source3/smbd/uid.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    uid/user handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/passwd.h"
  22 #include "smbd/smbd.h"
  23 #include "smbd/globals.h"
  24 #include "../librpc/gen_ndr/netlogon.h"
  25 #include "libcli/security/security.h"
  26 #include "passdb/lookup_sid.h"
  27 #include "auth.h"
  28
  29 /* what user is current? */
  30 extern struct current_user current_user;
  31
  32 /****************************************************************************
  33  Become the guest user without changing the security context stack.
  34 ****************************************************************************/
  35
  36 bool change_to_guest(void)
  37 {
  38         struct passwd *pass;
  39
  40         pass = Get_Pwnam_alloc(talloc_tos(), lp_guest_account());
  41         if (!pass) {
  42                 return false;
  43         }
  44
  45 #ifdef AIX
  46         /* MWW: From AIX FAQ patch to WU-ftpd: call initgroups before
  47            setting IDs */
  48         initgroups(pass->pw_name, pass->pw_gid);
  49 #endif
  50
  51         set_sec_ctx(pass->pw_uid, pass->pw_gid, 0, NULL, NULL);
  52
  53         current_user.conn = NULL;
  54         current_user.vuid = UID_FIELD_INVALID;
  55
  56         TALLOC_FREE(pass);
  57
  58         return true;
  59 }
  60
  61 /****************************************************************************
  62  talloc free the conn->session_info if not used in the vuid cache.
  63 ****************************************************************************/
  64
  65 static void free_conn_session_info_if_unused(connection_struct *conn)
  66 {
  67         unsigned int i;
  68
  69         for (i = 0; i < VUID_CACHE_SIZE; i++) {
  70                 struct vuid_cache_entry *ent;
  71                 ent = &conn->vuid_cache->array[i];
  72                 if (ent->vuid != UID_FIELD_INVALID &&
  73                                 conn->session_info == ent->session_info) {
  74                         return;
  75                 }
  76         }
  77         /* Not used, safe to free. */
  78         TALLOC_FREE(conn->session_info);
  79 }
  80
  81 /****************************************************************************
  82   Setup the share access mask for a connection.
  83 ****************************************************************************/
  84
  85 static uint32_t create_share_access_mask(int snum,
  86                                 bool readonly_share,
  87                                 const struct security_token *token)
  88 {
  89         uint32_t share_access = 0;
  90
  91         share_access_check(token,
  92                         lp_servicename(talloc_tos(), snum),
  93                         MAXIMUM_ALLOWED_ACCESS,
  94                         &share_access);
  95
  96         if (readonly_share) {
  97                 share_access &=
  98                         ~(SEC_FILE_WRITE_DATA | SEC_FILE_APPEND_DATA |
  99                           SEC_FILE_WRITE_EA | SEC_FILE_WRITE_ATTRIBUTE |
 100                           SEC_DIR_DELETE_CHILD );
 101         }
 102
 103         if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
 104                 share_access |= SEC_FLAG_SYSTEM_SECURITY;
 105         }
 106         if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
 107                 share_access |= SEC_RIGHTS_PRIV_RESTORE;
 108         }
 109         if (security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
 110                 share_access |= SEC_RIGHTS_PRIV_BACKUP;
 111         }
 112         if (security_token_has_privilege(token, SEC_PRIV_TAKE_OWNERSHIP)) {
 113                 share_access |= SEC_STD_WRITE_OWNER;
 114         }
 115
 116         return share_access;
