/*
- Unix SMB/Netbios implementation.
- Version 1.9.
+ Unix SMB/CIFS implementation.
uid/user handling
Copyright (C) Tim Potter 2000
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
-extern int DEBUGLEVEL;
extern struct current_user current_user;
struct sec_ctx {
- uid_t uid;
- uid_t gid;
- int ngroups;
- gid_t *groups;
+ UNIX_USER_TOKEN ut;
+ NT_USER_TOKEN *token;
};
/* A stack of security contexts. We include the current context as being
static struct sec_ctx sec_ctx_stack[MAX_SEC_CTX_DEPTH + 1];
static int sec_ctx_stack_ndx;
-/* Become the specified uid */
+/****************************************************************************
+ Become the specified uid.
+****************************************************************************/
-static BOOL become_uid(uid_t uid)
+static bool become_uid(uid_t uid)
{
/* Check for dodgy uid values */
/* Set effective user id */
set_effective_uid(uid);
- current_user.uid = uid;
-
-#ifdef WITH_PROFILE
- profile_p->uid_changes++;
-#endif
+ DO_PROFILE_INC(uid_changes);
return True;
}
-/* Become the specified gid */
+/****************************************************************************
+ Become the specified gid.
+****************************************************************************/
-static BOOL become_gid(gid_t gid)
+static bool become_gid(gid_t gid)
{
/* Check for dodgy gid values */
/* Set effective group id */
set_effective_gid(gid);
- current_user.gid = gid;
-
return True;
}
-/* Become the specified uid and gid */
+/****************************************************************************
+ Become the specified uid and gid.
+****************************************************************************/
-static BOOL become_id(uid_t uid, gid_t gid)
+static bool become_id(uid_t uid, gid_t gid)
{
return become_gid(gid) && become_uid(uid);
}
-/* Drop back to root privileges in order to change to another user */
+/****************************************************************************
+ Drop back to root privileges in order to change to another user.
+****************************************************************************/
static void gain_root(void)
{
+ if (non_root_mode()) {
+ return;
+ }
+
if (geteuid() != 0) {
set_effective_uid(0);
}
}
-/* Get the list of current groups */
+/****************************************************************************
+ Get the list of current groups.
+****************************************************************************/
-static void get_current_groups(int *ngroups, gid_t **groups)
+static int get_current_groups(gid_t gid, int *p_ngroups, gid_t **p_groups)
{
- *ngroups = getgroups(0, NULL);
- *groups = (gid_t *)malloc(*ngroups * sizeof(gid_t));
+ int i;
+ gid_t grp;
+ int ngroups;
+ gid_t *groups = NULL;
- if (!groups) {
- DEBUG(0, ("Out of memory in get_current_groups\n"));
- return;
+ (*p_ngroups) = 0;
+ (*p_groups) = NULL;
+
+ /* this looks a little strange, but is needed to cope with
+ systems that put the current egid in the group list
+ returned from getgroups() (tridge) */
+ save_re_gid();
+ set_effective_gid(gid);
+ setgid(gid);
+
+ ngroups = sys_getgroups(0,&grp);
+ if (ngroups <= 0) {
+ goto fail;
+ }
+
+ if((groups = SMB_MALLOC_ARRAY(gid_t, ngroups+1)) == NULL) {
+ DEBUG(0,("setup_groups malloc fail !\n"));
+ goto fail;
+ }
+
+ if ((ngroups = sys_getgroups(ngroups,groups)) == -1) {
+ goto fail;
+ }
+
+ restore_re_gid();
+
+ (*p_ngroups) = ngroups;
+ (*p_groups) = groups;
+
+ DEBUG( 3, ( "get_current_groups: user is in %u groups: ", ngroups));
+ for (i = 0; i < ngroups; i++ ) {
+ DEBUG( 3, ( "%s%d", (i ? ", " : ""), (int)groups[i] ) );
}
+ DEBUG( 3, ( "\n" ) );
+
+ return ngroups;
- getgroups(*ngroups, *groups);
+fail:
+ SAFE_FREE(groups);
+ restore_re_gid();
+ return -1;
}
-/* Create a new security context on the stack. It is the same as the old
- one. User changes are done using the set_sec_ctx() function. */
+/****************************************************************************
+ Create a new security context on the stack. It is the same as the old
+ one. User changes are done using the set_sec_ctx() function.
