source3/smbd/uid.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    uid/user handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/passwd.h"
  22 #include "smbd/smbd.h"
  23 #include "smbd/globals.h"
  24 #include "../librpc/gen_ndr/netlogon.h"
  25 #include "libcli/security/security.h"
  26 #include "passdb/lookup_sid.h"
  27 #include "auth.h"
  28
  29 /* what user is current? */
  30 extern struct current_user current_user;
  31
  32 /****************************************************************************
  33  Become the guest user without changing the security context stack.
  34 ****************************************************************************/
  35
  36 bool change_to_guest(void)
  37 {
  38         struct passwd *pass;
  39
  40         pass = Get_Pwnam_alloc(talloc_tos(), lp_guestaccount());
  41         if (!pass) {
  42                 return false;
  43         }
  44
  45 #ifdef AIX
  46         /* MWW: From AIX FAQ patch to WU-ftpd: call initgroups before
  47            setting IDs */
  48         initgroups(pass->pw_name, pass->pw_gid);
  49 #endif
  50
  51         set_sec_ctx(pass->pw_uid, pass->pw_gid, 0, NULL, NULL);
  52
  53         current_user.conn = NULL;
  54         current_user.vuid = UID_FIELD_INVALID;
  55
  56         TALLOC_FREE(pass);
  57
  58         return true;
  59 }
  60
  61 /****************************************************************************
  62  talloc free the conn->session_info if not used in the vuid cache.
  63 ****************************************************************************/
  64
  65 static void free_conn_session_info_if_unused(connection_struct *conn)
  66 {
  67         unsigned int i;
  68
  69         for (i = 0; i < VUID_CACHE_SIZE; i++) {
  70                 struct vuid_cache_entry *ent;
  71                 ent = &conn->vuid_cache.array[i];
  72                 if (ent->vuid != UID_FIELD_INVALID &&
  73                                 conn->session_info == ent->session_info) {
  74                         return;
  75                 }
  76         }
  77         /* Not used, safe to free. */
  78         TALLOC_FREE(conn->session_info);
  79 }
  80
  81 /*******************************************************************
  82  Check if a username is OK.
  83
  84  This sets up conn->session_info with a copy related to this vuser that
  85  later code can then mess with.
  86 ********************************************************************/
  87
  88 static bool check_user_ok(connection_struct *conn,
  89                         uint64_t vuid,
  90                         const struct auth_session_info *session_info,
  91                         int snum)
  92 {
  93         bool valid_vuid = (vuid != UID_FIELD_INVALID);
  94         unsigned int i;
  95         bool readonly_share;
  96         bool admin_user;
  97
  98         if (valid_vuid) {
  99                 struct vuid_cache_entry *ent;
 100
 101                 for (i=0; i<VUID_CACHE_SIZE; i++) {
 102                         ent = &conn->vuid_cache.array[i];
 103                         if (ent->vuid == vuid) {
 104                                 free_conn_session_info_if_unused(conn);
 105                                 conn->session_info = ent->session_info;
 106                                 conn->read_only = ent->read_only;
 107                                 return(True);
 108                         }
 109                 }
 110         }
 111
 112         if (!user_ok_token(session_info->unix_info->unix_name,
 113                            session_info->info->domain_name,
 114                            session_info->security_token, snum))
 115                 return(False);
 116
 117         readonly_share = is_share_read_only_for_token(
 118                 session_info->unix_info->unix_name,
 119                 session_info->info->domain_name,
 120                 session_info->security_token,
 121                 conn);
 122
 123         if (!readonly_share &&
 124             !share_access_check(session_info->security_token,
 125                                 lp_servicename(talloc_tos(), snum),
 126                                 FILE_WRITE_DATA,
 127                                 NULL)) {
 128                 /* smb.conf allows r/w, but the security descriptor denies
 129                  * write. Fall back to looking at readonly. */
 130                 readonly_share = True;
 131                 DEBUG(5,("falling back to read-only access-evaluation due to "
 132                          "security descriptor\n"));
 133         }
 134
 135         if (!share_access_check(session_info->security_token,
 136                                 lp_servicename(talloc_tos(), snum),
 137                                 readonly_share ?
