This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
+#include "system/filesys.h"
+#include "system/passwd.h"
+#include "auth/auth.h"
+#include "ntvfs/ntvfs.h"
+#include "dsdb/samdb/samdb.h"
struct unixuid_private {
- void *samctx;
+ struct sidmap_context *sidmap;
+ struct unix_sec_ctx *last_sec_ctx;
+ struct security_token *last_token;
};
-/*
- map a sid to a unix uid
-*/
-static NTSTATUS sid_to_unixuid(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct dom_sid *sid, uid_t *uid)
-{
- struct unixuid_private *private = ntvfs->private_data;
- const char *attrs[] = { "sAMAccountName", "unixID", "unixName", "sAMAccountType", NULL };
- int ret;
- const char *s;
- void *ctx;
- struct ldb_message **res;
- const char *sidstr;
- uint_t atype;
-
- ctx = talloc(req, 0);
- sidstr = dom_sid_string(ctx, sid);
-
- ret = samdb_search(private->samctx, ctx, NULL, &res, attrs, "objectSid=%s", sidstr);
- if (ret != 1) {
- DEBUG(0,("sid_to_unixuid: unable to find sam record for sid %s\n", sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* make sure its a user, not a group */
- atype = samdb_result_uint(res[0], "sAMAccountType", 0);
- if (atype && atype != ATYPE_NORMAL_ACCOUNT) {
- DEBUG(0,("sid_to_unixuid: sid %s is not ATYPE_NORMAL_ACCOUNT\n", sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* first try to get the uid directly */
- s = samdb_result_string(res[0], "unixID", NULL);
- if (s != NULL) {
- *uid = strtoul(s, NULL, 0);
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- /* next try via the UnixName attribute */
- s = samdb_result_string(res[0], "unixName", NULL);
- if (s != NULL) {
- struct passwd *pwd = getpwnam(s);
- if (!pwd) {
- DEBUG(0,("unixName %s for sid %s does not exist as a local user\n", s, sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
- *uid = pwd->pw_uid;
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- /* finally try via the sAMAccountName attribute */
- s = samdb_result_string(res[0], "sAMAccountName", NULL);
- if (s != NULL) {
- struct passwd *pwd = getpwnam(s);
- if (!pwd) {
- DEBUG(0,("sAMAccountName '%s' for sid %s does not exist as a local user\n", s, sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
- *uid = pwd->pw_uid;
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- DEBUG(0,("sid_to_unixuid: no unixID, unixName or sAMAccountName for sid %s\n", sidstr));
-
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
-}
-
-
-/*
- map a sid to a unix gid
-*/
-static NTSTATUS sid_to_unixgid(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct dom_sid *sid, gid_t *gid)
-{
- struct unixuid_private *private = ntvfs->private_data;
- const char *attrs[] = { "sAMAccountName", "unixID", "unixName", "sAMAccountType", NULL };
- int ret;
- const char *s;
- void *ctx;
- struct ldb_message **res;
- const char *sidstr;
- uint_t atype;
-
- ctx = talloc(req, 0);
- sidstr = dom_sid_string(ctx, sid);
-
- ret = samdb_search(private->samctx, ctx, NULL, &res, attrs, "objectSid=%s", sidstr);
- if (ret != 1) {
- DEBUG(0,("sid_to_unixgid: unable to find sam record for sid %s\n", sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* make sure its not a user */
- atype = samdb_result_uint(res[0], "sAMAccountType", 0);
- if (atype && atype == ATYPE_NORMAL_ACCOUNT) {
- DEBUG(0,("sid_to_unixgid: sid %s is a ATYPE_NORMAL_ACCOUNT\n", sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* first try to get the gid directly */
- s = samdb_result_string(res[0], "unixID", NULL);
- if (s != NULL) {
- *gid = strtoul(s, NULL, 0);
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- /* next try via the UnixName attribute */
- s = samdb_result_string(res[0], "unixName", NULL);
- if (s != NULL) {
- struct group *grp = getgrnam(s);
- if (!grp) {
- DEBUG(0,("unixName '%s' for sid %s does not exist as a local group\n", s, sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
- *gid = grp->gr_gid;
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- /* finally try via the sAMAccountName attribute */
- s = samdb_result_string(res[0], "sAMAccountName", NULL);
- if (s != NULL) {
- struct group *grp = getgrnam(s);
- if (!grp) {
- DEBUG(0,("sAMAccountName '%s' for sid %s does not exist as a local group\n", s, sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
- *gid = grp->gr_gid;
