-ADTS] 5.1.3.3.4: - * If the security descriptor has no DACL or its "DACL Present" bit - * is not set, then grant requester the requested control access right. - */ + if (((sd->type & SEC_DESC_DACL_PRESENT)) && (dacl != NULL)) { + ret = ad_gpo_evaluate_dacl(dacl, idmap_ctx, user_sid, group_sids, + group_size, &access_allowed); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, "Could not determine if GPO is applicable\n"); + continue; + } + } else { + /* + * [MS-ADTS] 5.1.3.3.4: + * If the security descriptor has no DACL or its "DACL Present" bit + * is not set, then grant requester the requested control access right. + */ - if ((!(sd->type & SEC_DESC_DACL_PRESENT)) || (dacl == NULL)) { DEBUG(SSSDBG_TRACE_ALL, "DACL is not present\n"); access_allowed = true; - break; - } - - ret = ad_gpo_evaluate_dacl(dacl, idmap_ctx, user_sid, group_sids, - group_size, &access_allowed); - if (ret != EOK) { - DEBUG(SSSDBG_MINOR_FAILURE, "Could not determine if GPO is applicable\n"); - continue; } if (access_allowed) { From 37fb261e707537c7d031f7a9e7374ea42929577a Mon Sep 17 00:00:00 2001 From: REIM THOMAS Date: Jan 03 2020 23:30:20 +0000 Subject: [PATCH 2/5] GPO: Support group policy file main folders with upper case name There are AD domain controller implementations that use upper case names for the main folder on SYSVOL under which group policy files and templates are stored. E. g. 'MACHINE' instead of 'Machine'. gpo_child uses library libsmbclient to copy group policy files from the AD domain controller into a local GPO cache directory. libsmbclient does not allow to request the domain controller to perform case insensitive SMB URI lookups, if SYSVOL is located on a case sensitive file system. If a group policy template is stored under main folder 'MACHINE' gpo_child cannot retrieve the policy data and exits with error code 2 (No such file or directory). GPO based access control fails with error 22 (Invalid argument) and users may not be able to login. GP_EXT_GUID_SECURITY_SUFFIX constant defines a case sensitive main folder name (/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf) for the policy template to retrieve. If the group policy file cannot be retrieved, gpo_child will now also try to retrieve the file using an upper case main folder name, i.e. /MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf. Resolves: https://pagure.io/SSSD/sssd/issue/3324 Signed-off-by: REIM THOMAS --- diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c index a0bd6e1..154a576 100644 --- a/src/providers/ad/ad_gpo_child.c +++ b/src/providers/ad/ad_gpo_child.c @@ -23,6 +23,7 @@ */ #include +#include #include #include #include @@ -529,6 +530,7 @@ copy_smb_file_to_gpo_cache(SMBCCTX *smbc_ctx, const char *smb_cse_suffix) { char *smb_uri = NULL; + char *gpt_main_folder = NULL; SMBCFILE *file; int ret; uint8_t *buf = NULL; @@ -554,10 +556,38 @@ copy_smb_file_to_gpo_cache(SMBCCTX *smbc_ctx, errno = 0; file = smbc_getFunctionOpen(smbc_ctx)(smbc_ctx, smb_uri, O_RDONLY, 0755); if (file == NULL) { - ret = errno; - DEBUG(SSSDBG_CRIT_FAILURE, "smbc_getFunctionOpen failed [%d][%s]\n", - ret, strerror(ret)); - goto done; + /* + * DCs may use upper case names for the main folder, where GPTs are + * stored. libsmbclient does not allow us to request case insensitive + * file name lookups on DCs with case sensitive file systems. + */ + gpt_main_folder = strstr(smb_uri, "/Machine/"); + if (gpt_main_folder == NULL) { + /* At this moment we do not use