2 Unix SMB/Netbios implementation.
5 Copyright (C) Andrew Tridgell 1992-1998
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 /* what user is current? */
25 extern struct current_user current_user;
27 /****************************************************************************
28 Become the guest user without changing the security context stack.
29 ****************************************************************************/
31 BOOL change_to_guest(void)
33 static struct passwd *pass=NULL;
34 static uid_t guest_uid = (uid_t)-1;
35 static gid_t guest_gid = (gid_t)-1;
36 static fstring guest_name;
39 pass = sys_getpwnam(lp_guestaccount());
42 guest_uid = pass->pw_uid;
43 guest_gid = pass->pw_gid;
44 fstrcpy(guest_name, pass->pw_name);
48 /* MWW: From AIX FAQ patch to WU-ftpd: call initgroups before
50 initgroups(guest_name, guest_gid);
53 set_sec_ctx(guest_uid, guest_gid, 0, NULL, NULL);
55 current_user.conn = NULL;
56 current_user.vuid = UID_FIELD_INVALID;
61 /*******************************************************************
62 Check if a username is OK.
63 ********************************************************************/
65 static BOOL check_user_ok(connection_struct *conn, user_struct *vuser,int snum)
68 for (i=0;i<conn->uid_cache.entries;i++)
69 if (conn->uid_cache.list[i] == vuser->uid)
72 if (!user_ok(vuser->user.unix_name,snum))
75 i = conn->uid_cache.entries % UID_CACHE_SIZE;
76 conn->uid_cache.list[i] = vuser->uid;
78 if (conn->uid_cache.entries < UID_CACHE_SIZE)
79 conn->uid_cache.entries++;
84 /****************************************************************************
85 Become the user of a connection number without changing the security context
86 stack, but modify the currnet_user entries.
87 ****************************************************************************/
89 BOOL change_to_user(connection_struct *conn, uint16 vuid)
91 user_struct *vuser = get_valid_user_struct(vuid);
96 BOOL must_free_token = False;
97 NT_USER_TOKEN *token = NULL;
100 DEBUG(2,("change_to_user: Connection not open\n"));
105 * We need a separate check in security=share mode due to vuid
106 * always being UID_FIELD_INVALID. If we don't do this then
107 * in share mode security we are *always* changing uid's between
108 * SMB's - this hurts performance - Badly.
111 if((lp_security() == SEC_SHARE) && (current_user.conn == conn) &&
112 (current_user.uid == conn->uid)) {
113 DEBUG(4,("change_to_user: Skipping user change - already user\n"));
115 } else if ((current_user.conn == conn) &&
116 (vuser != 0) && (current_user.vuid == vuid) &&
117 (current_user.uid == vuser->uid)) {
118 DEBUG(4,("change_to_user: Skipping user change - already user\n"));
124 if((vuser != NULL) && !check_user_ok(conn, vuser, snum))
127 if (conn->force_user ||
129 (lp_security() == SEC_SHARE)) {
132 current_user.groups = conn->groups;
133 current_user.ngroups = conn->ngroups;
134 token = conn->nt_user_token;
137 DEBUG(2,("change_to_user: Invalid vuid used %d\n",vuid));
142 current_user.ngroups = vuser->n_groups;
143 current_user.groups = vuser->groups;
144 token = vuser->nt_user_token;
148 * See if we should force group for this service.
149 * If so this overrides any group set in the force
153 if((group_c = *lp_force_group(snum))) {
154 BOOL is_guest = False;
159 * Only force group if the user is a member of
160 * the service group. Check the group memberships for
161 * this user (we already have this) to
162 * see if we should force the group.
166 for (i = 0; i < current_user.ngroups; i++) {
167 if (current_user.groups[i] == conn->gid) {
177 * We've changed the group list in the token - we must
181 if (vuser && vuser->guest)
184 token = create_nt_token(uid, gid, current_user.ngroups, current_user.groups, is_guest, NULL);
185 must_free_token = True;
188 set_sec_ctx(uid, gid, current_user.ngroups, current_user.groups, token);
191 * Free the new token (as set_sec_ctx copies it).
195 delete_nt_token(&token);
197 current_user.conn = conn;
198 current_user.vuid = vuid;
200 DEBUG(5,("change_to_user uid=(%d,%d) gid=(%d,%d)\n",
201 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
206 /****************************************************************************
207 Go back to being root without changing the security context stack,
208 but modify the current_user entries.
