Much better support for both non-algorithic RIDs (where the RID is stored in

the passdb) and RIDs not in the passdb, due to being NIS users etc.

The main fix here is to add become_root()/unbecome_root() at critical places.

This (finally) fixes the bug where you could not see local users's names
in a file's security properties as non-root.  Tested.

The similar bug in uid_to_sid is also fixed, but is not (yet) Tested.

Andrew Bartlett
(This used to be commit 79327a305e20d78ab5ca21d01c39b5f49dc0d632)

diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index 7eecbfd2cd118cdc9ac89448df86ab61c8b185e2..17aefe115904e6fe63bef3ee31a9a45e70e951d9 100644 (file)
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -514,121 +514,116 @@ BOOL local_lookup_sid(DOM_SID *sid, char *name, enum SID_NAME_USE *psid_name_use
        uint32 rid;
        BOOL is_user;
        SAM_ACCOUNT *sam_account = NULL;
-       BOOL found = False;
+       uid_t uid;
+       struct passwd *pass;
+       GROUP_MAP map;
+       
 
        sid_peek_rid(sid, &rid);
-       is_user = pdb_rid_is_user(rid);
        *psid_name_use = SID_NAME_UNKNOWN;
-
-       DEBUG(5,("local_lookup_sid: looking up %s RID %u.\n", is_user ? "user" :
-                       "group", (unsigned int)rid));
-
-       if(is_user) {
-               if(rid == DOMAIN_USER_RID_ADMIN) {
-                       char **admin_list = lp_admin_users(-1);
-                       *psid_name_use = SID_NAME_USER;
-                       if (admin_list) {
-                               char *p = *admin_list;
-                               if(!next_token(&p, name, NULL, sizeof(fstring)))
-                                       fstrcpy(name, "Administrator");
-                       } else {
-                               fstrcpy(name, "Administrator");
-                       }
-               } else if (rid == DOMAIN_USER_RID_GUEST) {
-                       char *p = lp_guestaccount();
-                       *psid_name_use = SID_NAME_USER;
+       
+       DEBUG(5,("local_lookup_sid: looking up RID %u.\n", (unsigned int)rid));
+       
+       if (rid == DOMAIN_USER_RID_ADMIN) {
+               char **admin_list = lp_admin_users(-1);
+               *psid_name_use = SID_NAME_USER;
+               if (admin_list) {
+                       char *p = *admin_list;
                        if(!next_token(&p, name, NULL, sizeof(fstring)))
-                               fstrcpy(name, "Guest");
+                               fstrcpy(name, "Administrator");
                } else {
-                       uid_t uid;
-                       struct passwd *pass;
-                       
-                       /*
-                        * Don't try to convert the rid to a name if 
-                        * running in appliance mode
-                        */
-                       if (lp_hide_local_users())
-                               return False;
+                       fstrcpy(name, "Administrator");
+               }
+               return True;
 
-                       if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_account))) {
-                               return False;
-                       }
-                       
-                       if (pdb_getsampwrid(sam_account, rid)) {
-                               fstrcpy(name, pdb_get_username(sam_account));
-                               *psid_name_use = SID_NAME_USER;
-                               found = True;
-                       }
-                       
-                       pdb_free_sam(&sam_account);
+       } else if (rid == DOMAIN_USER_RID_GUEST) {
+               char *p = lp_guestaccount();
+               *psid_name_use = SID_NAME_USER;
+               if(!next_token(&p, name, NULL, sizeof(fstring)))
+                       fstrcpy(name, "Guest");
+               return True;
+
+       }
+
+       /*
+        * Don't try to convert the rid to a name if 
+        * running in appliance mode
+        */
+
+       if (lp_hide_local_users())
+               return False;
+               
+       if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_account))) {
+               return False;
+       }
+               
+       if (pdb_getsampwrid(sam_account, rid)) {
+               fstrcpy(name, pdb_get_username(sam_account));
+               *psid_name_use = SID_NAME_USER;
+
+               pdb_free_sam(&sam_account);
                        