 117 }
 118
 119 /*******************************************************************
 120  Calculate access mask and if this user can access this share.
 121 ********************************************************************/
 122
 123 NTSTATUS check_user_share_access(connection_struct *conn,
 124                                 const struct auth_session_info *session_info,
 125                                 uint32_t *p_share_access,
 126                                 bool *p_readonly_share)
 127 {
 128         int snum = SNUM(conn);
 129         uint32_t share_access = 0;
 130         bool readonly_share = false;
 131
 132         if (!user_ok_token(session_info->unix_info->unix_name,
 133                            session_info->info->domain_name,
 134                            session_info->security_token, snum)) {
 135                 return NT_STATUS_ACCESS_DENIED;
 136         }
 137
 138         readonly_share = is_share_read_only_for_token(
 139                 session_info->unix_info->unix_name,
 140                 session_info->info->domain_name,
 141                 session_info->security_token,
 142                 conn);
 143
 144         share_access = create_share_access_mask(snum,
 145                                         readonly_share,
 146                                         session_info->security_token);
 147
 148         if ((share_access & (FILE_READ_DATA|FILE_WRITE_DATA)) == 0) {
 149                 /* No access, read or write. */
 150                 DEBUG(3,("user %s connection to %s denied due to share "
 151                          "security descriptor.\n",
 152                          session_info->unix_info->unix_name,
 153                          lp_servicename(talloc_tos(), snum)));
 154                 return NT_STATUS_ACCESS_DENIED;
 155         }
 156
 157         if (!readonly_share &&
 158             !(share_access & FILE_WRITE_DATA)) {
 159                 /* smb.conf allows r/w, but the security descriptor denies
 160                  * write. Fall back to looking at readonly. */
 161                 readonly_share = True;
 162                 DEBUG(5,("falling back to read-only access-evaluation due to "
 163                          "security descriptor\n"));
 164         }
 165
 166         *p_share_access = share_access;
 167         *p_readonly_share = readonly_share;
 168
 169         return NT_STATUS_OK;
 170 }
 171
 172 /*******************************************************************
 173  Check if a username is OK.
 174
 175  This sets up conn->session_info with a copy related to this vuser that
 176  later code can then mess with.
 177 ********************************************************************/
 178
 179 static bool check_user_ok(connection_struct *conn,
 180                         uint64_t vuid,
 181                         const struct auth_session_info *session_info,
 182                         int snum)
 183 {
 184         unsigned int i;
 185         bool readonly_share = false;
 186         bool admin_user = false;
 187         struct vuid_cache_entry *ent = NULL;
 188         uint32_t share_access = 0;
 189         NTSTATUS status;
 190
 191         for (i=0; i<VUID_CACHE_SIZE; i++) {
 192                 ent = &conn->vuid_cache->array[i];
 193                 if (ent->vuid == vuid) {
 194                         if (vuid == UID_FIELD_INVALID) {
 195                                 /*
 196                                  * Slow path, we don't care
 197                                  * about the array traversal.
 198                                 */
 199                                 continue;
 200                         }
 201                         free_conn_session_info_if_unused(conn);
 202                         conn->session_info = ent->session_info;
 203                         conn->read_only = ent->read_only;
 204                         conn->share_access = ent->share_access;
 205                         conn->vuid = ent->vuid;
 206                         return(True);
 207                 }
 208         }
 209
 210         status = check_user_share_access(conn,
 211                                         session_info,
 212                                         &share_access,
 213                                         &readonly_share);
 214         if (!NT_STATUS_IS_OK(status)) {
 215                 return false;
 216         }
 217
 218         admin_user = token_contains_name_in_list(
 219                 session_info->unix_info->unix_name,
 220                 session_info->info->domain_name,
 221                 NULL, session_info->security_token, lp_admin_users(snum));
 222
 223         ent = &conn->vuid_cache->array[conn->vuid_cache->next_entry];
 224
 225         conn->vuid_cache->next_entry =
 226                 (conn->vuid_cache->next_entry + 1) % VUID_CACHE_SIZE;
 227
 228         TALLOC_FREE(ent->session_info);
 229
 230         /*
 231          * If force_user was set, all session_info's are based on the same
 232          * username-based faked one.
 233          */
 234
 235         ent->session_info = copy_session_info(
 236                 conn, conn->force_user ? conn->session_info : session_info);
 237
 238         if (ent->session_info == NULL) {
 239                 ent->vuid = UID_FIELD_INVALID;
 240                 return false;
 241         }
 242
 243         if (admin_user) {
 244                 DEBUG(2,("check_user_ok: user %s is an admin user. "
 245                         "Setting uid as %d\n",
 246                         ent->session_info->unix_info->unix_name,
 247                         sec_initial_uid() ));
 248                 ent->session_info->unix_token->uid = sec_initial_uid();
 249         }
 250
 251         /*
 252          * It's actually OK to call check_user_ok() with
 253          * vuid == UID_FIELD_INVALID as called from change_to_user_by_session().
 254          * All this will do is throw away one entry in the cache.