209 ****************************************************************************/
211 BOOL change_to_root_user(void)
215 DEBUG(5,("change_to_root_user: now uid=(%d,%d) gid=(%d,%d)\n",
216 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
218 current_user.conn = NULL;
219 current_user.vuid = UID_FIELD_INVALID;
224 /****************************************************************************
225 Become the user of an authenticated connected named pipe.
226 When this is called we are currently running as the connection
227 user. Doesn't modify current_user.
228 ****************************************************************************/
230 BOOL become_authenticated_pipe_user(pipes_struct *p)
235 set_sec_ctx(p->pipe_user.uid, p->pipe_user.gid,
236 p->pipe_user.ngroups, p->pipe_user.groups, p->pipe_user.nt_user_token);
241 /****************************************************************************
242 Unbecome the user of an authenticated connected named pipe.
243 When this is called we are running as the authenticated pipe
244 user and need to go back to being the connection user. Doesn't modify
246 ****************************************************************************/
248 BOOL unbecome_authenticated_pipe_user(void)
250 return pop_sec_ctx();
253 /****************************************************************************
254 Utility functions used by become_xxx/unbecome_xxx.
255 ****************************************************************************/
258 connection_struct *conn;
262 /* A stack of current_user connection contexts. */
264 static struct conn_ctx conn_ctx_stack[MAX_SEC_CTX_DEPTH];
265 static int conn_ctx_stack_ndx;
267 static void push_conn_ctx(void)
269 struct conn_ctx *ctx_p;
271 /* Check we don't overflow our stack */
273 if (conn_ctx_stack_ndx == MAX_SEC_CTX_DEPTH) {
274 DEBUG(0, ("Connection context stack overflow!\n"));
275 smb_panic("Connection context stack overflow!\n");
278 /* Store previous user context */
279 ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
281 ctx_p->conn = current_user.conn;
282 ctx_p->vuid = current_user.vuid;
284 DEBUG(3, ("push_conn_ctx(%u) : conn_ctx_stack_ndx = %d\n",
285 (unsigned int)ctx_p->vuid, conn_ctx_stack_ndx ));
287 conn_ctx_stack_ndx++;
290 static void pop_conn_ctx(void)
292 struct conn_ctx *ctx_p;
294 /* Check for stack underflow. */
296 if (conn_ctx_stack_ndx == 0) {
297 DEBUG(0, ("Connection context stack underflow!\n"));
298 smb_panic("Connection context stack underflow!\n");
301 conn_ctx_stack_ndx--;
302 ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
304 current_user.conn = ctx_p->conn;
305 current_user.vuid = ctx_p->vuid;
308 ctx_p->vuid = UID_FIELD_INVALID;
311 void init_conn_ctx(void)
315 /* Initialise connection context stack */
316 for (i = 0; i < MAX_SEC_CTX_DEPTH; i++) {
317 conn_ctx_stack[i].conn = NULL;
318 conn_ctx_stack[i].vuid = UID_FIELD_INVALID;
322 /****************************************************************************
323 Temporarily become a root user. Must match with unbecome_root(). Saves and
324 restores the connection context.
325 ****************************************************************************/
327 void become_root(void)
334 /* Unbecome the root user */
336 void unbecome_root(void)
342 /****************************************************************************
343 Push the current security context then force a change via change_to_user().
344 Saves and restores the connection context.
345 ****************************************************************************/
347 BOOL become_user(connection_struct *conn, uint16 vuid)
354 if (!change_to_user(conn, vuid)) {
363 BOOL unbecome_user(void)
370 /*****************************************************************
371 Convert the suplimentary SIDs returned in a netlogon into UNIX
372 group gid_t's. Add to the total group array.
373 *****************************************************************/
375 void add_supplementary_nt_login_groups(int *n_groups, gid_t **pp_groups, NT_USER_TOKEN **pptok)
378 int current_n_groups = *n_groups;
379 gid_t *final_groups = NULL;
381 NT_USER_TOKEN *ptok = *pptok;
382 NT_USER_TOKEN *new_tok = NULL;
384 if (!ptok || (ptok->num_sids == 0))
387 new_tok = dup_nt_token(ptok);
389 DEBUG(0,("add_supplementary_nt_login_groups: Failed to malloc new token\n"));
392 /* Leave the allocated space but empty the number of SIDs. */
393 new_tok->num_sids = 0;
395 total_groups = current_n_groups + ptok->num_sids;
397 final_groups = (gid_t *)malloc(total_groups * sizeof(gid_t));
399 DEBUG(0,("add_supplementary_nt_login_groups: Failed to malloc new groups.\n"));
400 delete_nt_token(&new_tok);
404 memcpy(final_groups, *pp_groups, current_n_groups * sizeof(gid_t));
405 for (i = 0; i < ptok->num_sids; i++) {
406 enum SID_NAME_USE sid_type;
409 if (sid_to_gid(&ptok->user_sids[i], &new_grp, &sid_type)) {
411 * Don't add the gid_t if it is already in the current group
412 * list. Some UNIXen don't like the same group more than once.
