As requested by Volker, split this into smaller commits.
Jeremy.
enum security_ace_type *pacl_type,
mode_t perms,
bool directory_ace);
-NTSTATUS unpack_nt_owners(connection_struct *conn, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd);
+NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd);
SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl);
NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
SEC_DESC **ppdesc);
void unbecome_root(void);
bool become_user(connection_struct *conn, uint16 vuid);
bool unbecome_user(void);
-uid_t get_current_uid(connection_struct *conn);
-gid_t get_current_gid(connection_struct *conn);
-const UNIX_USER_TOKEN *get_current_utok(connection_struct *conn);
-const NT_USER_TOKEN *get_current_nttok(connection_struct *conn);
-uint16_t get_current_vuid(connection_struct *conn);
/* The following definitions come from smbd/utmp.c */
return False;
}
+ if (fsp->conn->admin_user) {
+ tok_copy = copy_unix_token(lck, tok);
+ if (tok_copy == NULL) {
+ TALLOC_FREE(lck);
+ return false;
+ }
+ tok_copy->uid = (uid_t)0;
+ tok = tok_copy;
+ }
+
set_delete_on_close_lck(lck, delete_on_close, tok);
if (fsp->is_directory) {
if (params.do_chown) {
/* chown logic is a copy/paste from posix_acl.c:set_nt_acl */
- NTSTATUS status = unpack_nt_owners(fsp->conn, &newUID, &newGID, security_info_sent, psd);
+ NTSTATUS status = unpack_nt_owners(SNUM(fsp->conn), &newUID, &newGID, security_info_sent, psd);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(8, ("unpack_nt_owners failed"));
return status;
#include "includes.h"
+extern struct current_user current_user;
+
/****************************************************************************
Run a file if it is a magic script.
****************************************************************************/
/* Initial delete on close was set and no one else
* wrote a real delete on close. */
- if (get_current_vuid(conn) != fsp->vuid) {
+ if (current_user.vuid != fsp->vuid) {
become_user(conn, fsp->vuid);
became_user = True;
}
fsp->delete_on_close = true;
- set_delete_on_close_lck(lck, True, get_current_utok(fsp->conn));
+ set_delete_on_close_lck(lck, True, ¤t_user.ut);
if (became_user) {
unbecome_user();
}
*/
fsp->update_write_time_on_close = false;
- if (!unix_token_equal(lck->delete_token, get_current_utok(conn))) {
+ if (!unix_token_equal(lck->delete_token, ¤t_user.ut)) {
/* Become the user who requested the delete. */
DEBUG(5,("close_remove_share_mode: file %s. "
* directories we don't care if anyone else
* wrote a real delete on close. */
- if (get_current_vuid(fsp->conn) != fsp->vuid) {
+ if (current_user.vuid != fsp->vuid) {
become_user(fsp->conn, fsp->vuid);
became_user = True;
}
send_stat_cache_delete_message(fsp->fsp_name->base_name);
- set_delete_on_close_lck(lck, True, get_current_utok(fsp->conn));
+ set_delete_on_close_lck(lck, True, ¤t_user.ut);
fsp->delete_on_close = true;
if (became_user) {
unbecome_user();
/*
* If user is a member of the Admin group
* we never hide files from them.
- * Use (uid_t)0 here not sec_initial_uid()
- * because of the RAW-SAMBA3HIDE test.
*/
- if (get_current_uid(conn) == (uid_t)0) {
+ if (conn->admin_user) {
return True;
}
/*
* If user is a member of the Admin group
* we never hide files from them.
- * Use (uid_t)0 here not sec_initial_uid()
- * because of the RAW-SAMBA3HIDE test.
*/
- if (get_current_uid(conn) == (uid_t)0) {
+ if (conn->admin_user) {
return True;
}
/*
* If user is a member of the Admin group
* we never hide files from them.
- * Use (uid_t)0 here not sec_initial_uid()
- * because of the RAW-SAMBA3HIDE test.