 138                                 FILE_READ_DATA : FILE_WRITE_DATA,
 139                                 NULL)) {
 140                 return False;
 141         }
 142
 143         admin_user = token_contains_name_in_list(
 144                 session_info->unix_info->unix_name,
 145                 session_info->info->domain_name,
 146                 NULL, session_info->security_token, lp_admin_users(snum));
 147
 148         if (valid_vuid) {
 149                 struct vuid_cache_entry *ent =
 150                         &conn->vuid_cache.array[conn->vuid_cache.next_entry];
 151
 152                 conn->vuid_cache.next_entry =
 153                         (conn->vuid_cache.next_entry + 1) % VUID_CACHE_SIZE;
 154
 155                 TALLOC_FREE(ent->session_info);
 156
 157                 /*
 158                  * If force_user was set, all session_info's are based on the same
 159                  * username-based faked one.
 160                  */
 161
 162                 ent->session_info = copy_session_info(
 163                         conn, conn->force_user ? conn->session_info : session_info);
 164
 165                 if (ent->session_info == NULL) {
 166                         ent->vuid = UID_FIELD_INVALID;
 167                         return false;
 168                 }
 169
 170                 ent->vuid = vuid;
 171                 ent->read_only = readonly_share;
 172                 free_conn_session_info_if_unused(conn);
 173                 conn->session_info = ent->session_info;
 174         }
 175
 176         conn->read_only = readonly_share;
 177         if (admin_user) {
 178                 DEBUG(2,("check_user_ok: user %s is an admin user. "
 179                         "Setting uid as %d\n",
 180                         conn->session_info->unix_info->unix_name,
 181                         sec_initial_uid() ));
 182                 conn->session_info->unix_token->uid = sec_initial_uid();
 183         }
 184
 185         return(True);
 186 }
 187
 188 /****************************************************************************
 189  Become the user of a connection number without changing the security context
 190  stack, but modify the current_user entries.
 191 ****************************************************************************/
 192
 193 static bool change_to_user_internal(connection_struct *conn,
 194                                     const struct auth_session_info *session_info,
 195                                     uint64_t vuid)
 196 {
 197         int snum;
 198         gid_t gid;
 199         uid_t uid;
 200         char group_c;
 201         int num_groups = 0;
 202         gid_t *group_list = NULL;
 203         bool ok;
 204
 205         snum = SNUM(conn);
 206
 207         ok = check_user_ok(conn, vuid, session_info, snum);
 208         if (!ok) {
 209                 DEBUG(2,("SMB user %s (unix user %s) "
 210                          "not permitted access to share %s.\n",
 211                          session_info->unix_info->sanitized_username,
 212                          session_info->unix_info->unix_name,
 213                          lp_servicename(talloc_tos(), snum)));
 214                 return false;
 215         }
 216
 217         uid = conn->session_info->unix_token->uid;
 218         gid = conn->session_info->unix_token->gid;
 219         num_groups = conn->session_info->unix_token->ngroups;
 220         group_list  = conn->session_info->unix_token->groups;
 221
 222         /*
 223          * See if we should force group for this service. If so this overrides
 224          * any group set in the force user code.
 225          */
 226         if((group_c = *lp_force_group(talloc_tos(), snum))) {
 227
 228                 SMB_ASSERT(conn->force_group_gid != (gid_t)-1);
 229
 230                 if (group_c == '+') {
 231                         int i;
 232
 233                         /*
 234                          * Only force group if the user is a member of the
 235                          * service group. Check the group memberships for this
 236                          * user (we already have this) to see if we should force
 237                          * the group.
 238                          */
 239                         for (i = 0; i < num_groups; i++) {
 240                                 if (group_list[i] == conn->force_group_gid) {
 241                                         conn->session_info->unix_token->gid =
 242                                                 conn->force_group_gid;
 243                                         gid = conn->force_group_gid;
 244                                         gid_to_sid(&conn->session_info->security_token
 245                                                    ->sids[1], gid);
 246                                         break;
 247                                 }
 248                         }
 249                 } else {
 250                         conn->session_info->unix_token->gid = conn->force_group_gid;
 251                         gid = conn->force_group_gid;
 252                         gid_to_sid(&conn->session_info->security_token->sids[1],