416 for (j = 0; j < current_n_groups; j++)
417 if (final_groups[j] == new_grp)
420 if ( j == current_n_groups) {
421 /* Group not already present. */
422 final_groups[current_n_groups++] = new_grp;
425 /* SID didn't map. Copy to the new token to be saved. */
426 sid_copy(&new_tok->user_sids[new_tok->num_sids++], &ptok->user_sids[i]);
430 SAFE_FREE(*pp_groups);
431 *pp_groups = final_groups;
432 *n_groups = current_n_groups;
434 /* Replace the old token with the truncated one. */
435 delete_nt_token(&ptok);
439 /*****************************************************************
440 *THE CANONICAL* convert name to SID function.
441 Tries winbind first - then uses local lookup.
442 *****************************************************************/
444 BOOL lookup_name(const char *name, DOM_SID *psid, enum SID_NAME_USE *name_type)
446 extern pstring global_myname;
447 extern fstring global_myworkgroup;
449 char *sep = lp_winbind_separator();
451 *name_type = SID_NAME_UNKNOWN;
453 if (!winbind_lookup_name(name, psid, name_type) || (*name_type != SID_NAME_USER) ) {
456 DEBUG(10, ("lookup_name: winbind lookup for %s failed - trying local\n", name));
458 /* If we are looking up a domain user, make sure it is
459 for the local machine only */
461 if (strchr_m(name, sep[0]) || strchr_m(name, '\\')) {
462 fstring domain, username;
464 split_domain_name(name, domain, username);
466 switch (lp_server_role()) {
467 case ROLE_DOMAIN_PDC:
468 case ROLE_DOMAIN_BDC:
469 if (strequal(domain, global_myworkgroup)) {
470 fstrcpy(domain, global_myname);
471 ret = local_lookup_name(domain, username, psid, name_type);
473 /* No break is deliberate here. JRA. */
475 if (strcasecmp(global_myname, domain) != 0) {
476 DEBUG(5, ("lookup_name: domain %s is not local\n", domain));
477 ret = local_lookup_name(global_myname, username, psid, name_type);
481 ret = local_lookup_name(global_myname, name, psid, name_type);
486 ("lookup_name: (local) %s -> SID %s (type %u)\n",
487 name, sid_to_string(sid,psid),
488 (unsigned int)*name_type ));
490 DEBUG(10,("lookup name: (local) %s failed.\n", name));
496 DEBUG(10,("lookup_name (winbindd): %s -> SID %s (type %u)\n",
497 name, sid_to_string(sid, psid),
498 (unsigned int)*name_type));
502 /*****************************************************************
503 *THE CANONICAL* convert SID to name function.
504 Tries winbind first - then uses local lookup.
505 *****************************************************************/
507 BOOL lookup_sid(DOM_SID *sid, fstring dom_name, fstring name, enum SID_NAME_USE *name_type)
512 *name_type = SID_NAME_UNKNOWN;
514 /* Check if this is our own sid. This should perhaps be done by
515 winbind? For the moment handle it here. */
517 if (sid->num_auths == 5) {
521 sid_copy(&tmp_sid, sid);
522 sid_split_rid(&tmp_sid, &rid);
524 if (sid_equal(&global_sam_sid, &tmp_sid)) {
526 return map_domain_sid_to_name(&tmp_sid, dom_name) &&
527 local_lookup_sid(sid, name, name_type);
531 if (!winbind_lookup_sid(sid, dom_name, name, name_type)) {
536 DEBUG(10,("lookup_sid: winbind lookup for SID %s failed - trying local.\n", sid_to_string(sid_str, sid) ));
538 sid_copy(&tmp_sid, sid);
539 sid_split_rid(&tmp_sid, &rid);
540 return map_domain_sid_to_name(&tmp_sid, dom_name) &&
541 lookup_known_rid(&tmp_sid, rid, name, name_type);
546 /*****************************************************************
547 *THE CANONICAL* convert uid_t to SID function.