-                       if (found) {
-                               return True;
-                       }
+               return True;
+       }
+               
+       pdb_free_sam(&sam_account);
+               
+       if (get_group_map_from_sid(*sid, &map, MAPPING_WITHOUT_PRIV)) {
+               if (map.gid!=-1) {
+                       DEBUG(5,("local_lookup_sid: mapped group %s to gid %u\n", map.nt_name, (unsigned int)map.gid));
+                       fstrcpy(name, map.nt_name);
+                       *psid_name_use = map.sid_name_use;
+                       return True;
+               }
+       }
+               
+       is_user = pdb_rid_is_user(rid);
+
+       DEBUG(5, ("assuming RID %u is a %s\n", (unsigned)rid, is_user ? "user" : "group"));
+
+       if (pdb_rid_is_user(rid)) {
+               uid = fallback_pdb_user_rid_to_uid(rid);
+               pass = getpwuid_alloc(uid);
                        
-                       uid = fallback_pdb_user_rid_to_uid(rid);
-                       pass = getpwuid_alloc(uid);
+               *psid_name_use = SID_NAME_USER;
                        
-                       *psid_name_use = SID_NAME_USER;
+               DEBUG(5,("local_lookup_sid: looking up uid %u %s\n", (unsigned int)uid,
+                        pass ? "succeeded" : "failed" ));
                        
-                       DEBUG(5,("local_lookup_sid: looking up uid %u %s\n", (unsigned int)uid,
-                                pass ? "succeeded" : "failed" ));
+               if(!pass) {
+                       slprintf(name, sizeof(fstring)-1, "unix_user.%u", (unsigned int)uid);
+                       return True;
+               }
                        
-                       if(!pass) {
-                               slprintf(name, sizeof(fstring)-1, "unix_user.%u", (unsigned int)uid);
-                               return True;
-                       }
+               fstrcpy(name, pass->pw_name);
                        
-                       fstrcpy(name, pass->pw_name);
+               DEBUG(5,("local_lookup_sid: found user %s for rid %u\n", name,
+                        (unsigned int)rid ));
                        
-                       DEBUG(5,("local_lookup_sid: found user %s for rid %u\n", name,
-                                (unsigned int)rid ));
+               passwd_free(&pass);
                        
-                       passwd_free(&pass);
-               }
-               
        } else {
                gid_t gid;
                struct group *gr; 
-               GROUP_MAP map;
-               
-               /* 
-                * Don't try to convert the rid to a name if running
-                * in appliance mode
-                */
-               
-               if (lp_hide_local_users()) 
-                       return False;
-
-               /* check if it's a mapped group */
-               if (get_group_map_from_sid(*sid, &map, MAPPING_WITHOUT_PRIV)) {
-                       if (map.gid!=-1) {
-                               DEBUG(5,("local_lookup_sid: mapped group %s to gid %u\n", map.nt_name, (unsigned int)map.gid));
-                               fstrcpy(name, map.nt_name);
-                               *psid_name_use = map.sid_name_use;
-                               return True;
-                       }
-               }
-               
+                       
                gid = pdb_group_rid_to_gid(rid);
                gr = getgrgid(gid);
-
+                       
                *psid_name_use = SID_NAME_ALIAS;
-
+                       
                DEBUG(5,("local_lookup_sid: looking up gid %u %s\n", (unsigned int)gid,
-                       gr ? "succeeded" : "failed" ));
-
+                        gr ? "succeeded" : "failed" ));
+                       
                if(!gr) {
                        slprintf(name, sizeof(fstring)-1, "unix_group.%u", (unsigned int)gid);
                        return False;
                }
-
+                       
                fstrcpy( name, gr->gr_name);
-
+                       
                DEBUG(5,("local_lookup_sid: found group %s for rid %u\n", name,
-                       (unsigned int)rid ));
+                        (unsigned int)rid ));
        }
-
        return True;
 }
 