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- DEBUG(0,("sid_to_unixgid: no unixID, unixName or sAMAccountName for sid %s\n", sidstr));
-
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
-}
struct unix_sec_ctx {
uid_t uid;
*/
static struct unix_sec_ctx *save_unix_security(TALLOC_CTX *mem_ctx)
{
- struct unix_sec_ctx *sec = talloc_p(mem_ctx, struct unix_sec_ctx);
+ struct unix_sec_ctx *sec = talloc(mem_ctx, struct unix_sec_ctx);
if (sec == NULL) {
return NULL;
}
talloc_free(sec);
return NULL;
}
- sec->groups = talloc_array_p(sec, gid_t, sec->ngroups);
+ sec->groups = talloc_array(sec, gid_t, sec->ngroups);
if (sec->groups == NULL) {
talloc_free(sec);
return NULL;
}
/*
- form a unix_sec_ctx from the current session info
+ form a unix_sec_ctx from the current security_token
*/
-static NTSTATUS authinfo_to_unix_security(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req,
- struct auth_serversupplied_info *info,
+static NTSTATUS nt_token_to_unix_security(struct ntvfs_module_context *ntvfs,
+ struct ntvfs_request *req,
+ struct security_token *token,
struct unix_sec_ctx **sec)
{
+ struct unixuid_private *private = ntvfs->private_data;
int i;
NTSTATUS status;
- *sec = talloc_p(req, struct unix_sec_ctx);
+ *sec = talloc(req, struct unix_sec_ctx);
- status = sid_to_unixuid(ntvfs, req, info->user_sid, &(*sec)->uid);
+ /* we can't do unix security without a user and group */
+ if (token->num_sids < 2) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ status = sidmap_sid_to_unixuid(private->sidmap,
+ token->user_sid, &(*sec)->uid);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- status = sid_to_unixgid(ntvfs, req, info->primary_group_sid, &(*sec)->gid);
+ status = sidmap_sid_to_unixgid(private->sidmap,
+ token->group_sid, &(*sec)->gid);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- (*sec)->ngroups = info->n_domain_groups;
- (*sec)->groups = talloc_array_p(*sec, gid_t, (*sec)->ngroups);
+ (*sec)->ngroups = token->num_sids - 2;
+ (*sec)->groups = talloc_array(*sec, gid_t, (*sec)->ngroups);
if ((*sec)->groups == NULL) {
return NT_STATUS_NO_MEMORY;
}
for (i=0;i<(*sec)->ngroups;i++) {
- status = sid_to_unixgid(ntvfs, req, info->domain_groups[i], &(*sec)->groups[i]);
+ status = sidmap_sid_to_unixgid(private->sidmap,
+ token->sids[i+2], &(*sec)->groups[i]);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
setup our unix security context according to the session authentication info
*/
static NTSTATUS unixuid_setup_security(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct unix_sec_ctx **sec)
+ struct ntvfs_request *req, struct unix_sec_ctx **sec)
{
- struct auth_serversupplied_info *info = req->session->session_info->server_info;
- void *ctx = talloc(req, 0);
+ struct unixuid_private *private = ntvfs->private_data;
+ struct security_token *token;
struct unix_sec_ctx *newsec;
NTSTATUS status;
- *sec = save_unix_security(req);
+ if (req->session_info == NULL) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ token = req->session_info->security_token;
+
+ *sec = save_unix_security(ntvfs);
if (*sec == NULL) {
return NT_STATUS_NO_MEMORY;
}
- status = authinfo_to_unix_security(ntvfs, req, info, &newsec);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(ctx);
- return status;
+ if (token == private->last_token) {
+ newsec = private->last_sec_ctx;
+ } else {
+ status = nt_token_to_unix_security(ntvfs, req, token, &newsec);
+ if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(*sec);
+ return status;
+ }
+ if (private->last_sec_ctx) {
+ talloc_free(private->last_sec_ctx);
+ }
+ private->last_sec_ctx = newsec;
+ private->last_token = token;
+ talloc_steal(private, newsec);
}
status = set_unix_security(newsec);
if (!NT_STATUS_IS_OK(status)) {
- talloc_free(ctx);
+ talloc_free(*sec);
return status;
}
- talloc_free(ctx);
-
return NT_STATUS_OK;
}
NTSTATUS status2; \
struct unix_sec_ctx *sec; \
status = unixuid_setup_security(ntvfs, req, &sec); \
- if (NT_STATUS_IS_OK(status)) status = ntvfs_next_##op args; \
+ NT_STATUS_NOT_OK_RETURN(status); \
+ status = ntvfs_next_##op args; \
status2 = set_unix_security(sec); \
+ talloc_free(sec); \
if (!NT_STATUS_IS_OK(status2)) smb_panic("Unable to reset security context"); \
} while (0)
connect to a share - used when a tree_connect operation comes in.