*/
- if (get_current_uid(conn) == (uid_t)0) {
+ if (conn->admin_user)
return False;
- }
SMB_ASSERT(VALID_STAT(smb_fname->st));
struct security_descriptor *secdesc = NULL;
bool ret;
- if (get_current_uid(conn) == (uid_t)0) {
+ if (conn->server_info->utok.uid == 0 || conn->admin_user) {
/* I'm sorry sir, I didn't know you were root... */
return true;
}
ret = false;
goto out;
}
- if (get_current_uid(conn) == (uid_t)0) {
+ if (conn->server_info->utok.uid == 0 || conn->admin_user) {
/* I'm sorry sir, I didn't know you were root... */
ret = true;
goto out;
DEBUG(10,("can_access_file_data: requesting 0x%x on file %s\n",
(unsigned int)access_mask, smb_fname_str_dbg(smb_fname)));
- if (get_current_uid(conn) == (uid_t)0) {
+ if (conn->server_info->utok.uid == 0 || conn->admin_user) {
/* I'm sorry sir, I didn't know you were root... */
return True;
}
SMB_ASSERT(VALID_STAT(smb_fname->st));
/* Check primary owner access. */
- if (get_current_uid(conn) == smb_fname->st.st_ex_uid) {
+ if (conn->server_info->utok.uid == smb_fname->st.st_ex_uid) {
switch (access_mask) {
case FILE_READ_DATA:
return (smb_fname->st.st_ex_mode & S_IRUSR) ?
vuser->server_info->sam_account);
}
/* modelled after NTAS 3.51 reply */
- SSVAL(p,usri11_priv,
- (get_current_uid(conn) == (uid_t)0)?
- USER_PRIV_ADMIN:USER_PRIV_USER);
+ SSVAL(p,usri11_priv,conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
SIVAL(p,usri11_auth_flags,AF_OP_PRINT); /* auth flags */
SIVALS(p,usri11_password_age,-1); /* password age */
SIVAL(p,usri11_homedir,PTR_DIFF(p2,p)); /* home dir */
memset(p+22,' ',16); /* password */
SIVALS(p,38,-1); /* password age */
SSVAL(p,42,
- (get_current_uid(conn) == (uid_t)0)?
- USER_PRIV_ADMIN:USER_PRIV_USER);
+ conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
SIVAL(p,44,PTR_DIFF(p2,*rdata)); /* home dir */
strlcpy(p2, vuser ? pdb_get_homedir(
vuser->server_info->sam_account) : "",
PACKI(&desc,"W",0); /* code */
PACKS(&desc,"B21",name); /* eff. name */
PACKS(&desc,"B",""); /* pad */
- PACKI(&desc,"W",
- (get_current_uid(conn) == (uid_t)0)?
- USER_PRIV_ADMIN:USER_PRIV_USER);
+ PACKI(&desc,"W", conn->admin_user?USER_PRIV_ADMIN:USER_PRIV_USER);
PACKI(&desc,"D",0); /* auth flags XXX */
PACKI(&desc,"W",0); /* num logons */
PACKI(&desc,"W",0); /* bad pw count */
{
*access_granted = 0;
- if (get_current_uid(conn) == (uid_t)0) {
+ if (conn->server_info->utok.uid == 0 || conn->admin_user) {
/* I'm sorry sir, I didn't know you were root... */
*access_granted = access_desired;
if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
new_file_created = True;
}
- set_share_mode(lck, fsp, get_current_uid(conn), 0,
+ set_share_mode(lck, fsp, conn->server_info->utok.uid, 0,
fsp->oplock_type);
/* Handle strange delete on close create semantics. */
return status;
}
- set_share_mode(lck, fsp, get_current_uid(conn), 0, NO_OPLOCK);
+ set_share_mode(lck, fsp, conn->server_info->utok.uid, 0, NO_OPLOCK);
/* For directories the delete on close bit at open time seems
always to be honored on close... See test 19 in Samba4 BASE-DELETE. */
#include "includes.h"
+extern struct current_user current_user;
extern const struct generic_mapping file_generic_mapping;
#undef DBGC_CLASS
Unpack a SEC_DESC into a UNIX owner and group.
****************************************************************************/
-NTSTATUS unpack_nt_owners(struct connection_struct *conn,
- uid_t *puser, gid_t *pgrp,
- uint32 security_info_sent, const SEC_DESC *psd)
+NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd)
{
DOM_SID owner_sid;
DOM_SID grp_sid;
if (security_info_sent & OWNER_SECURITY_INFORMATION) {
sid_copy(&owner_sid, psd->owner_sid);
if (!sid_to_uid(&owner_sid, puser)) {
- if (lp_force_unknown_acl_user(SNUM(conn))) {
+ if (lp_force_unknown_acl_user(snum)) {
/* this allows take ownership to work
* reasonably */
- *puser = get_current_uid(conn);
+ *puser = current_user.ut.uid;
} else {
DEBUG(3,("unpack_nt_owners: unable to validate"
" owner sid for %s\n",
if (security_info_sent & GROUP_SECURITY_INFORMATION) {
sid_copy(&grp_sid, psd->group_sid);
if (!sid_to_gid( &grp_sid, pgrp)) {
- if (lp_force_unknown_acl_user(SNUM(conn))) {
+ if (lp_force_unknown_acl_user(snum)) {
/* this allows take group ownership to work
* reasonably */
- *pgrp = get_current_gid(conn);
+ *pgrp = current_user.ut.gid;
} else {
DEBUG(3,("unpack_nt_owners: unable to validate"
" group sid.\n"));
expensive and will need optimisation. A *lot* of optimisation :-). JRA.