+****************************************************************************/
-BOOL push_sec_ctx(void)
+bool push_sec_ctx(void)
{
+ struct sec_ctx *ctx_p;
+
/* Check we don't overflow our stack */
- if (sec_ctx_stack_ndx == (MAX_SEC_CTX_DEPTH)) {
+ if (sec_ctx_stack_ndx == MAX_SEC_CTX_DEPTH) {
DEBUG(0, ("Security context stack overflow!\n"));
- return False;
+ smb_panic("Security context stack overflow!");
}
/* Store previous user context */
sec_ctx_stack_ndx++;
- sec_ctx_stack[sec_ctx_stack_ndx].uid = geteuid();
- sec_ctx_stack[sec_ctx_stack_ndx].gid = getegid();
+ ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
- sec_ctx_stack[sec_ctx_stack_ndx].ngroups = sys_getgroups(0, NULL);
+ ctx_p->ut.uid = geteuid();
+ ctx_p->ut.gid = getegid();
- if (!(sec_ctx_stack[sec_ctx_stack_ndx].groups =
- malloc(sec_ctx_stack[sec_ctx_stack_ndx].ngroups *
- sizeof(gid_t)))) {
- DEBUG(0, ("Out of memory in push_sec_ctx()\n"));
- return False;
- }
+ DEBUG(3, ("push_sec_ctx(%u, %u) : sec_ctx_stack_ndx = %d\n",
+ (unsigned int)ctx_p->ut.uid, (unsigned int)ctx_p->ut.gid, sec_ctx_stack_ndx ));
- sys_getgroups(sec_ctx_stack[sec_ctx_stack_ndx].ngroups,
- sec_ctx_stack[sec_ctx_stack_ndx].groups);
+ ctx_p->token = dup_nt_token(NULL,
+ sec_ctx_stack[sec_ctx_stack_ndx-1].token);
+
+ ctx_p->ut.ngroups = sys_getgroups(0, NULL);
+
+ if (ctx_p->ut.ngroups != 0) {
+ if (!(ctx_p->ut.groups = SMB_MALLOC_ARRAY(gid_t, ctx_p->ut.ngroups))) {
+ DEBUG(0, ("Out of memory in push_sec_ctx()\n"));
+ TALLOC_FREE(ctx_p->token);
+ return False;
+ }
+
+ sys_getgroups(ctx_p->ut.ngroups, ctx_p->ut.groups);
+ } else {
+ ctx_p->ut.groups = NULL;
+ }
return True;
}
-/* Set the current security context to a given user */
+/****************************************************************************
+ Change UNIX security context. Calls panic if not successful so no return value.
+****************************************************************************/
-void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups)
+#ifndef HAVE_DARWIN_INITGROUPS
+
+/* Normal credential switch path. */
+
+static void set_unix_security_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups)
{
- /* Set the security context */
+ /* Start context switch */
+ gain_root();
+#ifdef HAVE_SETGROUPS
+ if (sys_setgroups(gid, ngroups, groups) != 0 && !non_root_mode()) {
+ smb_panic("sys_setgroups failed");
+ }
+#endif
+ become_id(uid, gid);
+ /* end context switch */
+}
- DEBUG(3, ("setting sec ctx (%d, %d)\n", uid, gid));
+#else /* HAVE_DARWIN_INITGROUPS */
+
+/* The Darwin groups implementation is a little unusual. The list of
+* groups in the kernel credential is not exhaustive, but more like
+* a cache. The full group list is held in userspace and checked
+* dynamically.
+*
+* This is an optional mechanism, and setgroups(2) opts out
+* of it. That is, if you call setgroups, then the list of groups you
+* set are the only groups that are ever checked. This is not what we
+* want. We want to opt in to the dynamic resolution mechanism, so we
+* need to specify the uid of the user whose group list (cache) we are
+* setting.