any GPO from user settings, + * but it can change in the future so let's keep the following + * line around to make this part of the code 'just work' also + * with the user GPO settings. */ + gpt_main_folder = strstr(smb_uri, "/User/"); + } + if (gpt_main_folder != NULL) { + ++gpt_main_folder; + while (gpt_main_folder != NULL && *gpt_main_folder != '/') { + *gpt_main_folder = toupper(*gpt_main_folder); + ++gpt_main_folder; + } + + DEBUG(SSSDBG_TRACE_FUNC, "smb_uri: %s\n", smb_uri); + + errno = 0; + file = smbc_getFunctionOpen(smbc_ctx)(smbc_ctx, smb_uri, O_RDONLY, 0755); + } + + if (file == NULL) { + ret = errno; + DEBUG(SSSDBG_CRIT_FAILURE, "smbc_getFunctionOpen failed [%d][%s]\n", + ret, strerror(ret)); + goto done; + } } buf = talloc_array(tmp_ctx, uint8_t, SMB_BUFFER_SIZE); From e9da361de516462845ada839bee4c362873ae03f Mon Sep 17 00:00:00 2001 From: REIM THOMAS Date: Jan 03 2020 23:30:20 +0000 Subject: [PATCH 3/5] GPO: Close group policy file after copying The SMB protocol sequence for copying the content of group policy files should be: - smbc_getFunctionOpen() - smbc_getFunctionRead() - smbc_getFunctionClose(). Inform the AD server, that we do not need further access to a policy file after we have copied its content. Resolves: https://pagure.io/SSSD/sssd/issue/3324 Signed-off-by: REIM THOMAS --- diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c index 154a576..a6137e2 100644 --- a/src/providers/ad/ad_gpo_child.c +++ b/src/providers/ad/ad_gpo_child.c @@ -531,7 +531,7 @@ copy_smb_file_to_gpo_cache(SMBCCTX *smbc_ctx, { char *smb_uri = NULL; char *gpt_main_folder = NULL; - SMBCFILE *file; + SMBCFILE *file = NULL; int ret; uint8_t *buf = NULL; int buflen = 0; @@ -617,6 +617,10 @@ copy_smb_file_to_gpo_cache(SMBCCTX *smbc_ctx, } done: + if (file != NULL) { + smbc_getFunctionClose(smbc_ctx)(smbc_ctx, file); + } + talloc_free(tmp_ctx); return ret; } From 62fad0ef51dc4c7249bfad9b34aa8461855c8467 Mon Sep 17 00:00:00 2001 From: REIM THOMAS Date: Jan 03 2020 23:30:20 +0000 Subject: [PATCH 4/5] GPO: Group policy access evaluation not in line with [MS-ADTS] The implemented security ACE evaluation algorithm is too strict and does not meet Microsoft technical specifications: Security access rights for a group policy object may be split into several access control entries (ACE). The implemented algorithm does not consider this and denies access to GPOs, where the "ApplyGroupPolicy" (AGP) ACE is preceded by a standard access rights ACE. The algorithm also denies access, if the AGP ACE is preceded by other extended object ACEs. Update security access right evaluation algorithms to be in line with the applicable Microsoft technical specifications: - Add a simple evaluation algorithm to check standard access rights for the complete GPO ([MS-ADTS] 5.1.3.3.2 and [MS-GOPD] 2.4): The requester must have been granted read access (RIGHT_DS_READ_PROPERTY) to the properties of the GPO - Fix the "ApplyGroupPolicy" evaluation algorithm to be in line with [MS-ADTS] 5.1.3.3.4 Further improve debug messages during security filtering for administrators to figure out why access to a GPO was denied: - Inform administrators when a GPO with applicable AGP access right has not been evaluated due to missing or denied read access. - Show the trustee's SID that specifies the particular user or group for which GPO access has been denied - Align message content to Microsoft tool like Gpresult Resolves: https://pagure.io/SSSD/sssd/issue/3324 Signed-off-by: REIM THOMAS --- diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c index df103d4..4380241 100644 --- a/src/providers/ad/ad_gpo.c +++ b/src/providers/ad/ad_gpo.c @@ -134,7 +134,7 @@ struct gp_gpo { const char *policy_filename; }; -enum ace_eval_status { +enum ace_eval_agp_status { AD_GPO_ACE_DENIED, AD_GPO_ACE_ALLOWED, AD_GPO_ACE_NEUTRAL @@ -698,40 +698,55 @@ ad_gpo_ace_includes_client_sid(const char *user_sid, } /* - * This function determines whether use of the extended right - * named "ApplyGroupPolicy" (AGP) is allowed, by comparing the specified - * user_sid and group_sids against the specified access control entry (ACE). + * This function determines whether use of the extended right named + * "ApplyGroupPolicy" (AGP) is allowed for the GPO, by comparing the + * specified user_sid and group_sids against the passed access control + * entry (ACE). * This function returns ALLOWED, DENIED, or NEUTRAL depending on whether * the ACE explicitly allows, explicitly denies, or does neither. * - * Note that the 'M' abbreviation used in the evaluation algorithm stands for - * "access_mask", which represents the set of access rights associated with an - * individual ACE. The access right of interest to the GPO code is + * Notes: + * (1) Abbreviation 'M' used in the evaluation algorithm stands for + * "access_mask", which represents the set of access rights associated with + * the passed ACE. The access right of interest to the GPO code is * RIGHT_DS_CONTROL_ACCESS, which serves as a container for all control access * rights. The specific control access right is identified by a GUID in the * ACE's ObjectType. In our case, this is the GUID corresponding to AGP. + * (2) ACE that require an evaluation algorithm different from [MS-ADTS] + * 5.1.3.3.4, e. g. RIGHT_DS_CONTROL_ACCESS (CR) is not present in M, are + * ignored. * * The ACE evaluation algorithm is specified in [MS-ADTS] 5.1.3.3.4: - * - Deny access by default - * - If the "Inherit Only" (IO) flag is set in the ACE, skip the ACE. - * - If the SID in the ACE does not match any SID in the requester's - * security context, skip the ACE - * - If the ACE type is "Object Access Allowed", the access right - * RIGHT_DS_CONTROL_ACCESS (CR) is present in M, and the ObjectType - * field in the ACE is either not present OR contains a GUID value equal - * to AGP, then grant requested control access right. Stop access checking. - * - If the ACE type is "Object Access Denied", the access right - * RIGHT_DS_CONTROL_ACCESS (CR) is present in M, and the ObjectType - * field in the ACE is either not present OR contains a GUID value equal to - * AGP, then deny the requested control access right. Stop access checking. + * Evaluate the DACL by examining each ACE in sequence, starting with the first + * ACE. Perform the following sequence of actions for each ACE in the order as + * shown: + * 1. If the "Inherit Only" (IO) flag is set in the ACE, skip the ACE. + * 2. If the SID in the ACE does not match any SID in the requester's + * security context, skip the ACE. + * 3. If the ACE type is "Object Access Allowed", the access right + * RIGHT_DS_CONTROL_ACCESS (CR) is present in M, and the ObjectType + * field in the ACE is not present, then grant the requested control + * access right. Stop any further access checks. + * 4. If the ACE type is "Object Access Allowed" the access right + * RIGHT_DS_CONTROL_ACCESS (CR) is present in M, and the ObjectType + * field in the ACE contains a