@@ -643,7 +638,6 @@ BOOL local_lookup_name(const char *c_user, DOM_SID *psid, enum SID_NAME_USE *psi
        DOM_SID local_sid;
        fstring user;
        SAM_ACCOUNT *sam_account = NULL;
-       BOOL found = False;
        
        *psid_name_use = SID_NAME_UNKNOWN;
 
@@ -684,25 +678,23 @@ BOOL local_lookup_name(const char *c_user, DOM_SID *psid, enum SID_NAME_USE *psi
                *psid_name_use = SID_NAME_USER;
                
                sid_copy( psid, &local_sid);
-               found = True;
+               pdb_free_sam(&sam_account);
+               return True;
        }
 
        pdb_free_sam(&sam_account);
 
-       if (!found && (pass = Get_Pwnam(user))) {
+       if ((pass = Get_Pwnam(user))) {
                sid_append_rid( &local_sid, fallback_pdb_uid_to_user_rid(pass->pw_uid));
                *psid_name_use = SID_NAME_USER;
-               pdb_free_sam(&sam_account);
 
-       } else if (!found) {
+       } else {
                /*
                 * Maybe it was a group ?
                 */
                struct group *grp;
                GROUP_MAP map;
                
-               pdb_free_sam(&sam_account);
-
                /* check if it's a mapped group */
                if (get_group_map_from_ntname(user, &map, MAPPING_WITHOUT_PRIV)) {
                        if (map.gid!=-1) {
@@ -754,27 +746,36 @@ DOM_SID *local_uid_to_sid(DOM_SID *psid, uid_t uid)
        extern DOM_SID global_sam_sid;
        struct passwd *pass;
        SAM_ACCOUNT *sam_user = NULL;
+       fstring str; /* sid string buffer */
 
        sid_copy(psid, &global_sam_sid);
 
-       if(!(pass = getpwuid_alloc(uid)))
-               return NULL;
+       if((pass = getpwuid_alloc(uid))) {
 
-       if (NT_STATUS_IS_ERR(pdb_init_sam(&sam_user))) {
-               passwd_free(&pass);
-               return NULL;
-       }
-       
-       if (!pdb_getsampwnam(sam_user, pass->pw_name)) {
-               pdb_free_sam(&sam_user);
-               return NULL;
-       }
+               if (NT_STATUS_IS_ERR(pdb_init_sam(&sam_user))) {
+                       passwd_free(&pass);
+                       return NULL;
+               }
+               
+               if (pdb_getsampwnam(sam_user, pass->pw_name)) {
+                       sid_append_rid(psid, pdb_get_user_rid(sam_user));
+               } else {
+                       sid_append_rid(psid, fallback_pdb_uid_to_user_rid(uid));
+               }
 
-       passwd_free(&pass);
+               DEBUG(10,("local_uid_to_sid: uid %u -> SID (%s) (%s).\n", 
+                         (unsigned)uid, sid_to_string( str, psid),
+                         pass->pw_name ));
 
-       sid_append_rid(psid, pdb_get_user_rid(sam_user));
+               passwd_free(&pass);
+               pdb_free_sam(&sam_user);
+       
+       } else {
+               sid_append_rid(psid, fallback_pdb_uid_to_user_rid(uid));
 
-       pdb_free_sam(&sam_user);
+               DEBUG(10,("local_uid_to_sid: uid %u -> SID (%s) (unknown user).\n", 
+                         (unsigned)uid, sid_to_string( str, psid)));
+       }
 
        return psid;
 }
@@ -790,7 +791,6 @@ BOOL local_sid_to_uid(uid_t *puid, DOM_SID *psid, enum SID_NAME_USE *name_type)
        DOM_SID dom_sid;
        uint32 rid;
        fstring str;
-       struct passwd *pass;
        SAM_ACCOUNT *sam_user = NULL;
 
