325 lines
11 KiB
C#
325 lines
11 KiB
C#
//
|
|
// System.Security.AccessControl.DirectoryObjectSecurity implementation
|
|
//
|
|
// Author:
|
|
// Dick Porter <dick@ximian.com>
|
|
// James Bellinger <jfb@zer7.com>
|
|
//
|
|
// Copyright (C) 2006 Novell, Inc (http://www.novell.com)
|
|
// Copyright (C) 2012 James Bellinger
|
|
//
|
|
// Permission is hereby granted, free of charge, to any person obtaining
|
|
// a copy of this software and associated documentation files (the
|
|
// "Software"), to deal in the Software without restriction, including
|
|
// without limitation the rights to use, copy, modify, merge, publish,
|
|
// distribute, sublicense, and/or sell copies of the Software, and to
|
|
// permit persons to whom the Software is furnished to do so, subject to
|
|
// the following conditions:
|
|
//
|
|
// The above copyright notice and this permission notice shall be
|
|
// included in all copies or substantial portions of the Software.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
|
// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
|
// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
|
// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
//
|
|
|
|
using System.Security.Principal;
|
|
|
|
namespace System.Security.AccessControl
|
|
{
|
|
public abstract class DirectoryObjectSecurity : ObjectSecurity
|
|
{
|
|
protected DirectoryObjectSecurity ()
|
|
: base (true, true)
|
|
{
|
|
}
|
|
|
|
protected DirectoryObjectSecurity (CommonSecurityDescriptor securityDescriptor)
|
|
: base (securityDescriptor)
|
|
{
|
|
}
|
|
|
|
// For MoMA. NotImplementedException is correct for this base class.
|
|
Exception GetNotImplementedException ()
|
|
{
|
|
return new NotImplementedException ();
|
|
}
|
|
|
|
public virtual AccessRule AccessRuleFactory (IdentityReference identityReference, int accessMask,
|
|
bool isInherited, InheritanceFlags inheritanceFlags,
|
|
PropagationFlags propagationFlags, AccessControlType type,
|
|
Guid objectType, Guid inheritedObjectType)
|
|
{
|
|
throw GetNotImplementedException ();
|
|
}
|
|
|
|
internal override AccessRule InternalAccessRuleFactory (QualifiedAce ace, Type targetType,
|
|
AccessControlType type)
|
|
{
|
|
ObjectAce oace = ace as ObjectAce;
|
|
if (null == oace || ObjectAceFlags.None == oace.ObjectAceFlags)
|
|
return base.InternalAccessRuleFactory (ace, targetType, type);
|
|
|
|
return AccessRuleFactory (ace.SecurityIdentifier.Translate (targetType),
|
|
ace.AccessMask, ace.IsInherited,
|
|
ace.InheritanceFlags, ace.PropagationFlags, type,
|
|
oace.ObjectAceType, oace.InheritedObjectAceType);
|
|
}
|
|
|
|
public virtual AuditRule AuditRuleFactory (IdentityReference identityReference, int accessMask,
|
|
bool isInherited, InheritanceFlags inheritanceFlags,
|
|
PropagationFlags propagationFlags, AuditFlags flags,
|
|
Guid objectType, Guid inheritedObjectType)
|
|
{
|
|
throw GetNotImplementedException ();
|
|
}
|
|
|
|
internal override AuditRule InternalAuditRuleFactory (QualifiedAce ace, Type targetType)
|
|
{
|
|
ObjectAce oace = ace as ObjectAce;
|
|
if (null == oace || ObjectAceFlags.None == oace.ObjectAceFlags)
|
|
return base.InternalAuditRuleFactory (ace, targetType);
|
|
|
|
return AuditRuleFactory (ace.SecurityIdentifier.Translate (targetType),
|
|
ace.AccessMask, ace.IsInherited,
|
|
ace.InheritanceFlags, ace.PropagationFlags, ace.AuditFlags,
|
|