*/
static NTSTATUS unixuid_connect(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, const char *sharename)
+ struct ntvfs_request *req, const char *sharename)
{
struct unixuid_private *private;
NTSTATUS status;
- private = talloc_p(req->tcon, struct unixuid_private);
+ private = talloc(ntvfs, struct unixuid_private);
if (!private) {
return NT_STATUS_NO_MEMORY;
}
- private->samctx = samdb_connect(private);
- if (private->samctx == NULL) {
+ private->sidmap = sidmap_open(private);
+ if (private->sidmap == NULL) {
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
ntvfs->private_data = private;
+ private->last_sec_ctx = NULL;
+ private->last_token = NULL;
- PASS_THRU_REQ(ntvfs, req, connect, (ntvfs, req, sharename));
+ /* we don't use PASS_THRU_REQ here, as the connect operation runs with
+ root privileges. This allows the backends to setup any database
+ links they might need during the connect. */
+ status = ntvfs_next_connect(ntvfs, req, sharename);
return status;
}
/*
disconnect from a share
*/
-static NTSTATUS unixuid_disconnect(struct ntvfs_module_context *ntvfs,
- struct smbsrv_tcon *tcon)
+static NTSTATUS unixuid_disconnect(struct ntvfs_module_context *ntvfs)
{
struct unixuid_private *private = ntvfs->private_data;
NTSTATUS status;
talloc_free(private);
+ ntvfs->private_data = NULL;
- status = ntvfs_next_disconnect(ntvfs, tcon);
+ status = ntvfs_next_disconnect(ntvfs);
return status;
}
delete a file
*/
static NTSTATUS unixuid_unlink(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_unlink *unl)
+ struct ntvfs_request *req,
+ union smb_unlink *unl)
{
NTSTATUS status;
ioctl interface
*/
static NTSTATUS unixuid_ioctl(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_ioctl *io)
+ struct ntvfs_request *req, union smb_ioctl *io)
{
NTSTATUS status;
check if a directory exists
*/
static NTSTATUS unixuid_chkpath(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_chkpath *cp)
+ struct ntvfs_request *req,
+ union smb_chkpath *cp)
{
NTSTATUS status;
return info on a pathname
*/
static NTSTATUS unixuid_qpathinfo(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_fileinfo *info)
+ struct ntvfs_request *req, union smb_fileinfo *info)
{
NTSTATUS status;
query info on a open file
*/
static NTSTATUS unixuid_qfileinfo(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_fileinfo *info)
+ struct ntvfs_request *req, union smb_fileinfo *info)
{
NTSTATUS status;
set info on a pathname
*/
static NTSTATUS unixuid_setpathinfo(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_setfileinfo *st)
+ struct ntvfs_request *req, union smb_setfileinfo *st)
{
NTSTATUS status;
open a file
*/
static NTSTATUS unixuid_open(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_open *io)
+ struct ntvfs_request *req, union smb_open *io)
{
NTSTATUS status;
create a directory
*/
static NTSTATUS unixuid_mkdir(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_mkdir *md)
+ struct ntvfs_request *req, union smb_mkdir *md)
{
NTSTATUS status;
remove a directory
*/
static NTSTATUS unixuid_rmdir(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_rmdir *rd)
+ struct ntvfs_request *req, struct smb_rmdir *rd)
{
NTSTATUS status;
rename a set of files
*/
static NTSTATUS unixuid_rename(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_rename *ren)
+ struct ntvfs_request *req, union smb_rename *ren)
{
NTSTATUS status;
copy a set of files
*/
static NTSTATUS unixuid_copy(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_copy *cp)
+ struct ntvfs_request *req, struct smb_copy *cp)
{
NTSTATUS status;
read from a file
*/
static NTSTATUS unixuid_read(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_read *rd)
+ struct ntvfs_request *req, union smb_read *rd)
{
NTSTATUS status;
write to a file
*/
static NTSTATUS unixuid_write(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_write *wr)
+ struct ntvfs_request *req, union smb_write *wr)
{
NTSTATUS status;
seek in a file
*/
static NTSTATUS unixuid_seek(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_seek *io)
+ struct ntvfs_request *req,
+ union smb_seek *io)
{
NTSTATUS status;
flush a file
*/
static NTSTATUS unixuid_flush(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_flush *io)
+ struct ntvfs_request *req,
