*/
#include "includes.h"
+#include "system/filesys.h"
+#include "system/passwd.h"
+#include "auth/auth.h"
+#include "smb_server/smb_server.h"
+#include "ntvfs/ntvfs.h"
struct unixuid_private {
- void *samctx;
+ struct sidmap_context *sidmap;
+ struct unix_sec_ctx *last_sec_ctx;
+ struct security_token *last_token;
};
-/*
- map a sid to a unix uid
-*/
-static NTSTATUS sid_to_unixuid(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct dom_sid *sid, uid_t *uid)
-{
- struct unixuid_private *private = ntvfs->private_data;
- const char *attrs[] = { "sAMAccountName", "unixID", "unixName", "sAMAccountType", NULL };
- int ret;
- const char *s;
- void *ctx;
- struct ldb_message **res;
- const char *sidstr;
- uint_t atype;
-
- ctx = talloc(req, 0);
- sidstr = dom_sid_string(ctx, sid);
-
- ret = samdb_search(private->samctx, ctx, NULL, &res, attrs, "objectSid=%s", sidstr);
- if (ret != 1) {
- DEBUG(0,("sid_to_unixuid: unable to find sam record for sid %s\n", sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* make sure its a user, not a group */
- atype = samdb_result_uint(res[0], "sAMAccountType", 0);
- if (atype && atype != ATYPE_NORMAL_ACCOUNT) {
- DEBUG(0,("sid_to_unixuid: sid %s is not ATYPE_NORMAL_ACCOUNT\n", sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* first try to get the uid directly */
- s = samdb_result_string(res[0], "unixID", NULL);
- if (s != NULL) {
- *uid = strtoul(s, NULL, 0);
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- /* next try via the UnixName attribute */
- s = samdb_result_string(res[0], "unixName", NULL);
- if (s != NULL) {
- struct passwd *pwd = getpwnam(s);
- if (!pwd) {
- DEBUG(0,("unixName %s for sid %s does not exist as a local user\n", s, sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
- *uid = pwd->pw_uid;
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- /* finally try via the sAMAccountName attribute */
- s = samdb_result_string(res[0], "sAMAccountName", NULL);
- if (s != NULL) {
- struct passwd *pwd = getpwnam(s);
- if (!pwd) {
- DEBUG(0,("sAMAccountName '%s' for sid %s does not exist as a local user\n", s, sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
- *uid = pwd->pw_uid;
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- DEBUG(0,("sid_to_unixuid: no unixID, unixName or sAMAccountName for sid %s\n", sidstr));
-
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
-}
-
-
-/*
- map a sid to a unix gid
-*/
-static NTSTATUS sid_to_unixgid(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct dom_sid *sid, gid_t *gid)
-{
- struct unixuid_private *private = ntvfs->private_data;
- const char *attrs[] = { "sAMAccountName", "unixID", "unixName", "sAMAccountType", NULL };
- int ret;
- const char *s;
- void *ctx;
- struct ldb_message **res;
- const char *sidstr;
- uint_t atype;
-
- ctx = talloc(req, 0);
- sidstr = dom_sid_string(ctx, sid);
-
- ret = samdb_search(private->samctx, ctx, NULL, &res, attrs, "objectSid=%s", sidstr);
- if (ret != 1) {
- DEBUG(0,("sid_to_unixgid: unable to find sam record for sid %s\n", sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* make sure its not a user */
- atype = samdb_result_uint(res[0], "sAMAccountType", 0);
- if (atype && atype == ATYPE_NORMAL_ACCOUNT) {
- DEBUG(0,("sid_to_unixgid: sid %s is a ATYPE_NORMAL_ACCOUNT\n", sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* first try to get the gid directly */
- s = samdb_result_string(res[0], "unixID", NULL);
- if (s != NULL) {
- *gid = strtoul(s, NULL, 0);
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- /* next try via the UnixName attribute */
- s = samdb_result_string(res[0], "unixName", NULL);
- if (s != NULL) {
- struct group *grp = getgrnam(s);
- if (!grp) {
- DEBUG(0,("unixName '%s' for sid %s does not exist as a local group\n", s, sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
- *gid = grp->gr_gid;
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- /* finally try via the sAMAccountName attribute */
- s = samdb_result_string(res[0], "sAMAccountName", NULL);
- if (s != NULL) {
- struct group *grp = getgrnam(s);
