133 lines
5.1 KiB
Diff
133 lines
5.1 KiB
Diff
From dce025b882db7247571b135e928afb47f069a60f Mon Sep 17 00:00:00 2001
|
|
From: Sumit Bose <sbose@redhat.com>
|
|
Date: Thu, 27 Feb 2020 06:54:21 +0100
|
|
Subject: [PATCH] GPO: fix link order in a SOM
|
|
|
|
GPOs of the same OU were applied in the wrong order. Details about how
|
|
GPOs should be processed can be found e.g. at
|
|
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn581922(v%3Dws.11)
|
|
|
|
Resolves: https://github.com/SSSD/sssd/issues/5103
|
|
|
|
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
|
|
---
|
|
src/providers/ad/ad_gpo.c | 59 +++++++++++++++++++++++++++++----------
|
|
1 file changed, 45 insertions(+), 14 deletions(-)
|
|
|
|
diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
|
|
index bbe8d8a1e..1524c4bfc 100644
|
|
--- a/src/providers/ad/ad_gpo.c
|
|
+++ b/src/providers/ad/ad_gpo.c
|
|
@@ -3511,14 +3511,19 @@ ad_gpo_process_som_recv(struct tevent_req *req,
|
|
* - GPOs linked to an OU will be applied after GPOs linked to a Domain,
|
|
* which will be applied after GPOs linked to a Site.
|
|
* - multiple GPOs linked to a single SOM are applied in their link order
|
|
- * (i.e. 1st GPO linked to SOM is applied after 2nd GPO linked to SOM, etc).
|
|
+ * (i.e. 1st GPO linked to SOM is applied before 2nd GPO linked to SOM, etc).
|
|
* - enforced GPOs are applied after unenforced GPOs.
|
|
*
|
|
* As such, the _candidate_gpos output's dn fields looks like (in link order):
|
|
- * [unenforced {Site, Domain, OU}; enforced {Site, Domain, OU}]
|
|
+ * [unenforced {Site, Domain, OU}; enforced {OU, Domain, Site}]
|
|
*
|
|
* Note that in the case of conflicting policy settings, GPOs appearing later
|
|
- * in the list will trump GPOs appearing earlier in the list.
|
|
+ * in the list will trump GPOs appearing earlier in the list. Therefore the
|
|
+ * enforced GPOs are applied in revers order after the unenforced GPOs to
|
|
+ * make sure the enforced setting form the highest level will be applied.
|
|
+ *
|
|
+ * GPO processing details can be found e.g. at
|
|
+ * https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn581922(v%3Dws.11)
|
|
*/
|
|
static errno_t
|
|
ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx,
|
|
@@ -3542,6 +3547,7 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx,
|
|
int i = 0;
|
|
int j = 0;
|
|
int ret;
|
|
+ size_t som_count = 0;
|
|
|
|
tmp_ctx = talloc_new(NULL);
|
|
if (tmp_ctx == NULL) {
|
|
@@ -3568,6 +3574,7 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx,
|
|
}
|
|
i++;
|
|
}
|
|
+ som_count = i;
|
|
|
|
num_candidate_gpos = num_enforced + num_unenforced;
|
|
|
|
@@ -3590,9 +3597,43 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx,
|
|
goto done;
|
|
}
|
|
|
|
+ i = som_count -1 ;
|
|
+ while (i >= 0) {
|
|
+ gp_som = som_list[i];
|
|
+
|
|
+ /* For unenforced_gpo_dns the most specific GPOs with the highest
|
|
+ * priority should be the last. We start with the top-level SOM and go
|
|
+ * down to the most specific one and add the unenforced following the
|
|
+ * gplink_list where the GPO with the highest priority comes last. */
|
|
+ j = 0;
|
|
+ while (gp_som && gp_som->gplink_list && gp_som->gplink_list[j]) {
|
|
+ gp_gplink = gp_som->gplink_list[j];
|
|
+
|
|
+ if (!gp_gplink->enforced) {
|
|
+ unenforced_gpo_dns[unenforced_idx] =
|
|
+ talloc_steal(unenforced_gpo_dns, gp_gplink->gpo_dn);
|
|
+
|
|
+ if (unenforced_gpo_dns[unenforced_idx] == NULL) {
|
|
+ ret = ENOMEM;
|
|
+ goto done;
|
|
+ }
|
|
+ unenforced_idx++;
|
|
+ }
|
|
+ j++;
|
|
+ }
|
|
+ i--;
|
|
+ }
|
|
+
|
|
i = 0;
|
|
while (som_list[i]) {
|
|
gp_som = som_list[i];
|
|
+
|
|
+ /* For enforced GPOs we start processing with the most specific SOM to
|
|
+ * make sur enforced GPOs from higher levels override to lower level
|
|
+ * ones. According to the 'Group Policy Inheritance' tab in the
|
|
+ * Windows 'Goup Policy Management' utility in the same SOM the link
|
|
+ * order is still observed and an enforced GPO with a lower link order
|
|
+ * value still overrides an enforced GPO with a higher link order. */
|
|
j = 0;
|
|
while (gp_som && gp_som->gplink_list && gp_som->gplink_list[j]) {
|
|
gp_gplink = gp_som->gplink_list[j];
|
|
@@ -3610,16 +3651,6 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx,
|
|
goto done;
|
|
}
|
|
enforced_idx++;
|
|
- } else {
|
|
-
|
|
- unenforced_gpo_dns[unenforced_idx] =
|
|
- talloc_steal(unenforced_gpo_dns, gp_gplink->gpo_dn);
|
|
-
|
|
- if (unenforced_gpo_dns[unenforced_idx] == NULL) {
|
|
- ret = ENOMEM;
|
|
- goto done;
|
|
- }
|
|
- unenforced_idx++;
|
|
}
|
|
j++;
|
|
}
|
|
@@ -3638,7 +3669,7 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx,
|
|
}
|
|
|
|
gpo_dn_idx = 0;
|
|
- for (i = num_unenforced - 1; i >= 0; i--) {
|
|
+ for (i = 0; i < num_unenforced; i++) {
|
|
candidate_gpos[gpo_dn_idx] = talloc_zero(candidate_gpos, struct gp_gpo);
|
|
if (candidate_gpos[gpo_dn_idx] == NULL) {
|
|
ret = ENOMEM;
|
|
--
|
|
2.21.3
|
|
|