source3/smbd/uid.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    uid/user handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #include "includes.h"
  22
  23 /* what user is current? */
  24 extern struct current_user current_user;
  25
  26 /****************************************************************************
  27  Become the guest user without changing the security context stack.
  28 ****************************************************************************/
  29
  30 BOOL change_to_guest(void)
  31 {
  32         static struct passwd *pass=NULL;
  33
  34         if (!pass) {
  35                 /* Don't need to free() this as its stored in a static */
  36                 pass = getpwnam_alloc(lp_guestaccount());
  37                 if (!pass)
  38                         return(False);
  39         }
  40
  41 #ifdef AIX
  42         /* MWW: From AIX FAQ patch to WU-ftpd: call initgroups before
  43            setting IDs */
  44         initgroups(pass->pw_name, pass->pw_gid);
  45 #endif
  46
  47         set_sec_ctx(pass->pw_uid, pass->pw_gid, 0, NULL, NULL);
  48
  49         current_user.conn = NULL;
  50         current_user.vuid = UID_FIELD_INVALID;
  51
  52         passwd_free(&pass);
  53
  54         return True;
  55 }
  56
  57 /****************************************************************************
  58  Readonly share for this user ?
  59 ****************************************************************************/
  60
  61 static BOOL is_share_read_only_for_user(connection_struct *conn, user_struct *vuser)
  62 {
  63         char **list;
  64         const char *service = lp_servicename(conn->service);
  65         BOOL read_only_ret = lp_readonly(conn->service);
  66
  67         if (!service)
  68                 return read_only_ret;
  69
  70         str_list_copy(&list, lp_readlist(conn->service));
  71         if (list) {
  72                 if (!str_list_sub_basic(list, vuser->user.smb_name) ) {
  73                         DEBUG(0, ("is_share_read_only_for_user: ERROR: read list substitution failed\n"));
  74                 }
  75                 if (!str_list_substitute(list, "%S", service)) {
  76                         DEBUG(0, ("is_share_read_only_for_user: ERROR: read list service substitution failed\n"));
  77                 }
  78                 if (user_in_list(vuser->user.unix_name, (const char **)list, vuser->groups, vuser->n_groups)) {
  79                         read_only_ret = True;
  80                 }
  81                 str_list_free(&list);
  82         }
  83
  84         str_list_copy(&list, lp_writelist(conn->service));
  85         if (list) {
  86                 if (!str_list_sub_basic(list, vuser->user.smb_name) ) {
  87                         DEBUG(0, ("is_share_read_only_for_user: ERROR: write list substitution failed\n"));
  88                 }
  89                 if (!str_list_substitute(list, "%S", service)) {
  90                         DEBUG(0, ("is_share_read_only_for_user: ERROR: write list service substitution failed\n"));
  91                 }
  92                 if (user_in_list(vuser->user.unix_name, (const char **)list, vuser->groups, vuser->n_groups)) {
  93                         read_only_ret = False;
  94                 }
  95                 str_list_free(&list);
  96         }
  97
  98         DEBUG(10,("is_share_read_only_for_user: share %s is %s for unix user %s\n",
  99                 service, read_only_ret ? "read-only" : "read-write", vuser->user.unix_name ));
 100
 101         return read_only_ret;
 102 }
 103
 104 /*******************************************************************
 105  Check if a username is OK.
 106 ********************************************************************/
 107
 108 static BOOL check_user_ok(connection_struct *conn, user_struct *vuser,int snum)
 109 {
 110         unsigned int i;
 111         struct vuid_cache_entry *ent = NULL;
 112         BOOL readonly_share;
 113
 114         for (i=0;i<conn->vuid_cache.entries && i< VUID_CACHE_SIZE;i++) {
 115                 if (conn->vuid_cache.array[i].vuid == vuser->vuid) {
 116                         ent = &conn->vuid_cache.array[i];
 117                         conn->read_only = ent->read_only;
 118                         conn->admin_user = ent->admin_user;
 119                         return(True);
 120                 }
 121         }
 122
 123         if (!user_ok(vuser->user.unix_name,snum, vuser->groups, vuser->n_groups))
 124                 return(False);
 125
 126         readonly_share = is_share_read_only_for_user(conn, vuser);
 127
 128         if (!share_access_check(conn, snum, vuser, readonly_share ? FILE_READ_DATA : FILE_WRITE_DATA)) {
 129                 return False;
 130         }
 131
 132         i = conn->vuid_cache.entries % VUID_CACHE_SIZE;
 133         if (conn->vuid_cache.entries < VUID_CACHE_SIZE)
 134                 conn->vuid_cache.entries++;
 135
 136         ent = &conn->vuid_cache.array[i];
 137         ent->vuid = vuser->vuid;
 138         ent->read_only = readonly_share;
 139
 140         if (user_in_list(vuser->user.unix_name ,lp_admin_users(conn->service), vuser->groups, vuser->n_groups)) {
 141                 ent->admin_user = True;
 142         } else {
 143                 ent->admin_user = False;
 144         }
 145
 146         conn->read_only = ent->read_only;
 147         conn->admin_user = ent->admin_user;
 148
 149         return(True);
 150 }
 151
 152 /****************************************************************************
 153  Become the user of a connection number without changing the security context
 154  stack, but modify the currnet_user entries.