- if (!grp) {
- DEBUG(0,("sAMAccountName '%s' for sid %s does not exist as a local group\n", s, sidstr));
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
- *gid = grp->gr_gid;
- talloc_free(ctx);
- return NT_STATUS_OK;
- }
-
- DEBUG(0,("sid_to_unixgid: no unixID, unixName or sAMAccountName for sid %s\n", sidstr));
-
- talloc_free(ctx);
- return NT_STATUS_ACCESS_DENIED;
-}
struct unix_sec_ctx {
uid_t uid;
*/
static struct unix_sec_ctx *save_unix_security(TALLOC_CTX *mem_ctx)
{
- struct unix_sec_ctx *sec = talloc_p(mem_ctx, struct unix_sec_ctx);
+ struct unix_sec_ctx *sec = talloc(mem_ctx, struct unix_sec_ctx);
if (sec == NULL) {
return NULL;
}
talloc_free(sec);
return NULL;
}
- sec->groups = talloc_array_p(sec, gid_t, sec->ngroups);
+ sec->groups = talloc_array(sec, gid_t, sec->ngroups);
if (sec->groups == NULL) {
talloc_free(sec);
return NULL;
}
/*
- form a unix_sec_ctx from the current session info
+ form a unix_sec_ctx from the current security_token
*/
-static NTSTATUS authinfo_to_unix_security(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req,
- struct auth_serversupplied_info *info,
+static NTSTATUS nt_token_to_unix_security(struct ntvfs_module_context *ntvfs,
+ struct ntvfs_request *req,
+ struct security_token *token,
struct unix_sec_ctx **sec)
{
+ struct unixuid_private *private = ntvfs->private_data;
int i;
NTSTATUS status;
- *sec = talloc_p(req, struct unix_sec_ctx);
+ *sec = talloc(req, struct unix_sec_ctx);
+
+ /* we can't do unix security without a user and group */
+ if (token->num_sids < 2) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
- status = sid_to_unixuid(ntvfs, req, info->user_sid, &(*sec)->uid);
+ status = sidmap_sid_to_unixuid(private->sidmap,
+ token->user_sid, &(*sec)->uid);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- status = sid_to_unixgid(ntvfs, req, info->primary_group_sid, &(*sec)->gid);
+ status = sidmap_sid_to_unixgid(private->sidmap,
+ token->group_sid, &(*sec)->gid);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- (*sec)->ngroups = info->n_domain_groups;
- (*sec)->groups = talloc_array_p(*sec, gid_t, (*sec)->ngroups);
+ (*sec)->ngroups = token->num_sids - 2;
+ (*sec)->groups = talloc_array(*sec, gid_t, (*sec)->ngroups);
if ((*sec)->groups == NULL) {
return NT_STATUS_NO_MEMORY;
}
for (i=0;i<(*sec)->ngroups;i++) {
- status = sid_to_unixgid(ntvfs, req, info->domain_groups[i], &(*sec)->groups[i]);
+ status = sidmap_sid_to_unixgid(private->sidmap,
+ token->sids[i+2], &(*sec)->groups[i]);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
setup our unix security context according to the session authentication info
*/
static NTSTATUS unixuid_setup_security(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct unix_sec_ctx **sec)
+ struct ntvfs_request *req, struct unix_sec_ctx **sec)
{
- struct auth_serversupplied_info *info = req->session->session_info->server_info;
- void *ctx = talloc(req, 0);
+ struct unixuid_private *private = ntvfs->private_data;
+ struct security_token *token;
struct unix_sec_ctx *newsec;
NTSTATUS status;
+ if (req->session == NULL) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ token = req->session->session_info->security_token;
+
*sec = save_unix_security(req);
if (*sec == NULL) {
return NT_STATUS_NO_MEMORY;
}
- status = authinfo_to_unix_security(ntvfs, req, info, &newsec);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(ctx);
- return status;
+ if (req->session->session_info->security_token == private->last_token) {
+ newsec = private->last_sec_ctx;
+ } else {
+ status = nt_token_to_unix_security(ntvfs, req, token, &newsec);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ if (private->last_sec_ctx) {
+ talloc_free(private->last_sec_ctx);
+ }
+ private->last_sec_ctx = newsec;
+ private->last_token = req->session->session_info->security_token;
+ talloc_steal(private, newsec);
}
status = set_unix_security(newsec);
if (!NT_STATUS_IS_OK(status)) {
- talloc_free(ctx);
return status;
}
- talloc_free(ctx);
-
return NT_STATUS_OK;
}
connect to a share - used when a tree_connect operation comes in.