 255          */
 256
 257         ent->vuid = vuid;
 258         ent->read_only = readonly_share;
 259         ent->share_access = share_access;
 260         free_conn_session_info_if_unused(conn);
 261         conn->session_info = ent->session_info;
 262         conn->vuid = ent->vuid;
 263         if (vuid == UID_FIELD_INVALID) {
 264                 /*
 265                  * Not strictly needed, just make it really
 266                  * clear this entry is actually an unused one.
 267                  */
 268                 ent->read_only = false;
 269                 ent->share_access = 0;
 270                 ent->session_info = NULL;
 271         }
 272
 273         conn->read_only = readonly_share;
 274         conn->share_access = share_access;
 275
 276         return(True);
 277 }
 278
 279 /****************************************************************************
 280  Become the user of a connection number without changing the security context
 281  stack, but modify the current_user entries.
 282 ****************************************************************************/
 283
 284 static bool change_to_user_internal(connection_struct *conn,
 285                                     const struct auth_session_info *session_info,
 286                                     uint64_t vuid)
 287 {
 288         int snum;
 289         gid_t gid;
 290         uid_t uid;
 291         char group_c;
 292         int num_groups = 0;
 293         gid_t *group_list = NULL;
 294         bool ok;
 295
 296         if ((current_user.conn == conn) &&
 297             (current_user.vuid == vuid) &&
 298             (current_user.ut.uid == session_info->unix_token->uid))
 299         {
 300                 DBG_INFO("Skipping user change - already user\n");
 301                 return true;
 302         }
 303
 304         set_current_user_info(session_info->unix_info->sanitized_username,
 305                               session_info->unix_info->unix_name,
 306                               session_info->info->domain_name);
 307
 308         snum = SNUM(conn);
 309
 310         ok = check_user_ok(conn, vuid, session_info, snum);
 311         if (!ok) {
 312                 DEBUG(2,("SMB user %s (unix user %s) "
 313                          "not permitted access to share %s.\n",
 314                          session_info->unix_info->sanitized_username,
 315                          session_info->unix_info->unix_name,
 316                          lp_servicename(talloc_tos(), snum)));
 317                 return false;
 318         }
 319
 320         uid = conn->session_info->unix_token->uid;
 321         gid = conn->session_info->unix_token->gid;
 322         num_groups = conn->session_info->unix_token->ngroups;
 323         group_list  = conn->session_info->unix_token->groups;
 324
 325         /*
 326          * See if we should force group for this service. If so this overrides
 327          * any group set in the force user code.
 328          */
 329         if((group_c = *lp_force_group(talloc_tos(), snum))) {
 330
 331                 SMB_ASSERT(conn->force_group_gid != (gid_t)-1);
 332
 333                 if (group_c == '+') {
 334                         int i;
 335
 336                         /*
 337                          * Only force group if the user is a member of the
 338                          * service group. Check the group memberships for this
 339                          * user (we already have this) to see if we should force
 340                          * the group.
 341                          */
 342                         for (i = 0; i < num_groups; i++) {
 343                                 if (group_list[i] == conn->force_group_gid) {
 344                                         conn->session_info->unix_token->gid =
 345                                                 conn->force_group_gid;
 346                                         gid = conn->force_group_gid;
 347                                         gid_to_sid(&conn->session_info->security_token
 348                                                    ->sids[1], gid);
 349                                         break;
 350                                 }
 351                         }
 352                 } else {
 353                         conn->session_info->unix_token->gid = conn->force_group_gid;
 354                         gid = conn->force_group_gid;
 355                         gid_to_sid(&conn->session_info->security_token->sids[1],
 356                                    gid);
 357                 }
 358         }
 359
 360         /*Set current_user since we will immediately also call set_sec_ctx() */
 361         current_user.ut.ngroups = num_groups;
 362         current_user.ut.groups  = group_list;
 363
 364         set_sec_ctx(uid,
 365                     gid,
 366                     current_user.ut.ngroups,
 367                     current_user.ut.groups,
 368                     conn->session_info->security_token);
 369
 370         current_user.conn = conn;
 371         current_user.vuid = vuid;
 372
 373         DEBUG(5, ("Impersonated user: uid=(%d,%d), gid=(%d,%d)\n",
 374                  (int)getuid(),
 375                  (int)geteuid(),
 376                  (int)getgid(),
 377                  (int)getegid()));
 378
 379         return true;
 380 }
 381
 382 bool change_to_user(connection_struct *conn, uint64_t vuid)
 383 {
 384         struct user_struct *vuser;
 385         int snum = SNUM(conn);
 386
 387         if (!conn) {
 388                 DEBUG(2,("Connection not open\n"));
 389                 return(False);
 390         }
 391
 392         vuser = get_valid_user_struct(conn->sconn, vuid);
 393         if (vuser == NULL) {
 394                 /* Invalid vuid sent */
 395                 DEBUG(2,("Invalid vuid %llu used on share %s.\n",
 396                          (unsigned long long)vuid, lp_servicename(talloc_tos(),
 397                                                                   snum)));
 398                 return false;
 399         }
 400
 401         return change_to_user_internal(conn, vuser->session_info, vuid);
 402 }
 403
 404 static bool change_to_user_by_session(connection_struct *conn,
 405                                       const struct auth_session_info *session_info)
 406 {
 407         SMB_ASSERT(conn != NULL);
 408         SMB_ASSERT(session_info != NULL);
 409
 410         return change_to_user_internal(conn, session_info, UID_FIELD_INVALID);
 411 }
 412
 413 /****************************************************************************
 414  Go back to being root without changing the security context stack,
 415  but modify the current_user entries.