****************************************************************************/
-static bool uid_entry_in_group(connection_struct *conn, canon_ace *uid_ace, canon_ace *group_ace )
+static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
{
const char *u_name = NULL;
* if it's the current user, we already have the unix token
* and don't need to do the complex user_in_group_sid() call
*/
- if (uid_ace->unix_ug.uid == get_current_uid(conn)) {
- const UNIX_USER_TOKEN *curr_utok = NULL;
+ if (uid_ace->unix_ug.uid == current_user.ut.uid) {
size_t i;
- if (group_ace->unix_ug.gid == get_current_gid(conn)) {
+ if (group_ace->unix_ug.gid == current_user.ut.gid) {
return True;
}
- curr_utok = get_current_utok(conn);
- for (i=0; i < curr_utok->ngroups; i++) {
- if (group_ace->unix_ug.gid == curr_utok->groups[i]) {
+ for (i=0; i < current_user.ut.ngroups; i++) {
+ if (group_ace->unix_ug.gid == current_user.ut.groups[i]) {
return True;
}
}
type.
****************************************************************************/
-static bool ensure_canon_entry_valid(connection_struct *conn, canon_ace **pp_ace,
+static bool ensure_canon_entry_valid(canon_ace **pp_ace,
const struct share_params *params,
const bool is_directory,
const DOM_SID *pfile_owner_sid,
for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
- if (uid_entry_in_group(conn, pace, pace_iter)) {
+ if (uid_entry_in_group(pace, pace_iter)) {
pace->perms |= pace_iter->perms;
group_matched = True;
}
allow entries.
****************************************************************************/
-static void process_deny_list(connection_struct *conn, canon_ace **pp_ace_list )
+static void process_deny_list( canon_ace **pp_ace_list )
{
canon_ace *ace_list = *pp_ace_list;
canon_ace *curr_ace = NULL;
if (allow_ace_p->owner_type == UID_ACE)
continue;
- if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
+ if (uid_entry_in_group( curr_ace, allow_ace_p))
new_perms |= allow_ace_p->perms;
}
/* Mask off the deny group perms. */
- if (uid_entry_in_group(conn, allow_ace_p, curr_ace))
+ if (uid_entry_in_group( allow_ace_p, curr_ace))
allow_ace_p->perms &= ~curr_ace->perms;
}
/* OR in the group perms. */
- if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
+ if (uid_entry_in_group( curr_ace, allow_ace_p))
curr_ace->perms |= allow_ace_p->perms;
}
}
*/
print_canon_ace_list( "file ace - before deny", file_ace);
- process_deny_list(fsp->conn, &file_ace);
+ process_deny_list( &file_ace);
print_canon_ace_list( "dir ace - before deny", dir_ace);
- process_deny_list(fsp->conn, &dir_ace);
+ process_deny_list( &dir_ace);
/*
* A well formed POSIX file or default ACL has at least 3 entries, a
st.st_ex_mode = create_default_mode(fsp, False);
- if (!ensure_canon_entry_valid(fsp->conn, &file_ace, fsp->conn->params,
+ if (!ensure_canon_entry_valid(&file_ace, fsp->conn->params,
fsp->is_directory, pfile_owner_sid, pfile_grp_sid, &st, True)) {
free_canon_ace_list(file_ace);
free_canon_ace_list(dir_ace);
st.st_ex_mode = create_default_mode(fsp, True);
- if (dir_ace && !ensure_canon_entry_valid(fsp->conn, &dir_ace, fsp->conn->params,
+ if (dir_ace && !ensure_canon_entry_valid(&dir_ace, fsp->conn->params,
fsp->is_directory, pfile_owner_sid, pfile_grp_sid, &st, True)) {
free_canon_ace_list(file_ace);
free_canon_ace_list(dir_ace);
* This next call will ensure we have at least a user/group/world set.
*/
- if (!ensure_canon_entry_valid(conn, &l_head, conn->params,
+ if (!ensure_canon_entry_valid(&l_head, conn->params,
S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
psbuf, False))
goto fail;
Check if the current user group list contains a given group.