*/
static NTSTATUS unixuid_connect(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, const char *sharename)
+ struct ntvfs_request *req, const char *sharename)
{
struct unixuid_private *private;
NTSTATUS status;
- private = talloc_p(req->tcon, struct unixuid_private);
+ private = talloc(ntvfs, struct unixuid_private);
if (!private) {
return NT_STATUS_NO_MEMORY;
}
- private->samctx = samdb_connect(private);
- if (private->samctx == NULL) {
+ private->sidmap = sidmap_open(private);
+ if (private->sidmap == NULL) {
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
ntvfs->private_data = private;
+ private->last_sec_ctx = NULL;
+ private->last_token = NULL;
- PASS_THRU_REQ(ntvfs, req, connect, (ntvfs, req, sharename));
+ /* we don't use PASS_THRU_REQ here, as the connect operation runs with
+ root privileges. This allows the backends to setup any database
+ links they might need during the connect. */
+ status = ntvfs_next_connect(ntvfs, req, sharename);
return status;
}
/*
disconnect from a share
*/
-static NTSTATUS unixuid_disconnect(struct ntvfs_module_context *ntvfs,
- struct smbsrv_tcon *tcon)
+static NTSTATUS unixuid_disconnect(struct ntvfs_module_context *ntvfs)
{
struct unixuid_private *private = ntvfs->private_data;
NTSTATUS status;
talloc_free(private);
+ ntvfs->private_data = NULL;
- status = ntvfs_next_disconnect(ntvfs, tcon);
+ status = ntvfs_next_disconnect(ntvfs);
return status;
}
delete a file
*/
static NTSTATUS unixuid_unlink(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_unlink *unl)
+ struct ntvfs_request *req,
+ union smb_unlink *unl)
{
NTSTATUS status;
ioctl interface
*/
static NTSTATUS unixuid_ioctl(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_ioctl *io)
+ struct ntvfs_request *req, union smb_ioctl *io)
{
NTSTATUS status;
check if a directory exists
*/
static NTSTATUS unixuid_chkpath(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_chkpath *cp)
+ struct ntvfs_request *req,
+ union smb_chkpath *cp)
{
NTSTATUS status;
return info on a pathname
*/
static NTSTATUS unixuid_qpathinfo(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_fileinfo *info)
+ struct ntvfs_request *req, union smb_fileinfo *info)
{
NTSTATUS status;
query info on a open file
*/
static NTSTATUS unixuid_qfileinfo(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_fileinfo *info)
+ struct ntvfs_request *req, union smb_fileinfo *info)
{
NTSTATUS status;
set info on a pathname
*/
static NTSTATUS unixuid_setpathinfo(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_setfileinfo *st)
+ struct ntvfs_request *req, union smb_setfileinfo *st)
{
NTSTATUS status;
open a file
*/
static NTSTATUS unixuid_open(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_open *io)
+ struct ntvfs_request *req, union smb_open *io)
{
NTSTATUS status;
create a directory
*/
static NTSTATUS unixuid_mkdir(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_mkdir *md)
+ struct ntvfs_request *req, union smb_mkdir *md)
{
NTSTATUS status;
remove a directory
*/
static NTSTATUS unixuid_rmdir(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_rmdir *rd)
+ struct ntvfs_request *req, struct smb_rmdir *rd)
{
NTSTATUS status;
rename a set of files
*/
static NTSTATUS unixuid_rename(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_rename *ren)
+ struct ntvfs_request *req, union smb_rename *ren)
{
NTSTATUS status;
copy a set of files
*/
static NTSTATUS unixuid_copy(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_copy *cp)
+ struct ntvfs_request *req, struct smb_copy *cp)
{
NTSTATUS status;
read from a file
*/
static NTSTATUS unixuid_read(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_read *rd)
+ struct ntvfs_request *req, union smb_read *rd)
{
NTSTATUS status;
write to a file
*/
static NTSTATUS unixuid_write(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_write *wr)
+ struct ntvfs_request *req, union smb_write *wr)
{
NTSTATUS status;
seek in a file
*/