 416 ****************************************************************************/
 417
 418 bool smbd_change_to_root_user(void)
 419 {
 420         set_root_sec_ctx();
 421
 422         DEBUG(5,("change_to_root_user: now uid=(%d,%d) gid=(%d,%d)\n",
 423                 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
 424
 425         current_user.conn = NULL;
 426         current_user.vuid = UID_FIELD_INVALID;
 427
 428         return(True);
 429 }
 430
 431 /****************************************************************************
 432  Become the user of an authenticated connected named pipe.
 433  When this is called we are currently running as the connection
 434  user. Doesn't modify current_user.
 435 ****************************************************************************/
 436
 437 bool smbd_become_authenticated_pipe_user(struct auth_session_info *session_info)
 438 {
 439         if (!push_sec_ctx())
 440                 return False;
 441
 442         set_sec_ctx(session_info->unix_token->uid, session_info->unix_token->gid,
 443                     session_info->unix_token->ngroups, session_info->unix_token->groups,
 444                     session_info->security_token);
 445
 446         DEBUG(5, ("Impersonated user: uid=(%d,%d), gid=(%d,%d)\n",
 447                  (int)getuid(),
 448                  (int)geteuid(),
 449                  (int)getgid(),
 450                  (int)getegid()));
 451
 452         return True;
 453 }
 454
 455 /****************************************************************************
 456  Unbecome the user of an authenticated connected named pipe.
 457  When this is called we are running as the authenticated pipe
 458  user and need to go back to being the connection user. Doesn't modify
 459  current_user.
 460 ****************************************************************************/
 461
 462 bool smbd_unbecome_authenticated_pipe_user(void)
 463 {
 464         return pop_sec_ctx();
 465 }
 466
 467 /****************************************************************************
 468  Utility functions used by become_xxx/unbecome_xxx.
 469 ****************************************************************************/
 470
 471 static void push_conn_ctx(void)
 472 {
 473         struct conn_ctx *ctx_p;
 474         extern userdom_struct current_user_info;
 475
 476         /* Check we don't overflow our stack */
 477
 478         if (conn_ctx_stack_ndx == MAX_SEC_CTX_DEPTH) {
 479                 DEBUG(0, ("Connection context stack overflow!\n"));
 480                 smb_panic("Connection context stack overflow!\n");
 481         }
 482
 483         /* Store previous user context */
 484         ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 485
 486         ctx_p->conn = current_user.conn;
 487         ctx_p->vuid = current_user.vuid;
 488         ctx_p->user_info = current_user_info;
 489
 490         DEBUG(4, ("push_conn_ctx(%llu) : conn_ctx_stack_ndx = %d\n",
 491                 (unsigned long long)ctx_p->vuid, conn_ctx_stack_ndx));
 492
 493         conn_ctx_stack_ndx++;
 494 }
 495
 496 static void pop_conn_ctx(void)
 497 {
 498         struct conn_ctx *ctx_p;
 499
 500         /* Check for stack underflow. */
 501
 502         if (conn_ctx_stack_ndx == 0) {
 503                 DEBUG(0, ("Connection context stack underflow!\n"));
 504                 smb_panic("Connection context stack underflow!\n");
 505         }
 506
 507         conn_ctx_stack_ndx--;
 508         ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 509
 510         set_current_user_info(ctx_p->user_info.smb_name,
 511                               ctx_p->user_info.unix_name,
 512                               ctx_p->user_info.domain);
 513         current_user.conn = ctx_p->conn;
 514         current_user.vuid = ctx_p->vuid;
 515
 516         ctx_p->conn = NULL;
 517         ctx_p->vuid = UID_FIELD_INVALID;
 518 }
 519
 520 /****************************************************************************
 521  Temporarily become a root user.  Must match with unbecome_root(). Saves and
 522  restores the connection context.