 155 ****************************************************************************/
 156
 157 BOOL change_to_user(connection_struct *conn, uint16 vuid)
 158 {
 159         user_struct *vuser = get_valid_user_struct(vuid);
 160         int snum;
 161         gid_t gid;
 162         uid_t uid;
 163         char group_c;
 164         BOOL must_free_token = False;
 165         NT_USER_TOKEN *token = NULL;
 166
 167         if (!conn) {
 168                 DEBUG(2,("change_to_user: Connection not open\n"));
 169                 return(False);
 170         }
 171
 172         /*
 173          * We need a separate check in security=share mode due to vuid
 174          * always being UID_FIELD_INVALID. If we don't do this then
 175          * in share mode security we are *always* changing uid's between
 176          * SMB's - this hurts performance - Badly.
 177          */
 178
 179         if((lp_security() == SEC_SHARE) && (current_user.conn == conn) &&
 180            (current_user.uid == conn->uid)) {
 181                 DEBUG(4,("change_to_user: Skipping user change - already user\n"));
 182                 return(True);
 183         } else if ((current_user.conn == conn) &&
 184                    (vuser != 0) && (current_user.vuid == vuid) &&
 185                    (current_user.uid == vuser->uid)) {
 186                 DEBUG(4,("change_to_user: Skipping user change - already user\n"));
 187                 return(True);
 188         }
 189
 190         snum = SNUM(conn);
 191
 192         if ((vuser) && !check_user_ok(conn, vuser, snum)) {
 193                 DEBUG(2,("change_to_user: SMB user %s (unix user %s, vuid %d) not permitted access to share %s.\n",
 194                         vuser->user.smb_name, vuser->user.unix_name, vuid, lp_servicename(snum)));
 195                 return False;
 196         }
 197
 198         if (conn->force_user) /* security = share sets this too */ {
 199                 uid = conn->uid;
 200                 gid = conn->gid;
 201                 current_user.groups = conn->groups;
 202                 current_user.ngroups = conn->ngroups;
 203                 token = conn->nt_user_token;
 204         } else if (vuser) {
 205                 uid = conn->admin_user ? 0 : vuser->uid;
 206                 gid = vuser->gid;
 207                 current_user.ngroups = vuser->n_groups;
 208                 current_user.groups  = vuser->groups;
 209                 token = vuser->nt_user_token;
 210         } else {
 211                 DEBUG(2,("change_to_user: Invalid vuid used %d in accessing share %s.\n",vuid, lp_servicename(snum) ));
 212                 return False;
 213         }
 214
 215         /*
 216          * See if we should force group for this service.
 217          * If so this overrides any group set in the force
 218          * user code.
 219          */
 220
 221         if((group_c = *lp_force_group(snum))) {
 222                 BOOL is_guest = False;
 223
 224                 if(group_c == '+') {
 225
 226                         /*
 227                          * Only force group if the user is a member of
 228                          * the service group. Check the group memberships for
 229                          * this user (we already have this) to
 230                          * see if we should force the group.
 231                          */
 232
 233                         int i;
 234                         for (i = 0; i < current_user.ngroups; i++) {
 235                                 if (current_user.groups[i] == conn->gid) {
 236                                         gid = conn->gid;
 237                                         break;
 238                                 }
 239                         }
 240                 } else {
 241                         gid = conn->gid;
 242                 }
 243
 244                 /*
 245                  * We've changed the group list in the token - we must
 246                  * re-create it.
 247                  */
 248
 249                 if (vuser && vuser->guest)
 250                         is_guest = True;
 251
 252                 token = create_nt_token(uid, gid, current_user.ngroups, current_user.groups, is_guest);
 253                 if (!token) {
 254                         DEBUG(1, ("change_to_user: create_nt_token failed!\n"));
 255                         return False;
 256                 }
 257                 must_free_token = True;
 258         }
 259
 260         set_sec_ctx(uid, gid, current_user.ngroups, current_user.groups, token);
 261
 262         /*
 263          * Free the new token (as set_sec_ctx copies it).
 264          */
 265
 266         if (must_free_token)
 267                 delete_nt_token(&token);
 268
 269         current_user.conn = conn;
 270         current_user.vuid = vuid;
 271
 272         DEBUG(5,("change_to_user uid=(%d,%d) gid=(%d,%d)\n",
 273                  (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
 274
 275         return(True);
 276 }
 277
 278 /****************************************************************************
 279  Go back to being root without changing the security context stack,
 280  but modify the current_user entries.