oace.ObjectAceType, oace.InheritedObjectAceType);
|
|
}
|
|
|
|
public AuthorizationRuleCollection GetAccessRules (bool includeExplicit, bool includeInherited, Type targetType)
|
|
{
|
|
return InternalGetAccessRules (includeExplicit, includeInherited, targetType);
|
|
}
|
|
|
|
public AuthorizationRuleCollection GetAuditRules (bool includeExplicit, bool includeInherited, Type targetType)
|
|
{
|
|
return InternalGetAuditRules (includeExplicit, includeInherited, targetType);
|
|
}
|
|
|
|
protected void AddAccessRule (ObjectAccessRule rule)
|
|
{
|
|
bool modified;
|
|
ModifyAccess (AccessControlModification.Add, rule, out modified);
|
|
}
|
|
|
|
protected bool RemoveAccessRule (ObjectAccessRule rule)
|
|
{
|
|
bool modified;
|
|
return ModifyAccess (AccessControlModification.Remove, rule, out modified);
|
|
}
|
|
|
|
protected void RemoveAccessRuleAll (ObjectAccessRule rule)
|
|
{
|
|
bool modified;
|
|
ModifyAccess (AccessControlModification.RemoveAll, rule, out modified);
|
|
}
|
|
|
|
protected void RemoveAccessRuleSpecific (ObjectAccessRule rule)
|
|
{
|
|
bool modified;
|
|
ModifyAccess (AccessControlModification.RemoveSpecific, rule, out modified);
|
|
}
|
|
|
|
protected void ResetAccessRule (ObjectAccessRule rule)
|
|
{
|
|
bool modified;
|
|
ModifyAccess (AccessControlModification.Reset, rule, out modified);
|
|
}
|
|
|
|
protected void SetAccessRule (ObjectAccessRule rule)
|
|
{
|
|
bool modified;
|
|
ModifyAccess (AccessControlModification.Set, rule, out modified);
|
|
}
|
|
|
|
protected override bool ModifyAccess (AccessControlModification modification, AccessRule rule, out bool modified)
|
|
{
|
|
if (null == rule)
|
|
throw new ArgumentNullException ("rule");
|
|
|
|
ObjectAccessRule orule = rule as ObjectAccessRule;
|
|
if (null == orule)
|
|
throw new ArgumentException ("rule");
|
|
|
|
modified = true;
|
|
|
|
WriteLock ();
|
|
try {
|
|
switch (modification) {
|
|
case AccessControlModification.Add:
|
|
descriptor.DiscretionaryAcl.AddAccess (orule.AccessControlType,
|
|
SidFromIR (orule.IdentityReference),
|
|
orule.AccessMask,
|
|
orule.InheritanceFlags,
|
|
orule.PropagationFlags,
|
|
orule.ObjectFlags,
|
|
orule.ObjectType,
|
|
orule.InheritedObjectType);
|
|
break;
|
|
case AccessControlModification.Set:
|
|
descriptor.DiscretionaryAcl.SetAccess (orule.AccessControlType,
|
|
SidFromIR (orule.IdentityReference),
|
|
orule.AccessMask,
|
|
orule.InheritanceFlags,
|
|
orule.PropagationFlags,
|
|
orule.ObjectFlags,
|
|
orule.ObjectType,
|
|
orule.InheritedObjectType);
|
|
break;
|
|
case AccessControlModification.Reset:
|
|
PurgeAccessRules (orule.IdentityReference);
|
|
goto case AccessControlModification.Add;
|
|
case AccessControlModification.Remove:
|
|
modified = descriptor.DiscretionaryAcl.RemoveAccess (orule.AccessControlType,
|
|
SidFromIR (orule.IdentityReference),
|
|
rule.AccessMask,
|
|
orule.InheritanceFlags,
|
|
orule.PropagationFlags,
|
|
orule.ObjectFlags,
|
|
orule.ObjectType,
|
|
orule.InheritedObjectType);
|
|
break;
|
|
case AccessControlModification.RemoveAll:
|
|
PurgeAccessRules (orule.IdentityReference);
|
|
break;
|
|
case AccessControlModification.RemoveSpecific:
|
|
descriptor.DiscretionaryAcl.RemoveAccessSpecific (orule.AccessControlType,
|
|
SidFromIR (orule.IdentityReference),
|
|
orule.AccessMask,
|
|
orule.InheritanceFlags,
|
|
orule.PropagationFlags,
|
|
orule.ObjectFlags,
|
|
orule.ObjectType,
|
|