 523 ****************************************************************************/
 524
 525 void smbd_become_root(void)
 526 {
 527          /*
 528           * no good way to handle push_sec_ctx() failing without changing
 529           * the prototype of become_root()
 530           */
 531         if (!push_sec_ctx()) {
 532                 smb_panic("become_root: push_sec_ctx failed");
 533         }
 534         push_conn_ctx();
 535         set_root_sec_ctx();
 536 }
 537
 538 /* Unbecome the root user */
 539
 540 void smbd_unbecome_root(void)
 541 {
 542         pop_sec_ctx();
 543         pop_conn_ctx();
 544 }
 545
 546 /****************************************************************************
 547  Push the current security context then force a change via change_to_user().
 548  Saves and restores the connection context.
 549 ****************************************************************************/
 550
 551 bool become_user(connection_struct *conn, uint64_t vuid)
 552 {
 553         if (!push_sec_ctx())
 554                 return False;
 555
 556         push_conn_ctx();
 557
 558         if (!change_to_user(conn, vuid)) {
 559                 pop_sec_ctx();
 560                 pop_conn_ctx();
 561                 return False;
 562         }
 563
 564         return True;
 565 }
 566
 567 bool become_user_by_session(connection_struct *conn,
 568                             const struct auth_session_info *session_info)
 569 {
 570         if (!push_sec_ctx())
 571                 return false;
 572
 573         push_conn_ctx();
 574
 575         if (!change_to_user_by_session(conn, session_info)) {
 576                 pop_sec_ctx();
 577                 pop_conn_ctx();
 578                 return false;
 579         }
 580
 581         return true;
 582 }
 583
 584 bool unbecome_user(void)
 585 {
 586         pop_sec_ctx();
 587         pop_conn_ctx();
 588         return True;
 589 }
 590
 591 /****************************************************************************
 592  Return the current user we are running effectively as on this connection.
 593  I'd like to make this return conn->session_info->unix_token->uid, but become_root()
 594  doesn't alter this value.
 595 ****************************************************************************/
 596
 597 uid_t get_current_uid(connection_struct *conn)
 598 {
 599         return current_user.ut.uid;
 600 }
 601
 602 /****************************************************************************
 603  Return the current group we are running effectively as on this connection.
 604  I'd like to make this return conn->session_info->unix_token->gid, but become_root()
 605  doesn't alter this value.
 606 ****************************************************************************/
 607
 608 gid_t get_current_gid(connection_struct *conn)
 609 {
 610         return current_user.ut.gid;
 611 }
 612
 613 /****************************************************************************
 614  Return the UNIX token we are running effectively as on this connection.
 615  I'd like to make this return &conn->session_info->unix_token-> but become_root()
 616  doesn't alter this value.
 617 ****************************************************************************/
 618
 619 const struct security_unix_token *get_current_utok(connection_struct *conn)
 620 {
 621         return &current_user.ut;
 622 }
 623
 624 /****************************************************************************
 625  Return the Windows token we are running effectively as on this connection.
 626  If this is currently a NULL token as we're inside become_root() - a temporary
 627  UNIX security override, then we search up the stack for the previous active
 628  token.
 629 ****************************************************************************/
 630
 631 const struct security_token *get_current_nttok(connection_struct *conn)
 632 {
 633         if (current_user.nt_user_token) {
 634                 return current_user.nt_user_token;
 635         }
 636         return sec_ctx_active_token();
 637 }
 638
 639 uint64_t get_current_vuid(connection_struct *conn)
 640 {
 641         return current_user.vuid;
 642 }