****************************************************************************/
-static bool current_user_in_group(connection_struct *conn, gid_t gid)
+static bool current_user_in_group(gid_t gid)
{
int i;
- const UNIX_USER_TOKEN *utok = get_current_utok(conn);
- for (i = 0; i < utok->ngroups; i++) {
- if (utok->groups[i] == gid) {
+ for (i = 0; i < current_user.ut.ngroups; i++) {
+ if (current_user.ut.groups[i] == gid) {
return True;
}
}
/* file primary group == user primary or supplementary group */
if (lp_acl_group_control(SNUM(conn)) &&
- current_user_in_group(conn, smb_fname->st.st_ex_gid)) {
+ current_user_in_group(smb_fname->st.st_ex_gid)) {
return true;
}
/* Case (2) / (3) */
if (lp_enable_privileges()) {
- bool has_take_ownership_priv = user_has_privileges(get_current_nttok(conn),
+ bool has_take_ownership_priv = user_has_privileges(current_user.nt_user_token,
&se_take_ownership);
- bool has_restore_priv = user_has_privileges(get_current_nttok(conn),
+ bool has_restore_priv = user_has_privileges(current_user.nt_user_token,
&se_restore);
/* Case (2) */
- if ( ( has_take_ownership_priv && ( uid == get_current_uid(conn) ) ) ||
+ if ( ( has_take_ownership_priv && ( uid == current_user.ut.uid ) ) ||
/* Case (3) */
( has_restore_priv ) ) {
and also copes with the case where the SID in a take ownership ACL is
a local SID on the users workstation
*/
- if (uid != get_current_uid(conn)) {
+ if (uid != current_user.ut.uid) {
errno = EPERM;
return -1;
}
* Unpack the user/group/world id's.
*/
- status = unpack_nt_owners( conn, &user, &grp, security_info_sent, psd);
+ status = unpack_nt_owners( SNUM(conn), &user, &grp, security_info_sent, psd);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
conn->read_only = readonly_share;
conn->admin_user = admin_user;
- if (conn->admin_user) {
- conn->server_info->utok.uid = sec_initial_uid();
- }
return(True);
}
return false;
}
- /* security = share sets force_user. */
- if (!conn->force_user && !vuser) {
- DEBUG(2,("change_to_user: Invalid vuid used %d in accessing "
- "share %s.\n",vuid, lp_servicename(snum) ));
- return False;
- }
-
/*
* conn->server_info is now correctly set up with a copy we can mess
* with for force_group etc.
*/
- uid = conn->server_info->utok.uid;
- gid = conn->server_info->utok.gid;
- num_groups = conn->server_info->utok.ngroups;
- group_list = conn->server_info->utok.groups;
+ if (conn->force_user) /* security = share sets this too */ {
+ uid = conn->server_info->utok.uid;
+ gid = conn->server_info->utok.gid;
+ group_list = conn->server_info->utok.groups;
+ num_groups = conn->server_info->utok.ngroups;
+ } else if (vuser) {
+ uid = conn->admin_user ? 0 : vuser->server_info->utok.uid;
+ gid = conn->server_info->utok.gid;
+ num_groups = conn->server_info->utok.ngroups;
+ group_list = conn->server_info->utok.groups;
+ } else {
+ DEBUG(2,("change_to_user: Invalid vuid used %d in accessing "
+ "share %s.\n",vuid, lp_servicename(snum) ));
+ return False;
+ }
/*
* See if we should force group for this service.
pop_conn_ctx();
return True;
}
-
-/****************************************************************************
- Return the current user we are running effectively as on this connection.
- I'd like to make this return conn->server_info->utok.uid, but become_root()
- doesn't alter this value.
-****************************************************************************/
-
-uid_t get_current_uid(connection_struct *conn)
-{
- return current_user.ut.uid;
-}
-
-/****************************************************************************
- Return the current group we are running effectively as on this connection.
- I'd like to make this return conn->server_info->utok.gid, but become_root()
- doesn't alter this value.
-****************************************************************************/
-
-gid_t get_current_gid(connection_struct *conn)
-{
- return current_user.ut.gid;
-}
-
-/****************************************************************************
- Return the UNIX token we are running effectively as on this connection.
- I'd like to make this return &conn->server_info->utok, but become_root()
- doesn't alter this value.
-****************************************************************************/
-
-const UNIX_USER_TOKEN *get_current_utok(connection_struct *conn)
-{
- return ¤t_user.ut;
-}
-
-const NT_USER_TOKEN *get_current_nttok(connection_struct *conn)
-{
- return current_user.nt_user_token;
-}
-
-uint16_t get_current_vuid(connection_struct *conn)
-{
- return current_user.vuid;
-}