orule.InheritedObjectType);
|
|
break;
|
|
default:
|
|
throw new ArgumentOutOfRangeException ("modification");
|
|
}
|
|
|
|
if (modified) AccessRulesModified = true;
|
|
} finally {
|
|
WriteUnlock ();
|
|
}
|
|
|
|
return modified;
|
|
}
|
|
|
|
protected void AddAuditRule (ObjectAuditRule rule)
|
|
{
|
|
bool modified;
|
|
ModifyAudit (AccessControlModification.Add, rule, out modified);
|
|
}
|
|
|
|
protected bool RemoveAuditRule (ObjectAuditRule rule)
|
|
{
|
|
bool modified;
|
|
return ModifyAudit (AccessControlModification.Remove, rule, out modified);
|
|
}
|
|
|
|
protected void RemoveAuditRuleAll (ObjectAuditRule rule)
|
|
{
|
|
bool modified;
|
|
ModifyAudit (AccessControlModification.RemoveAll, rule, out modified);
|
|
}
|
|
|
|
protected void RemoveAuditRuleSpecific (ObjectAuditRule rule)
|
|
{
|
|
bool modified;
|
|
ModifyAudit (AccessControlModification.RemoveSpecific, rule, out modified);
|
|
}
|
|
|
|
protected void SetAuditRule (ObjectAuditRule rule)
|
|
{
|
|
bool modified;
|
|
ModifyAudit (AccessControlModification.Set, rule, out modified);
|
|
}
|
|
|
|
protected override bool ModifyAudit (AccessControlModification modification, AuditRule rule, out bool modified)
|
|
{
|
|
if (null == rule)
|
|
throw new ArgumentNullException ("rule");
|
|
|
|
ObjectAuditRule orule = rule as ObjectAuditRule;
|
|
if (null == orule)
|
|
throw new ArgumentException ("rule");
|
|
|
|
modified = true;
|
|
|
|
WriteLock ();
|
|
try {
|
|
switch (modification) {
|
|
case AccessControlModification.Add:
|
|
if (null == descriptor.SystemAcl)
|
|
descriptor.SystemAcl = new SystemAcl (IsContainer, IsDS, 1);
|
|
|
|
descriptor.SystemAcl.AddAudit (orule.AuditFlags,
|
|
SidFromIR (orule.IdentityReference),
|
|
orule.AccessMask,
|
|
orule.InheritanceFlags,
|
|
orule.PropagationFlags,
|
|
orule.ObjectFlags,
|
|
orule.ObjectType,
|
|
orule.InheritedObjectType);
|
|
break;
|
|
case AccessControlModification.Set:
|
|
if (null == descriptor.SystemAcl)
|
|
descriptor.SystemAcl = new SystemAcl (IsContainer, IsDS, 1);
|
|
|
|
descriptor.SystemAcl.SetAudit (orule.AuditFlags,
|
|
SidFromIR (orule.IdentityReference),
|
|
orule.AccessMask,
|
|
orule.InheritanceFlags,
|
|
orule.PropagationFlags,
|
|
orule.ObjectFlags,
|
|
orule.ObjectType,
|
|
orule.InheritedObjectType);
|
|
break;
|
|
case AccessControlModification.Reset:
|
|
break;
|
|
case AccessControlModification.Remove:
|
|
if (null == descriptor.SystemAcl)
|
|
modified = false;
|
|
else
|
|
modified = descriptor.SystemAcl.RemoveAudit (orule.AuditFlags,
|
|
SidFromIR (orule.IdentityReference),
|
|
orule.AccessMask,
|
|
orule.InheritanceFlags,
|
|
orule.PropagationFlags,
|
|
orule.ObjectFlags,
|
|
orule.ObjectType,
|
|
orule.InheritedObjectType);
|
|
break;
|
|
case AccessControlModification.RemoveAll:
|
|
PurgeAuditRules (orule.IdentityReference);
|
|
break;
|
|
case AccessControlModification.RemoveSpecific:
|
|
if (null != descriptor.SystemAcl)
|
|
descriptor.SystemAcl.RemoveAuditSpecific (orule.AuditFlags,
|
|
SidFromIR (orule.IdentityReference),
|
|
orule.AccessMask,
|
|
orule.InheritanceFlags,
|
|
orule.PropagationFlags,
|
|
orule.ObjectFlags,
|
|
orule.ObjectType,
|
|
orule.InheritedObjectType);
|
|
break;
|
|
default:
|
|
throw new ArgumentOutOfRangeException ("modification");
|
|
}
|
|
|
|
if (modified) AuditRulesModified = true;
|
|
} finally {
|
|
WriteUnlock ();
|
|
}
|
|
|
|
return modified;
|
|
}
|
|
}
|
|
}
|
|
|