+*
+* The Darwin rules are:
+* 1. Thou shalt setegid, initgroups and seteuid IN THAT ORDER
+* 2. Thou shalt not pass more that NGROUPS_MAX to initgroups
+* 3. Thou shalt leave the first entry in the groups list well alone
+*/
+
+#include <sys/syscall.h>
+static void set_unix_security_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups)
+{
+ int max = groups_max();
+
+ /* Start context switch */
gain_root();
-#ifdef HAVE_SETGROUPS
- sys_setgroups(ngroups, groups);
+ become_gid(gid);
- sec_ctx_stack[sec_ctx_stack_ndx].ngroups = ngroups;
- sec_ctx_stack[sec_ctx_stack_ndx].groups =
- memdup(groups, sizeof(gid_t) * ngroups);
-#endif
- become_id(uid, gid);
+ if (syscall(SYS_initgroups, (ngroups > max) ? max : ngroups,
+ groups, uid) == -1 && !non_root_mode()) {
+ DEBUG(0, ("WARNING: failed to set group list "
+ "(%d groups) for UID %ld: %s\n",
+ ngroups, uid, strerror(errno)));
+ smb_panic("sys_setgroups failed");
+ }
+
+ become_uid(uid);
+ /* end context switch */
+}
+
+#endif /* HAVE_DARWIN_INITGROUPS */
+
+/****************************************************************************
+ Set the current security context to a given user.
+****************************************************************************/
+
+void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups, NT_USER_TOKEN *token)
+{
+ struct sec_ctx *ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
+
+ /* Set the security context */
+
+ DEBUG(3, ("setting sec ctx (%u, %u) - sec_ctx_stack_ndx = %d\n",
+ (unsigned int)uid, (unsigned int)gid, sec_ctx_stack_ndx));
+
+ debug_nt_user_token(DBGC_CLASS, 5, token);
+ debug_unix_user_token(DBGC_CLASS, 5, uid, gid, ngroups, groups);
+
+ /* Change uid, gid and supplementary group list. */
+ set_unix_security_ctx(uid, gid, ngroups, groups);
- sec_ctx_stack[sec_ctx_stack_ndx].uid = uid;
- sec_ctx_stack[sec_ctx_stack_ndx].gid = gid;
+ ctx_p->ut.ngroups = ngroups;
+
+ SAFE_FREE(ctx_p->ut.groups);
+ if (token && (token == ctx_p->token)) {
+ smb_panic("DUPLICATE_TOKEN");
+ }
+
+ TALLOC_FREE(ctx_p->token);
+
+ if (ngroups) {
+ ctx_p->ut.groups = (gid_t *)memdup(groups,
+ sizeof(gid_t) * ngroups);
+ if (!ctx_p->ut.groups) {
+ smb_panic("memdup failed");
+ }
+ } else {
+ ctx_p->ut.groups = NULL;
+ }
+
+ if (token) {
+ ctx_p->token = dup_nt_token(NULL, token);
+ if (!ctx_p->token) {
+ smb_panic("dup_nt_token failed");
+ }
+ } else {
+ ctx_p->token = NULL;
+ }
+
+ ctx_p->ut.uid = uid;
+ ctx_p->ut.gid = gid;
/* Update current_user stuff */
- current_user.uid = uid;
- current_user.gid = gid;
- current_user.ngroups = ngroups;
- current_user.groups = groups;
+ current_user.ut.uid = uid;
+ current_user.ut.gid = gid;
+ current_user.ut.ngroups = ngroups;
+ current_user.ut.groups = groups;
+ current_user.nt_user_token = ctx_p->token;
}
-/* Become root context */
+/****************************************************************************
+ Become root context.
+****************************************************************************/
void set_root_sec_ctx(void)
{
/* May need to worry about supplementary groups at some stage */
- set_sec_ctx(0, 0, 0, NULL);
+ set_sec_ctx(0, 0, 0, NULL, NULL);
}
-/* Pop a security context from the stack */
+/****************************************************************************
+ Pop a security context from the stack.