GUID value equal to AGP, then grant + * the requested control access right. Stop any further access checks. + * 5. If the ACE type is "Object Access Denied", the access right + * RIGHT_DS_CONTROL_ACCESS (CR) is present in M, and the ObjectType + * field in the ACE is not present, then deny the requested control + * access right. Stop any further access checks. + * 6. If the ACE type is "Object Access Denied" the access right + * RIGHT_DS_CONTROL_ACCESS (CR) is present in M, and the ObjectType + * field in the ACE contains a GUID value equal to AGP, then deny + * the requested control access right. Stop any further access checks. */ -static enum ace_eval_status ad_gpo_evaluate_ace(struct security_ace *ace, - struct sss_idmap_ctx *idmap_ctx, - const char *user_sid, - const char **group_sids, - int group_size) +static enum ace_eval_agp_status +ad_gpo_evaluate_agp_ace(struct security_ace *ace, + struct sss_idmap_ctx *idmap_ctx, + const char *user_sid, + const char **group_sids, + int group_size) { - bool agp_included = false; bool included = false; int ret = 0; struct security_ace_object object; @@ -752,36 +767,100 @@ static enum ace_eval_status ad_gpo_evaluate_ace(struct security_ace *ace, return AD_GPO_ACE_NEUTRAL; } - object = ace->object.object; - GUID_from_string(AD_AGP_GUID, &ext_right_agp_guid); - - if (object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) { - if (GUID_equal(&object.type.type, &ext_right_agp_guid)) { - agp_included = true; - } - } else { - agp_included = false; - } - if (ace->access_mask & SEC_ADS_CONTROL_ACCESS) { - if (agp_included) { - if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) { - return AD_GPO_ACE_ALLOWED; - } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT) { - return AD_GPO_ACE_DENIED; + object = ace->object.object; + if (object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) { + GUID_from_string(AD_AGP_GUID, &ext_right_agp_guid); + if (!GUID_equal(&object.type.type, &ext_right_agp_guid)) { + return AD_GPO_ACE_NEUTRAL; } } + if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) { + return AD_GPO_ACE_ALLOWED; + } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT) { + return AD_GPO_ACE_DENIED; + } } - return AD_GPO_ACE_DENIED; + return AD_GPO_ACE_NEUTRAL; } /* + * This function evaluates, which standard access rights the passed access + * control entry (ACE) allows or denies for the entire GPO. + * + * Notes: + * (1) Abbreviation 'M' used in the evaluation algorithm stands for + * "access_mask", which represents the set of access rights associated with + * the passed ACE. + * (2) Abbreviation 'G' used in the evaluation algorithm stands for + * "granted rights", which represents the set of access rights, that + * have already been granted by previously evaluated ACEs. + * (3) Abbreviation 'D' used in the evaluation algorithm stands for + * "denied rights", which represents the set of access rights, that + * have already been explicitly denied by previously evaluated ACEs. + * + * The simple ACE evaluation algorithm is specified in [MS-ADTS] 5.1.3.3.2: + * Evaluate the DACL by examining each ACE in sequence, starting with the first + * ACE. Perform the following sequence of actions for each ACE in the order as + * shown: + * 1. If the "Inherit Only" (IO) flag is set in the ACE, skip the ACE. + * 2. If the SID in the ACE does not match any SID in the requester's + * security context, skip the ACE. + * 3. If the ACE type is "Access Denied" and the access