 253                                    gid);
 254                 }
 255         }
 256
 257         /*Set current_user since we will immediately also call set_sec_ctx() */
 258         current_user.ut.ngroups = num_groups;
 259         current_user.ut.groups  = group_list;
 260
 261         set_sec_ctx(uid,
 262                     gid,
 263                     current_user.ut.ngroups,
 264                     current_user.ut.groups,
 265                     conn->session_info->security_token);
 266
 267         current_user.conn = conn;
 268         current_user.vuid = vuid;
 269
 270         DEBUG(5, ("Impersonated user: uid=(%d,%d), gid=(%d,%d)\n",
 271                  (int)getuid(),
 272                  (int)geteuid(),
 273                  (int)getgid(),
 274                  (int)getegid()));
 275
 276         return true;
 277 }
 278
 279 bool change_to_user(connection_struct *conn, uint64_t vuid)
 280 {
 281         const struct auth_session_info *session_info = NULL;
 282         struct user_struct *vuser;
 283         int snum = SNUM(conn);
 284
 285         if (!conn) {
 286                 DEBUG(2,("Connection not open\n"));
 287                 return(False);
 288         }
 289
 290         vuser = get_valid_user_struct(conn->sconn, vuid);
 291
 292         if ((current_user.conn == conn) &&
 293                    (vuser != NULL) && (current_user.vuid == vuid) &&
 294                    (current_user.ut.uid == vuser->session_info->unix_token->uid)) {
 295                 DEBUG(4,("Skipping user change - already "
 296                          "user\n"));
 297                 return(True);
 298         }
 299
 300         if (vuser == NULL) {
 301                 /* Invalid vuid sent */
 302                 DEBUG(2,("Invalid vuid %llu used on share %s.\n",
 303                          (unsigned long long)vuid, lp_servicename(talloc_tos(),
 304                                                                   snum)));
 305                 return false;
 306         }
 307
 308         session_info = vuser->session_info;
 309
 310         if (!conn->force_user && vuser == NULL) {
 311                 DEBUG(2,("Invalid vuid used %llu in accessing share %s.\n",
 312                          (unsigned long long)vuid,
 313                          lp_servicename(talloc_tos(), snum)));
 314                 return False;
 315         }
 316
 317         return change_to_user_internal(conn, session_info, vuid);
 318 }
 319
 320 static bool change_to_user_by_session(connection_struct *conn,
 321                                       const struct auth_session_info *session_info)
 322 {
 323         SMB_ASSERT(conn != NULL);
 324         SMB_ASSERT(session_info != NULL);
 325
 326         if ((current_user.conn == conn) &&
 327             (current_user.ut.uid == session_info->unix_token->uid)) {
 328                 DEBUG(7, ("Skipping user change - already user\n"));
 329
 330                 return true;
 331         }
 332
 333         return change_to_user_internal(conn, session_info, UID_FIELD_INVALID);
 334 }
 335
 336 /****************************************************************************
 337  Go back to being root without changing the security context stack,
 338  but modify the current_user entries.
 339 ****************************************************************************/
 340
 341 bool smbd_change_to_root_user(void)
 342 {
 343         set_root_sec_ctx();
 344
 345         DEBUG(5,("change_to_root_user: now uid=(%d,%d) gid=(%d,%d)\n",
 346                 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
 347
 348         current_user.conn = NULL;
 349         current_user.vuid = UID_FIELD_INVALID;
 350
 351         return(True);
 352 }
 353
 354 /****************************************************************************
 355  Become the user of an authenticated connected named pipe.
 356  When this is called we are currently running as the connection
 357  user. Doesn't modify current_user.
 358 ****************************************************************************/
 359
 360 bool become_authenticated_pipe_user(struct auth_session_info *session_info)
 361 {
 362         if (!push_sec_ctx())
 363                 return False;
 364
 365         set_sec_ctx(session_info->unix_token->uid, session_info->unix_token->gid,
 366                     session_info->unix_token->ngroups, session_info->unix_token->groups,
 367                     session_info->security_token);
 368
 369         return True;
 370 }
 371
 372 /****************************************************************************
 373  Unbecome the user of an authenticated connected named pipe.
 374  When this is called we are running as the authenticated pipe
 375  user and need to go back to being the connection user. Doesn't modify
 376  current_user.
 377 ****************************************************************************/
 378
 379 bool unbecome_authenticated_pipe_user(void)
 380 {
 381         return pop_sec_ctx();
 382 }
 383
 384 /****************************************************************************