548 Tries winbind first - then uses local lookup.
550 *****************************************************************/
552 DOM_SID *uid_to_sid(DOM_SID *psid, uid_t uid)
557 if (lp_winbind_uid(&low, &high) && uid >= low && uid <= high) {
558 if (winbind_uid_to_sid(psid, uid)) {
560 DEBUG(10,("uid_to_sid: winbindd %u -> %s\n",
561 (unsigned int)uid, sid_to_string(sid, psid)));
567 local_uid_to_sid(psid, uid);
569 DEBUG(10,("uid_to_sid: local %u -> %s\n", (unsigned int)uid, sid_to_string(sid, psid)));
574 /*****************************************************************
575 *THE CANONICAL* convert gid_t to SID function.
576 Tries winbind first - then uses local lookup.
578 *****************************************************************/
580 DOM_SID *gid_to_sid(DOM_SID *psid, gid_t gid)
585 if (lp_winbind_gid(&low, &high) && gid >= low && gid <= high) {
586 if (winbind_gid_to_sid(psid, gid)) {
588 DEBUG(10,("gid_to_sid: winbindd %u -> %s\n",
589 (unsigned int)gid, sid_to_string(sid, psid)));
595 local_gid_to_sid(psid, gid);
597 DEBUG(10,("gid_to_sid: local %u -> %s\n", (unsigned int)gid, sid_to_string(sid, psid)));
602 /*****************************************************************
603 *THE CANONICAL* convert SID to uid function.
604 Tries winbind first - then uses local lookup.
605 Returns True if this name is a user sid and the conversion
606 was done correctly, False if not. sidtype is set by this function.
607 *****************************************************************/
609 BOOL sid_to_uid(DOM_SID *psid, uid_t *puid, enum SID_NAME_USE *sidtype)
611 fstring dom_name, name, sid_str;
612 enum SID_NAME_USE name_type;
614 *sidtype = SID_NAME_UNKNOWN;
617 * First we must look up the name and decide if this is a user sid.
620 if ( (!winbind_lookup_sid(psid, dom_name, name, &name_type)) || (name_type != SID_NAME_USER) ) {
621 DEBUG(10,("sid_to_uid: winbind lookup for sid %s failed - trying local.\n",
622 sid_to_string(sid_str, psid) ));
624 return local_sid_to_uid(puid, psid, sidtype);
628 * Ensure this is a user sid.
631 if (name_type != SID_NAME_USER) {
632 DEBUG(10,("sid_to_uid: winbind lookup succeeded but SID is not a uid (%u)\n",
633 (unsigned int)name_type ));
637 *sidtype = SID_NAME_USER;
640 * Get the uid for this SID.
643 if (!winbind_sid_to_uid(puid, psid)) {
644 DEBUG(10,("sid_to_uid: winbind lookup for sid %s failed.\n",
645 sid_to_string(sid_str, psid) ));
649 DEBUG(10,("sid_to_uid: winbindd %s -> %u\n",
650 sid_to_string(sid_str, psid),
651 (unsigned int)*puid ));
656 /*****************************************************************
657 *THE CANONICAL* convert SID to gid function.
658 Tries winbind first - then uses local lookup.
659 Returns True if this name is a user sid and the conversion
660 was done correctly, False if not.
661 *****************************************************************/
663 BOOL sid_to_gid(DOM_SID *psid, gid_t *pgid, enum SID_NAME_USE *sidtype)
665 fstring dom_name, name, sid_str;
666 enum SID_NAME_USE name_type;
668 *sidtype = SID_NAME_UNKNOWN;
671 * First we must look up the name and decide if this is a group sid.
674 if (!winbind_lookup_sid(psid, dom_name, name, &name_type)) {
675 DEBUG(10,("sid_to_gid: winbind lookup for sid %s failed - trying local.\n",
676 sid_to_string(sid_str, psid) ));
678 return local_sid_to_gid(pgid, psid, sidtype);
682 * Ensure this is a group sid.
685 if ((name_type != SID_NAME_DOM_GRP) && (name_type != SID_NAME_ALIAS) && (name_type != SID_NAME_WKN_GRP)) {
686 DEBUG(10,("sid_to_gid: winbind lookup succeeded but SID is not a known group (%u)\n",
687 (unsigned int)name_type ));
689 return local_sid_to_gid(pgid, psid, sidtype);
692 *sidtype = name_type;
695 * Get the gid for this SID.
698 if (!winbind_sid_to_gid(pgid, psid)) {
699 DEBUG(10,("sid_to_gid: winbind lookup for sid %s failed.\n",
700 sid_to_string(sid_str, psid) ));
704 DEBUG(10,("sid_to_gid: winbindd %s -> %u\n",
705 sid_to_string(sid_str, psid),
706 (unsigned int)*pgid ));