CVE-2020-25717: s3:auth: Check minimum domain uid

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[abartlet@samba.org Removed knownfail on advice from metze]

diff --git a/selftest/knownfail.d/min_domain_uid b/selftest/knownfail.d/min_domain_uid
deleted file mode 100644 (file)
index 00bf75c..0000000
--- a/selftest/knownfail.d/min_domain_uid
+++ /dev/null
@@ -1 +0,0 @@
-^samba.tests.krb5.test_min_domain_uid.samba.*.SmbMinDomainUid.test_min_domain_uid_.*\(ad_member_no_nss_wb:local\)

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index 0a1cf4803e4e96cc60ec31552326a5fd3aff47b0..9ff7256bbed7672936bf6206550ba8825e8717e5 100644 (file)
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -2117,6 +2117,22 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
                        }
                }
                goto out;
+       } else if ((lp_security() == SEC_ADS || lp_security() == SEC_DOMAIN) &&
+                  !is_myname(domain) && pwd->pw_uid < lp_min_domain_uid()) {
+               /*
+                * !is_myname(domain) because when smbd starts tries to setup
+                * the guest user info, calling this function with nobody
+                * username. Nobody is usually uid 65535 but it can be changed
+                * to a regular user with 'guest account' parameter
+                */
+               nt_status = NT_STATUS_INVALID_TOKEN;
+               DBG_NOTICE("Username '%s%s%s' is invalid on this system, "
+                          "it does not meet 'min domain uid' "
+                          "restriction (%u < %u): %s\n",
+                          nt_domain, lp_winbind_separator(), nt_username,
+                          pwd->pw_uid, lp_min_domain_uid(),
+                          nt_errstr(nt_status));
+               goto out;
        }
 
        result = make_server_info(tmp_ctx);