 385  Utility functions used by become_xxx/unbecome_xxx.
 386 ****************************************************************************/
 387
 388 static void push_conn_ctx(void)
 389 {
 390         struct conn_ctx *ctx_p;
 391
 392         /* Check we don't overflow our stack */
 393
 394         if (conn_ctx_stack_ndx == MAX_SEC_CTX_DEPTH) {
 395                 DEBUG(0, ("Connection context stack overflow!\n"));
 396                 smb_panic("Connection context stack overflow!\n");
 397         }
 398
 399         /* Store previous user context */
 400         ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 401
 402         ctx_p->conn = current_user.conn;
 403         ctx_p->vuid = current_user.vuid;
 404
 405         DEBUG(4, ("push_conn_ctx(%llu) : conn_ctx_stack_ndx = %d\n",
 406                 (unsigned long long)ctx_p->vuid, conn_ctx_stack_ndx));
 407
 408         conn_ctx_stack_ndx++;
 409 }
 410
 411 static void pop_conn_ctx(void)
 412 {
 413         struct conn_ctx *ctx_p;
 414
 415         /* Check for stack underflow. */
 416
 417         if (conn_ctx_stack_ndx == 0) {
 418                 DEBUG(0, ("Connection context stack underflow!\n"));
 419                 smb_panic("Connection context stack underflow!\n");
 420         }
 421
 422         conn_ctx_stack_ndx--;
 423         ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 424
 425         current_user.conn = ctx_p->conn;
 426         current_user.vuid = ctx_p->vuid;
 427
 428         ctx_p->conn = NULL;
 429         ctx_p->vuid = UID_FIELD_INVALID;
 430 }
 431
 432 /****************************************************************************
 433  Temporarily become a root user.  Must match with unbecome_root(). Saves and
 434  restores the connection context.
 435 ****************************************************************************/
 436
 437 void smbd_become_root(void)
 438 {
 439          /*
 440           * no good way to handle push_sec_ctx() failing without changing
 441           * the prototype of become_root()
 442           */
 443         if (!push_sec_ctx()) {
 444                 smb_panic("become_root: push_sec_ctx failed");
 445         }
 446         push_conn_ctx();
 447         set_root_sec_ctx();
 448 }
 449
 450 /* Unbecome the root user */
 451
 452 void smbd_unbecome_root(void)
 453 {
 454         pop_sec_ctx();
 455         pop_conn_ctx();
 456 }
 457
 458 /****************************************************************************
 459  Push the current security context then force a change via change_to_user().
 460  Saves and restores the connection context.
 461 ****************************************************************************/
 462
 463 bool become_user(connection_struct *conn, uint64_t vuid)
 464 {
 465         if (!push_sec_ctx())
 466                 return False;
 467
 468         push_conn_ctx();
 469
 470         if (!change_to_user(conn, vuid)) {
 471                 pop_sec_ctx();
 472                 pop_conn_ctx();
 473                 return False;
 474         }
 475
 476         return True;
 477 }
 478
 479 bool become_user_by_session(connection_struct *conn,
 480                             const struct auth_session_info *session_info)
 481 {
 482         if (!push_sec_ctx())
 483                 return false;
 484
 485         push_conn_ctx();
 486
 487         if (!change_to_user_by_session(conn, session_info)) {
 488                 pop_sec_ctx();
 489                 pop_conn_ctx();
 490                 return false;
 491         }
 492
 493         return true;
 494 }
 495
 496 bool unbecome_user(void)
 497 {
 498         pop_sec_ctx();
 499         pop_conn_ctx();
 500         return True;
 501 }
 502
 503 /****************************************************************************
 504  Return the current user we are running effectively as on this connection.
 505  I'd like to make this return conn->session_info->unix_token->uid, but become_root()
 506  doesn't alter this value.
 507 ****************************************************************************/
 508
 509 uid_t get_current_uid(connection_struct *conn)
 510 {
 511         return current_user.ut.uid;
 512 }
 513
 514 /****************************************************************************
 515  Return the current group we are running effectively as on this connection.
 516  I'd like to make this return conn->session_info->unix_token->gid, but become_root()
 517  doesn't alter this value.
 518 ****************************************************************************/
 519
 520 gid_t get_current_gid(connection_struct *conn)
 521 {
 522         return current_user.ut.gid;
 523 }
 524
 525 /****************************************************************************
 526  Return the UNIX token we are running effectively as on this connection.
 527  I'd like to make this return &conn->session_info->unix_token-> but become_root()
 528  doesn't alter this value.
 529 ****************************************************************************/
 530
 531 const struct security_unix_token *get_current_utok(connection_struct *conn)
 532 {
 533         return &current_user.ut;
 534 }
 535
 536 /****************************************************************************
 537  Return the Windows token we are running effectively as on this connection.
 538  If this is currently a NULL token as we're inside become_root() - a temporary
 539  UNIX security override, then we search up the stack for the previous active
 540  token.
 541 ****************************************************************************/
 542
 543 const struct security_token *get_current_nttok(connection_struct *conn)
 544 {
 545         if (current_user.nt_user_token) {
 546                 return current_user.nt_user_token;
 547         }
 548         return sec_ctx_active_token();
 549 }
 550
 551 uint64_t get_current_vuid(connection_struct *conn)
 552 {
 553         return current_user.vuid;
 554 }