static NTSTATUS unixuid_seek(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_seek *io)
+ struct ntvfs_request *req,
+ union smb_seek *io)
{
NTSTATUS status;
flush a file
*/
static NTSTATUS unixuid_flush(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_flush *io)
+ struct ntvfs_request *req,
+ union smb_flush *io)
{
NTSTATUS status;
close a file
*/
static NTSTATUS unixuid_close(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_close *io)
+ struct ntvfs_request *req, union smb_close *io)
{
NTSTATUS status;
exit - closing files
*/
static NTSTATUS unixuid_exit(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req)
+ struct ntvfs_request *req)
{
NTSTATUS status;
logoff - closing files
*/
static NTSTATUS unixuid_logoff(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req)
+ struct ntvfs_request *req)
{
+ struct unixuid_private *private = ntvfs->private_data;
NTSTATUS status;
PASS_THRU_REQ(ntvfs, req, logoff, (ntvfs, req));
+ private->last_token = NULL;
+
+ return status;
+}
+
+/*
+ async setup
+*/
+static NTSTATUS unixuid_async_setup(struct ntvfs_module_context *ntvfs,
+ struct ntvfs_request *req,
+ void *private)
+{
+ NTSTATUS status;
+
+ PASS_THRU_REQ(ntvfs, req, async_setup, (ntvfs, req, private));
+
+ return status;
+}
+
+/*
+ cancel an async request
+*/
+static NTSTATUS unixuid_cancel(struct ntvfs_module_context *ntvfs,
+ struct ntvfs_request *req)
+{
+ NTSTATUS status;
+
+ PASS_THRU_REQ(ntvfs, req, cancel, (ntvfs, req));
+
return status;
}
lock a byte range
*/
static NTSTATUS unixuid_lock(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_lock *lck)
+ struct ntvfs_request *req, union smb_lock *lck)
{
NTSTATUS status;
set info on a open file
*/
static NTSTATUS unixuid_setfileinfo(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req,
+ struct ntvfs_request *req,
union smb_setfileinfo *info)
{
NTSTATUS status;
return filesystem space info
*/
static NTSTATUS unixuid_fsinfo(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_fsinfo *fs)
+ struct ntvfs_request *req, union smb_fsinfo *fs)
{
NTSTATUS status;
return print queue info
*/
static NTSTATUS unixuid_lpq(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_lpq *lpq)
+ struct ntvfs_request *req, union smb_lpq *lpq)
{
NTSTATUS status;
list files in a directory matching a wildcard pattern
*/
static NTSTATUS unixuid_search_first(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_search_first *io,
+ struct ntvfs_request *req, union smb_search_first *io,
void *search_private,
BOOL (*callback)(void *, union smb_search_data *))
{
/* continue a search */
static NTSTATUS unixuid_search_next(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_search_next *io,
+ struct ntvfs_request *req, union smb_search_next *io,
void *search_private,
BOOL (*callback)(void *, union smb_search_data *))
{
/* close a search */
static NTSTATUS unixuid_search_close(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, union smb_search_close *io)
+ struct ntvfs_request *req, union smb_search_close *io)
{
NTSTATUS status;
/* SMBtrans - not used on file shares */
static NTSTATUS unixuid_trans(struct ntvfs_module_context *ntvfs,
- struct smbsrv_request *req, struct smb_trans2 *trans2)
+ struct ntvfs_request *req, struct smb_trans2 *trans2)
{
NTSTATUS status;
ops.search_close = unixuid_search_close;
ops.trans = unixuid_trans;
ops.logoff = unixuid_logoff;
+ ops.async_setup = unixuid_async_setup;
+ ops.cancel = unixuid_cancel;
ops.name = "unixuid";
/* we register under all 3 backend types, as we are not type specific */
ops.type = NTVFS_DISK;
- ret = register_backend("ntvfs", &ops);
+ ret = ntvfs_register(&ops);
if (!NT_STATUS_IS_OK(ret)) goto failed;
ops.type = NTVFS_PRINT;
- ret = register_backend("ntvfs", &ops);
+ ret = ntvfs_register(&ops);
if (!NT_STATUS_IS_OK(ret)) goto failed;
ops.type = NTVFS_IPC;
- ret = register_backend("ntvfs", &ops);
+ ret = ntvfs_register(&ops);
if (!NT_STATUS_IS_OK(ret)) goto failed;
failed:
git.samba.org / gd / samba-autobuild / .git / blobdiff