+****************************************************************************/
-BOOL pop_sec_ctx(void)
+bool pop_sec_ctx(void)
{
+ struct sec_ctx *ctx_p;
+ struct sec_ctx *prev_ctx_p;
+
/* Check for stack underflow */
if (sec_ctx_stack_ndx == 0) {
DEBUG(0, ("Security context stack underflow!\n"));
- return False;
+ smb_panic("Security context stack underflow!");
}
+ ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
+
/* Clear previous user info */
- sec_ctx_stack[sec_ctx_stack_ndx].uid = (uid_t)-1;
- sec_ctx_stack[sec_ctx_stack_ndx].gid = (gid_t)-1;
+ ctx_p->ut.uid = (uid_t)-1;
+ ctx_p->ut.gid = (gid_t)-1;
- safe_free(sec_ctx_stack[sec_ctx_stack_ndx].groups);
- sec_ctx_stack[sec_ctx_stack_ndx].ngroups = 0;
+ SAFE_FREE(ctx_p->ut.groups);
+ ctx_p->ut.ngroups = 0;
+
+ TALLOC_FREE(ctx_p->token);
/* Pop back previous user */
sec_ctx_stack_ndx--;
- gain_root();
+ prev_ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];
-#ifdef HAVE_SETGROUPS
- sys_setgroups(sec_ctx_stack[sec_ctx_stack_ndx].ngroups,
- sec_ctx_stack[sec_ctx_stack_ndx].groups);
-#endif
-
- become_id(sec_ctx_stack[sec_ctx_stack_ndx].uid,
- sec_ctx_stack[sec_ctx_stack_ndx].gid);
+ /* Change uid, gid and supplementary group list. */
+ set_unix_security_ctx(prev_ctx_p->ut.uid,
+ prev_ctx_p->ut.gid,
+ prev_ctx_p->ut.ngroups,
+ prev_ctx_p->ut.groups);
/* Update current_user stuff */
- current_user.uid = sec_ctx_stack[sec_ctx_stack_ndx].uid;
- current_user.gid = sec_ctx_stack[sec_ctx_stack_ndx].gid;
- current_user.ngroups = sec_ctx_stack[sec_ctx_stack_ndx].ngroups;
- current_user.groups = sec_ctx_stack[sec_ctx_stack_ndx].groups;
+ current_user.ut.uid = prev_ctx_p->ut.uid;
+ current_user.ut.gid = prev_ctx_p->ut.gid;
+ current_user.ut.ngroups = prev_ctx_p->ut.ngroups;
+ current_user.ut.groups = prev_ctx_p->ut.groups;
+ current_user.nt_user_token = prev_ctx_p->token;
- DEBUG(3, ("popped off to sec ctx (%d, %d)\n", geteuid(), getegid()));
+ DEBUG(3, ("pop_sec_ctx (%u, %u) - sec_ctx_stack_ndx = %d\n",
+ (unsigned int)geteuid(), (unsigned int)getegid(), sec_ctx_stack_ndx));
return True;
}
void init_sec_ctx(void)
{
int i;
+ struct sec_ctx *ctx_p;
/* Initialise security context stack */
memset(sec_ctx_stack, 0, sizeof(struct sec_ctx) * MAX_SEC_CTX_DEPTH);
for (i = 0; i < MAX_SEC_CTX_DEPTH; i++) {
- sec_ctx_stack[i].uid = (uid_t)-1;
- sec_ctx_stack[i].gid = (gid_t)-1;
+ sec_ctx_stack[i].ut.uid = (uid_t)-1;
+ sec_ctx_stack[i].ut.gid = (gid_t)-1;
}
/* Initialise first level of stack. It is the current context */
+ ctx_p = &sec_ctx_stack[0];
+
+ ctx_p->ut.uid = geteuid();
+ ctx_p->ut.gid = getegid();
- sec_ctx_stack[0].uid = geteuid();
- sec_ctx_stack[0].gid = getegid();
+ get_current_groups(ctx_p->ut.gid, &ctx_p->ut.ngroups, &ctx_p->ut.groups);
- get_current_groups(&sec_ctx_stack[0].ngroups,
- &sec_ctx_stack[0].groups);
+ ctx_p->token = NULL; /* Maps to guest user. */
/* Initialise current_user global */
- current_user.uid = sec_ctx_stack[sec_ctx_stack_ndx].uid;
- current_user.gid = sec_ctx_stack[sec_ctx_stack_ndx].gid;
- current_user.ngroups = sec_ctx_stack[sec_ctx_stack_ndx].ngroups;
- current_user.groups = sec_ctx_stack[sec_ctx_stack_ndx].groups;
+ current_user.ut.uid = ctx_p->ut.uid;
+ current_user.ut.gid = ctx_p->ut.gid;
+ current_user.ut.ngroups = ctx_p->ut.ngroups;
+ current_user.ut.groups = ctx_p->ut.groups;
/* The conn and vuid are usually taken care of by other modules.
We initialise them here. */
current_user.conn = NULL;
current_user.vuid = UID_FIELD_INVALID;
+ current_user.nt_user_token = NULL;
}
git.samba.org / tprouty / samba.git / blobdiff