rights in M + * are not in G, then add the rights in M to D. + * 4. If the ACE type is "Access Allowed" and the access rights in M + * are not in D, then add the rights in M to G. + */ +static errno_t ad_gpo_simple_evaluate_ace(struct security_ace *ace, + struct sss_idmap_ctx *idmap_ctx, + const char *user_sid, + const char **group_sids, + int group_size, + uint32_t *_gpo_access_granted_status, + uint32_t *_gpo_access_denied_status) +{ + bool included = false; + uint32_t filtered_access_rights = 0; + int ret = 0; + + if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) { + return EOK; + } + + ret = ad_gpo_ace_includes_client_sid(user_sid, group_sids, group_size, + ace->trustee, idmap_ctx, &included); + + if (ret != EOK || !included) { + return ret; + } + + if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) { + filtered_access_rights = ace->access_mask & ~*_gpo_access_granted_status; + *_gpo_access_denied_status |= filtered_access_rights; + } else if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) { + filtered_access_rights = ace->access_mask & ~*_gpo_access_denied_status; + *_gpo_access_granted_status |= filtered_access_rights; + } + + return ret; +} + + +/* * This function extracts the GPO's DACL (discretionary access control list) * from the GPO's specified security descriptor, and determines whether * the GPO is applicable to the policy target, by comparing the specified * user_sid and group_sids against each access control entry (ACE) in the DACL. - * The boolean result is assigned to the _access_allowed output parameter. + * The GPO is only applicable to the target, if the requester has been granted + * read access (RIGHT_DS_READ_PROPERTY) to the properties of the GPO and + * control access (RIGHT_DS_CONTROL_ACCESS) to apply the GPO (AGP). + * The required read and control access rights for a particular trustee are + * usually located in different ACEs, i.e. one ACE for control of read access + * and one for control access. + * If it comes to the end of the DACL, and the required access is still not + * explicitly allowed or denied, SSSD denies access to the object as specified + * in [MS-ADTS] 5.1.3.1. */ static errno_t ad_gpo_evaluate_dacl(struct security_acl *dacl, struct sss_idmap_ctx *idmap_ctx, @@ -791,14 +870,19 @@ static errno_t ad_gpo_evaluate_dacl(struct security_acl *dacl, bool *_dacl_access_allowed) { uint32_t num_aces = 0; - enum ace_eval_status ace_status; - int i = 0; + uint32_t access_granted_status = 0; + uint32_t access_denied_status = 0; + enum ace_eval_agp_status ace_status; struct security_ace *ace = NULL; + int i = 0; + int ret = 0; + enum idmap_error_code err; + char *trustee_dom_sid_str = NULL; num_aces = dacl->num_aces; /* - * [MS-ADTS] 5.1.3.3.4: + * [MS-ADTS] 5.1.3.3.2. and 5.1.3.3.4: * If the DACL does not have any ACE, then deny the requester the * requested control access right. */ @@ -807,22 +891,83 @@ static errno_t ad_gpo_evaluate_dacl(struct security_acl *dacl, return EOK; } + /* + * [MS-GOPD] 2.4: + * To process a policy that applies to a Group Policy client, the core + * Group Policy engine must be able to read the policy data from the + * directory service so that the policy settings can be applied to the + * Group Policy client or the interactive user. + */ + for (i = 0; i < dacl->num_aces; i++) { + ace = &dacl->aces[i]; + + ret = ad_gpo_simple_evaluate_ace(ace, idmap_ctx, user_sid, + group_sids, group_size, + &access_granted_status, + &access_denied_status); + + if (ret != EOK) { + err = sss_idmap_smb_sid_to_sid(idmap_ctx, &ace->trustee, + &trustee_dom_sid_str); + if (err != IDMAP_SUCCESS) { + DEBUG(SSSDBG_OP_FAILURE, + " sss_idmap_smb_sid_to_sid failed.