        *name_type = SID_NAME_UNKNOWN;
@@ -798,9 +798,6 @@ BOOL local_sid_to_uid(uid_t *puid, DOM_SID *psid, enum SID_NAME_USE *name_type)
        sid_copy(&dom_sid, psid);
        sid_split_rid(&dom_sid, &rid);
 
-       if (!pdb_rid_is_user(rid))
-               return False;
-
        /*
         * We can only convert to a uid if this is our local
         * Domain SID (ie. we are the controling authority).
@@ -811,28 +808,26 @@ BOOL local_sid_to_uid(uid_t *puid, DOM_SID *psid, enum SID_NAME_USE *name_type)
        if (NT_STATUS_IS_ERR(pdb_init_sam(&sam_user)))
                return False;
        
-       if (!pdb_getsampwrid(sam_user, rid)) {
-               pdb_free_sam(&sam_user);
-               return False;
+       if (pdb_getsampwrid(sam_user, rid)) {
+               *puid = pdb_get_uid(sam_user);
+               if (*puid == -1) {
+                       pdb_free_sam(&sam_user);
+                       return False;
+               }
+               DEBUG(10,("local_sid_to_uid: SID %s -> uid (%u) (%s).\n", sid_to_string( str, psid),
+                         (unsigned int)*puid, pdb_get_username(sam_user)));
+       } else {
+               if (pdb_rid_is_user(rid)) {
+                       *puid = fallback_pdb_user_rid_to_uid(rid);
+                       DEBUG(10,("local_sid_to_uid: SID %s -> uid (%u) (non-passdb user).\n", sid_to_string( str, psid),
+                                 (unsigned int)*puid));
+               } else {
+                       pdb_free_sam(&sam_user);
+                       return False;                   
+               }
        }
-       
-       *puid = pdb_get_uid(sam_user);
-       if (*puid == -1)
-               return False;
-
        pdb_free_sam(&sam_user);
 
-       /*
-        * Ensure this uid really does exist.
-        */
-       if(!(pass = getpwuid_alloc(*puid)))
-               return False;
-
-       DEBUG(10,("local_sid_to_uid: SID %s -> uid (%u) (%s).\n", sid_to_string( str, psid),
-               (unsigned int)*puid, pass->pw_name ));
-
-       passwd_free(&pass);
-
        *name_type = SID_NAME_USER;
 
        return True;
@@ -887,9 +882,6 @@ BOOL local_sid_to_gid(gid_t *pgid, DOM_SID *psid, enum SID_NAME_USE *name_type)
        if (!sid_equal(&global_sam_sid, &dom_sid))
                return False;
 
-       if (pdb_rid_is_user(rid))
-               return False;
-
        if (get_group_map_from_sid(*psid, &map, MAPPING_WITHOUT_PRIV)) {
                
                /* the SID is in the mapping table but not mapped */
@@ -897,9 +889,12 @@ BOOL local_sid_to_gid(gid_t *pgid, DOM_SID *psid, enum SID_NAME_USE *name_type)
                        return False;
 
                sid_peek_rid(&map.sid, &rid);
-               *pgid = rid;
+               *pgid = map.gid;
                *name_type = map.sid_name_use;
        } else {
+               if (pdb_rid_is_user(rid))
+                       return False;
+
                *pgid = pdb_group_rid_to_gid(rid);
                *name_type = SID_NAME_ALIAS;
        }

diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index c83f6b3d8db57f1becdecf189fbd84c209ed0599..106d7c19234486c76520db7f0e1fa6af3ec8fe18 100644 (file)
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -1443,11 +1443,6 @@ static BOOL get_user_info_10(SAM_USER_INFO_10 *id10, uint32 user_rid)
        SAM_ACCOUNT *smbpass=NULL;
        BOOL ret;
 