 281 ****************************************************************************/
 282
 283 BOOL change_to_root_user(void)
 284 {
 285         set_root_sec_ctx();
 286
 287         DEBUG(5,("change_to_root_user: now uid=(%d,%d) gid=(%d,%d)\n",
 288                 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
 289
 290         current_user.conn = NULL;
 291         current_user.vuid = UID_FIELD_INVALID;
 292
 293         return(True);
 294 }
 295
 296 /****************************************************************************
 297  Become the user of an authenticated connected named pipe.
 298  When this is called we are currently running as the connection
 299  user. Doesn't modify current_user.
 300 ****************************************************************************/
 301
 302 BOOL become_authenticated_pipe_user(pipes_struct *p)
 303 {
 304         if (!push_sec_ctx())
 305                 return False;
 306
 307         set_sec_ctx(p->pipe_user.uid, p->pipe_user.gid,
 308                     p->pipe_user.ngroups, p->pipe_user.groups, p->pipe_user.nt_user_token);
 309
 310         return True;
 311 }
 312
 313 /****************************************************************************
 314  Unbecome the user of an authenticated connected named pipe.
 315  When this is called we are running as the authenticated pipe
 316  user and need to go back to being the connection user. Doesn't modify
 317  current_user.
 318 ****************************************************************************/
 319
 320 BOOL unbecome_authenticated_pipe_user(void)
 321 {
 322         return pop_sec_ctx();
 323 }
 324
 325 /****************************************************************************
 326  Utility functions used by become_xxx/unbecome_xxx.
 327 ****************************************************************************/
 328
 329 struct conn_ctx {
 330         connection_struct *conn;
 331         uint16 vuid;
 332 };
 333
 334 /* A stack of current_user connection contexts. */
 335
 336 static struct conn_ctx conn_ctx_stack[MAX_SEC_CTX_DEPTH];
 337 static int conn_ctx_stack_ndx;
 338
 339 static void push_conn_ctx(void)
 340 {
 341         struct conn_ctx *ctx_p;
 342
 343         /* Check we don't overflow our stack */
 344
 345         if (conn_ctx_stack_ndx == MAX_SEC_CTX_DEPTH) {
 346                 DEBUG(0, ("Connection context stack overflow!\n"));
 347                 smb_panic("Connection context stack overflow!\n");
 348         }
 349
 350         /* Store previous user context */
 351         ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 352
 353         ctx_p->conn = current_user.conn;
 354         ctx_p->vuid = current_user.vuid;
 355
 356         DEBUG(3, ("push_conn_ctx(%u) : conn_ctx_stack_ndx = %d\n",
 357                 (unsigned int)ctx_p->vuid, conn_ctx_stack_ndx ));
 358
 359         conn_ctx_stack_ndx++;
 360 }
 361
 362 static void pop_conn_ctx(void)
 363 {
 364         struct conn_ctx *ctx_p;
 365
 366         /* Check for stack underflow. */
 367
 368         if (conn_ctx_stack_ndx == 0) {
 369                 DEBUG(0, ("Connection context stack underflow!\n"));
 370                 smb_panic("Connection context stack underflow!\n");
 371         }
 372
 373         conn_ctx_stack_ndx--;
 374         ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 375
 376         current_user.conn = ctx_p->conn;
 377         current_user.vuid = ctx_p->vuid;
 378
 379         ctx_p->conn = NULL;
 380         ctx_p->vuid = UID_FIELD_INVALID;
 381 }
 382
 383 /****************************************************************************
 384  Temporarily become a root user.  Must match with unbecome_root(). Saves and
 385  restores the connection context.
 386 ****************************************************************************/
 387
 388 void become_root(void)
 389 {
 390         push_sec_ctx();
 391         push_conn_ctx();
 392         set_root_sec_ctx();
 393 }
 394
 395 /* Unbecome the root user */
 396
 397 void unbecome_root(void)
 398 {
 399         pop_sec_ctx();
 400         pop_conn_ctx();
 401 }
 402
 403 /****************************************************************************
 404  Push the current security context then force a change via change_to_user().
 405  Saves and restores the connection context.
 406 ****************************************************************************/
 407
 408 BOOL become_user(connection_struct *conn, uint16 vuid)
 409 {
 410         if (!push_sec_ctx())
 411                 return False;
 412
 413         push_conn_ctx();
 414
 415         if (!change_to_user(conn, vuid)) {
 416                 pop_sec_ctx();
 417                 pop_conn_ctx();
 418                 return False;
 419         }
 420
 421         return True;
 422 }
 423
 424 BOOL unbecome_user(void)
 425 {
 426         pop_sec_ctx();
 427         pop_conn_ctx();
 428         return True;
 429 }
 430