\n"); + return EFAULT; + } + + DEBUG(SSSDBG_MINOR_FAILURE, + " Could not determine if ACE is applicable; " + " Trustee: %s\n", trustee_dom_sid_str); + sss_idmap_free_sid(idmap_ctx, trustee_dom_sid_str); + trustee_dom_sid_str = NULL; + continue; + } + } + for (i = 0; i < dacl->num_aces; i ++) { ace = &dacl->aces[i]; - ace_status = ad_gpo_evaluate_ace(ace, idmap_ctx, user_sid, - group_sids, group_size); + err = sss_idmap_smb_sid_to_sid(idmap_ctx, &ace->trustee, + &trustee_dom_sid_str); + if (err != IDMAP_SUCCESS) { + DEBUG(SSSDBG_OP_FAILURE, " sss_idmap_smb_sid_to_sid failed.\n"); + return EFAULT; + } + + ace_status = ad_gpo_evaluate_agp_ace(ace, idmap_ctx, user_sid, + group_sids, group_size); switch (ace_status) { case AD_GPO_ACE_NEUTRAL: - continue; + break; case AD_GPO_ACE_ALLOWED: - *_dacl_access_allowed = true; - return EOK; + if (access_granted_status & SEC_ADS_READ_PROP) { + *_dacl_access_allowed = true; + sss_idmap_free_sid(idmap_ctx, trustee_dom_sid_str); + return EOK; + } else { + DEBUG(SSSDBG_TRACE_ALL, + " GPO read properties access denied (security); " + " Trustee: %s\n", trustee_dom_sid_str); + break; + } case AD_GPO_ACE_DENIED: - *_dacl_access_allowed = false; - return EOK; + if (access_granted_status & SEC_ADS_READ_PROP) { + DEBUG(SSSDBG_TRACE_ALL, + " GPO denied (security); " + " Trustee: %s\n", trustee_dom_sid_str); + sss_idmap_free_sid(idmap_ctx, trustee_dom_sid_str); + *_dacl_access_allowed = false; + return EOK; + } else { + DEBUG(SSSDBG_TRACE_ALL, + " GPO read properties access denied (security); " + " Trustee: %s\n", trustee_dom_sid_str); + break; + } } + sss_idmap_free_sid(idmap_ctx, trustee_dom_sid_str); + trustee_dom_sid_str = NULL; } *_dacl_access_allowed = false; From bc87101731aef0f2b7c5a21f261110ae42124616 Mon Sep 17 00:00:00 2001 From: REIM THOMAS Date: Jan 03 2020 23:30:20 +0000 Subject: [PATCH 5/5] GPO: Improve logging of GPO security filtering GPO security filtering is as critical as the actual logon policy rights checking. Administrators should not only be able to figure out, why GPO access check granted or denied a user login, but also why a GPO access check was not performed due to security filtering. GPO access check can be logged using debug level Function Data, whereas GPO security filtering can only be logged with lowest level tracing. - Debug the main security filtering activities on level Function Data - Debug missing security descriptor as minor failure, because it terminates GPO security filtering. Resolves: https://pagure.io/SSSD/sssd/issue/3324 Signed-off-by: REIM THOMAS --- diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c index 4380241..89df385 100644 --- a/src/providers/ad/ad_gpo.c +++ b/src/providers/ad/ad_gpo.c @@ -911,12 +911,12 @@ static errno_t ad_gpo_evaluate_dacl(struct security_acl *dacl, &trustee_dom_sid_str); if (err != IDMAP_SUCCESS) { DEBUG(SSSDBG_OP_FAILURE, - " sss_idmap_smb_sid_to_sid failed.\n"); + "sss_idmap_smb_sid_to_sid failed.\n"); return EFAULT; } DEBUG(SSSDBG_MINOR_FAILURE, - " Could not determine if ACE is applicable; " + "Could not determine if ACE is applicable; " " Trustee: %s\n", trustee_dom_sid_str); sss_idmap_free_sid(idmap_ctx, trustee_dom_sid_str); trustee_dom_sid_str = NULL; @@ -930,7 +930,7 @@ static errno_t ad_gpo_evaluate_dacl(struct security_acl *dacl, err = sss_idmap_smb_sid_to_sid(idmap_ctx, &ace->trustee, &trustee_dom_sid_str); if (err != IDMAP_SUCCESS) { - DEBUG(SSSDBG_OP_FAILURE, " sss_idmap_smb_sid_to_sid failed.