+ union smb_flush *io)
{
NTSTATUS status;
close a file
*/
static NTSTATUS unixuid_close(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_close *io)
+ struct ntvfs_request *req, union smb_close *io)
{
NTSTATUS status;
exit - closing files
*/
static NTSTATUS unixuid_exit(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req)
+ struct ntvfs_request *req)
{
NTSTATUS status;
logoff - closing files
*/
static NTSTATUS unixuid_logoff(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req)
+ struct ntvfs_request *req)
{
+ struct unixuid_private *private = ntvfs->private_data;
NTSTATUS status;
PASS_THRU_REQ(ntvfs, req, logoff, (ntvfs, req));
+ private->last_token = NULL;
+
+ return status;
+}
+
+/*
+ async setup
+*/
+static NTSTATUS unixuid_async_setup(struct ntvfs_module_context *ntvfs,
+ struct ntvfs_request *req,
+ void *private)
+{
+ NTSTATUS status;
+
+ PASS_THRU_REQ(ntvfs, req, async_setup, (ntvfs, req, private));
+
+ return status;
+}
+
+/*
+ cancel an async request
+*/
+static NTSTATUS unixuid_cancel(struct ntvfs_module_context *ntvfs,
+ struct ntvfs_request *req)
+{
+ NTSTATUS status;
+
+ PASS_THRU_REQ(ntvfs, req, cancel, (ntvfs, req));
+
+ return status;
+}
+
+/*
+ change notify
+*/
+static NTSTATUS unixuid_notify(struct ntvfs_module_context *ntvfs,
+ struct ntvfs_request *req, union smb_notify *info)
+{
+ NTSTATUS status;
+
+ PASS_THRU_REQ(ntvfs, req, notify, (ntvfs, req, info));
+
return status;
}
lock a byte range
*/
static NTSTATUS unixuid_lock(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_lock *lck)
+ struct ntvfs_request *req, union smb_lock *lck)
{
NTSTATUS status;
set info on a open file
*/
static NTSTATUS unixuid_setfileinfo(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req,
+ struct ntvfs_request *req,
union smb_setfileinfo *info)
{
NTSTATUS status;
return filesystem space info
*/
static NTSTATUS unixuid_fsinfo(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_fsinfo *fs)
+ struct ntvfs_request *req, union smb_fsinfo *fs)
{
NTSTATUS status;
return print queue info
*/
static NTSTATUS unixuid_lpq(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_lpq *lpq)
+ struct ntvfs_request *req, union smb_lpq *lpq)
{
NTSTATUS status;
list files in a directory matching a wildcard pattern
*/
static NTSTATUS unixuid_search_first(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_search_first *io,
+ struct ntvfs_request *req, union smb_search_first *io,
void *search_private,
- BOOL (*callback)(void *, union smb_search_data *))
+ BOOL (*callback)(void *, const union smb_search_data *))
{
NTSTATUS status;
/* continue a search */
static NTSTATUS unixuid_search_next(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_search_next *io,
+ struct ntvfs_request *req, union smb_search_next *io,
void *search_private,
- BOOL (*callback)(void *, union smb_search_data *))
+ BOOL (*callback)(void *, const union smb_search_data *))
{
NTSTATUS status;
/* close a search */
static NTSTATUS unixuid_search_close(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_search_close *io)
+ struct ntvfs_request *req, union smb_search_close *io)
{
NTSTATUS status;
/* SMBtrans - not used on file shares */
static NTSTATUS unixuid_trans(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_trans2 *trans2)
+ struct ntvfs_request *req, struct smb_trans2 *trans2)
{
NTSTATUS status;
{
NTSTATUS ret;
struct ntvfs_ops ops;
+ NTVFS_CURRENT_CRITICAL_SIZES(vers);
ZERO_STRUCT(ops);
ops.search_close = unixuid_search_close;
ops.trans = unixuid_trans;
ops.logoff = unixuid_logoff;
+ ops.async_setup = unixuid_async_setup;
+ ops.cancel = unixuid_cancel;
+ ops.notify = unixuid_notify;
ops.name = "unixuid";
/* we register under all 3 backend types, as we are not type specific */
ops.type = NTVFS_DISK;
- ret = register_backend("ntvfs", &ops);
+ ret = ntvfs_register(&ops, &vers);
if (!NT_STATUS_IS_OK(ret)) goto failed;
ops.type = NTVFS_PRINT;
- ret = register_backend("ntvfs", &ops);
+ ret = ntvfs_register(&ops, &vers);
if (!NT_STATUS_IS_OK(ret)) goto failed;
ops.type = NTVFS_IPC;
- ret = register_backend("ntvfs", &ops);
+ ret = ntvfs_register(&ops, &vers);
if (!NT_STATUS_IS_OK(ret)) goto failed;
failed:
git.samba.org / kai / samba-autobuild / .git / blobdiff