-       if (!pdb_rid_is_user(user_rid)) {
-               DEBUG(4,("RID 0x%x is not a user RID\n", user_rid));
-               return False;
-       }
-
        pdb_init_sam(&smbpass);
 
        become_root();
@@ -1524,11 +1519,6 @@ static BOOL get_user_info_20(SAM_USER_INFO_20 *id20, uint32 user_rid)
        SAM_ACCOUNT *sampass=NULL;
        BOOL ret;
 
-       if (!pdb_rid_is_user(user_rid)) {
-               DEBUG(4,("RID 0x%x is not a user RID\n", user_rid));
-               return False;
-       }
-
        pdb_init_sam(&sampass);
 
        become_root();
@@ -1562,11 +1552,6 @@ static BOOL get_user_info_21(SAM_USER_INFO_21 *id21, uint32 user_rid)
        SAM_ACCOUNT *sampass=NULL;
        BOOL ret;
 
-       if (!pdb_rid_is_user(user_rid)) {
-               DEBUG(4,("RID 0x%x is not a user RID\n", user_rid));
-               return False;
-       }
-
        pdb_init_sam(&sampass);
 
        become_root();

diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c
index 864d3d6c666a09f8f546649cc59a9536835c04da..ac0b535c13d1f8355994fe6a984b8f2c59123fb1 100644 (file)
--- a/source3/smbd/uid.c
+++ b/source3/smbd/uid.c
@@ -546,9 +546,12 @@ DOM_SID *uid_to_sid(DOM_SID *psid, uid_t uid)
                        return psid;
                }
        }
+       
+       /* Make sure we report failure, (when psid == NULL) */
+       become_root();
+       psid = local_uid_to_sid(psid, uid);
+        unbecome_root();
 
-       local_uid_to_sid(psid, uid);
-        
        DEBUG(10,("uid_to_sid: local %u -> %s\n", (unsigned int)uid, sid_to_string(sid, psid)));
 
        return psid;
@@ -611,10 +614,14 @@ BOOL sid_to_uid(DOM_SID *psid, uid_t *puid, enum SID_NAME_USE *sidtype)
         */
 
        if ( (!winbind_lookup_sid(psid, dom_name, name, &name_type)) || (name_type != SID_NAME_USER) ) {
+               BOOL result;
                DEBUG(10,("sid_to_uid: winbind lookup for sid %s failed - trying local.\n",
                                sid_to_string(sid_str, psid) ));
 
-               return local_sid_to_uid(puid, psid, sidtype);
+               become_root();
+               result = local_sid_to_uid(puid, psid, sidtype);
+               unbecome_root();
+               return result;
        }
 
        /*
@@ -634,9 +641,13 @@ BOOL sid_to_uid(DOM_SID *psid, uid_t *puid, enum SID_NAME_USE *sidtype)
         */
 
        if (!winbind_sid_to_uid(puid, psid)) {
+               BOOL result;
                DEBUG(10,("sid_to_uid: winbind lookup for sid %s failed.\n",
                                sid_to_string(sid_str, psid) ));
-               return local_sid_to_uid(puid, psid, sidtype);
+               become_root();
+               result = local_sid_to_uid(puid, psid, sidtype);
+               unbecome_root();
+               return result;
        }
 
        DEBUG(10,("sid_to_uid: winbindd %s -> %u\n",
@@ -667,7 +678,6 @@ BOOL sid_to_gid(DOM_SID *psid, gid_t *pgid, enum SID_NAME_USE *sidtype)
        if (!winbind_lookup_sid(psid, dom_name, name, &name_type)) {
                DEBUG(10,("sid_to_gid: winbind lookup for sid %s failed - trying local.\n",
                                sid_to_string(sid_str, psid) ));
-
                if (!local_sid_to_gid(pgid, psid, sidtype)) {
                        /* this was probably a foreign sid - assume its a group rid 
                           and continue */