\n"); + DEBUG(SSSDBG_OP_FAILURE, "sss_idmap_smb_sid_to_sid failed.\n"); return EFAULT; } @@ -946,22 +946,22 @@ static errno_t ad_gpo_evaluate_dacl(struct security_acl *dacl, sss_idmap_free_sid(idmap_ctx, trustee_dom_sid_str); return EOK; } else { - DEBUG(SSSDBG_TRACE_ALL, - " GPO read properties access denied (security); " + DEBUG(SSSDBG_TRACE_FUNC, + "GPO read properties access denied (security); " " Trustee: %s\n", trustee_dom_sid_str); break; } case AD_GPO_ACE_DENIED: if (access_granted_status & SEC_ADS_READ_PROP) { - DEBUG(SSSDBG_TRACE_ALL, - " GPO denied (security); " + DEBUG(SSSDBG_TRACE_FUNC, + "GPO denied (security); " " Trustee: %s\n", trustee_dom_sid_str); sss_idmap_free_sid(idmap_ctx, trustee_dom_sid_str); *_dacl_access_allowed = false; return EOK; } else { - DEBUG(SSSDBG_TRACE_ALL, - " GPO read properties access denied (security); " + DEBUG(SSSDBG_TRACE_FUNC, + "GPO read properties access denied (security); " " Trustee: %s\n", trustee_dom_sid_str); break; } @@ -970,6 +970,11 @@ static errno_t ad_gpo_evaluate_dacl(struct security_acl *dacl, trustee_dom_sid_str = NULL; } + if (access_granted_status & SEC_ADS_READ_PROP) { + DEBUG(SSSDBG_TRACE_FUNC, + "GPO apply group policy access denied (security)\n"); + } + *_dacl_access_allowed = false; return EOK; } @@ -1032,12 +1037,12 @@ ad_gpo_filter_gpos_by_dacl(TALLOC_CTX *mem_ctx, access_allowed = false; candidate_gpo = candidate_gpos[i]; - DEBUG(SSSDBG_TRACE_ALL, "examining dacl candidate_gpo_guid:%s\n", - candidate_gpo->gpo_guid); + DEBUG(SSSDBG_TRACE_FUNC, "examining dacl candidate_gpo_guid:%s\n", + candidate_gpo->gpo_guid); /* gpo_func_version must be set to version 2 */ if (candidate_gpo->gpo_func_version != 2) { - DEBUG(SSSDBG_TRACE_ALL, + DEBUG(SSSDBG_TRACE_FUNC, "GPO not applicable to target per security filtering: " "gPCFunctionalityVersion is not 2\n"); continue; @@ -1045,7 +1050,7 @@ ad_gpo_filter_gpos_by_dacl(TALLOC_CTX *mem_ctx, sd = candidate_gpo->gpo_sd; if (sd == NULL) { - DEBUG(SSSDBG_TRACE_ALL, "Security descriptor is missing\n"); + DEBUG(SSSDBG_MINOR_FAILURE, "Security descriptor is missing\n"); ret = EINVAL; goto done; } @@ -1054,7 +1059,7 @@ ad_gpo_filter_gpos_by_dacl(TALLOC_CTX *mem_ctx, /* gpo_flags value of 2 means that GPO's computer portion is disabled */ if (candidate_gpo->gpo_flags == 2) { - DEBUG(SSSDBG_TRACE_ALL, + DEBUG(SSSDBG_TRACE_FUNC, "GPO not applicable to target per security filtering: " "GPO's computer portion is disabled\n"); continue; @@ -1064,7 +1069,8 @@ ad_gpo_filter_gpos_by_dacl(TALLOC_CTX *mem_ctx, ret = ad_gpo_evaluate_dacl(dacl, idmap_ctx, user_sid, group_sids, group_size, &access_allowed); if (ret != EOK) { - DEBUG(SSSDBG_MINOR_FAILURE, "Could not determine if GPO is applicable\n"); + DEBUG(SSSDBG_MINOR_FAILURE, + "Could not determine if GPO is applicable\n"); continue; } } else { @@ -1079,13 +1085,13 @@ ad_gpo_filter_gpos_by_dacl(TALLOC_CTX *mem_ctx, } if (access_allowed) { - DEBUG(SSSDBG_TRACE_ALL, + DEBUG(SSSDBG_TRACE_FUNC, "GPO applicable to target per security filtering\n"); dacl_filtered_gpos[gpo_dn_idx] = talloc_steal(dacl_filtered_gpos, candidate_gpo); gpo_dn_idx++; } else { - DEBUG(SSSDBG_TRACE_ALL, + DEBUG(SSSDBG_TRACE_FUNC, "GPO not applicable to target per security filtering: " "result of DACL evaluation\n"); continue;