make some auth functions return an NTSTATUS like other similar functions for better...

Signed-off-by: Kristján Valur <kristjan@rvx.is>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Apr  2 02:12:48 UTC 2019 on sn-devel-144

diff --git a/libgpo/gpo_ldap.c b/libgpo/gpo_ldap.c
index f087203f28aa1153691e86e0f20415d6b6b7dde3..e5a5adb723593273ae73005395404a3d9f7092df 100644 (file)
--- a/libgpo/gpo_ldap.c
+++ b/libgpo/gpo_ldap.c
@@ -688,10 +688,13 @@ ADS_STATUS ads_get_sid_token(ADS_STRUCT *ads,
                }
        }
 
-       new_token = create_local_nt_token(mem_ctx, &object_sid, false,
-                                         num_token_sids, token_sids);
-       ADS_ERROR_HAVE_NO_MEMORY(new_token);
-
+       status = ADS_ERROR_NT(create_local_nt_token(mem_ctx, 
+                                         &object_sid, false,
+                                         num_token_sids, token_sids, &new_token));
+       if (!ADS_ERR_OK(status)) {
+               return status;
+       }
+       
        *token = new_token;
 
        security_token_debug(DBGC_CLASS, 5, *token);

diff --git a/source3/auth/proto.h b/source3/auth/proto.h
index 75cf1e6724fbb6ff3130b8af187b0443a03600c8..a96ff6e2582abd03b067a3d8b808679afff1504d 100644 (file)
--- a/source3/auth/proto.h
+++ b/source3/auth/proto.h
@@ -383,14 +383,15 @@ NTSTATUS pass_check(const struct passwd *pass,
 
 bool nt_token_check_sid ( const struct dom_sid *sid, const struct security_token *token );
 bool nt_token_check_domain_rid( struct security_token *token, uint32_t rid );
-struct security_token *get_root_nt_token( void );
+NTSTATUS get_root_nt_token( struct security_token **token );
 NTSTATUS add_aliases(const struct dom_sid *domain_sid,
                     struct security_token *token);
-struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
+NTSTATUS create_local_nt_token(TALLOC_CTX *mem_ctx,
                                            const struct dom_sid *user_sid,
                                            bool is_guest,
                                            int num_groupsids,
-                                           const struct dom_sid *groupsids);
+                                           const struct dom_sid *groupsids,
+                                           struct security_token **token);
 NTSTATUS finalize_local_nt_token(struct security_token *result,
                                 uint32_t session_info_flags);
 NTSTATUS get_user_sid_info3_and_extra(const struct netr_SamInfo3 *info3,

diff --git a/source3/auth/token_util.c b/source3/auth/token_util.c
index f7ebd23e4aadfc4bc49454ac392496589d17fc30..3a3b5d9936bcc45bbb3a8911f09df60f2cc44bcb 100644 (file)
--- a/source3/auth/token_util.c
+++ b/source3/auth/token_util.c
@@ -78,27 +78,29 @@ bool nt_token_check_domain_rid( struct security_token *token, uint32_t rid )
  Create a copy if you need to change it.
 ******************************************************************************/
 
-struct security_token *get_root_nt_token( void )
+NTSTATUS get_root_nt_token( struct security_token **token )
 {
-       struct security_token *token, *for_cache;
+       struct security_token *for_cache;
        struct dom_sid u_sid, g_sid;
        struct passwd *pw;
        void *cache_data;
+       NTSTATUS status = NT_STATUS_OK;
 
        cache_data = memcache_lookup_talloc(
                NULL, SINGLETON_CACHE_TALLOC,
                data_blob_string_const_null("root_nt_token"));
 
        if (cache_data != NULL) {
-               return talloc_get_type_abort(
+               *token = talloc_get_type_abort(
                        cache_data, struct security_token);
+               return NT_STATUS_OK;
        }
 
        if ( !(pw = getpwuid(0)) ) {
                if ( !(pw = getpwnam("root")) ) {
-                       DEBUG(0,("get_root_nt_token: both getpwuid(0) "
-                               "and getpwnam(\"root\") failed!\n"));
-                       return NULL;
+                       DBG_ERR("get_root_nt_token: both getpwuid(0) "
+                               "and getpwnam(\"root\") failed!\n");
+                       return NT_STATUS_NO_SUCH_USER;
                }
        }
 
@@ -108,18 +110,21 @@ struct security_token *get_root_nt_token( void )
        uid_to_sid(&u_sid, pw->pw_uid);
        gid_to_sid(&g_sid, pw->pw_gid);
 
-       token = create_local_nt_token(talloc_tos(), &u_sid, False,
-                                     1, &global_sid_Builtin_Administrators);
+       status = create_local_nt_token(talloc_tos(), &u_sid, False,
+                                     1, &global_sid_Builtin_Administrators, token);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
 
-       security_token_set_privilege(token, SEC_PRIV_DISK_OPERATOR);
+       security_token_set_privilege(*token, SEC_PRIV_DISK_OPERATOR);
 
-       for_cache = token;
+       for_cache = *token;
 
        memcache_add_talloc(
                NULL, SINGLETON_CACHE_TALLOC,
                data_blob_string_const_null("root_nt_token"), &for_cache);
 
-       return token;
+       return status;
 }
 
 
@@ -420,11 +425,12 @@ NTSTATUS create_local_nt_token_from_info3(TALLOC_CTX *mem_ctx,
  Create a NT token for the user, expanding local aliases
 *******************************************************************/
 
-struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
+NTSTATUS create_local_nt_token(TALLOC_CTX *mem_ctx,
                                            const struct dom_sid *user_sid,
                                            bool is_guest,
                                            int num_groupsids,
-                                           const struct dom_sid *groupsids)
+                                           const struct dom_sid *groupsids,
+                                           struct security_token **token)
 {
        struct security_token *result = NULL;
        int i;
@@ -437,7 +443,8 @@ struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
 
        if (!(result = talloc_zero(mem_ctx, struct security_token))) {
                DEBUG(0, ("talloc failed\n"));
-               return NULL;
+               status = NT_STATUS_NO_MEMORY;
+               goto err;
        }
 
        /* Add the user and primary group sid */
@@ -445,8 +452,7 @@ struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
        status = add_sid_to_array(result, user_sid,
                                  &result->sids, &result->num_sids);
        if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(result);
-               return NULL;
+               goto err;
        }
 
        /* For guest, num_groupsids may be zero. */
@@ -455,8 +461,7 @@ struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
                                          &result->sids,
                                          &result->num_sids);
                if (!NT_STATUS_IS_OK(status)) {
-                       TALLOC_FREE(result);
-                       return NULL;
+                       goto err;
                }
        }
 
@@ -471,15 +476,13 @@ struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
                                                 &result->sids,
                                                 &result->num_sids);
                if (!NT_STATUS_IS_OK(status)) {
-                       TALLOC_FREE(result);
-                       return NULL;
+                       goto err;
                }
        }
 
        status = add_local_groups(result, is_guest);
        if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(result);
-               return NULL;
+               goto err;
        }
 
        session_info_flags |= AUTH_SESSION_INFO_DEFAULT_GROUPS;
@@ -489,8 +492,7 @@ struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
 
        status = finalize_local_nt_token(result, session_info_flags);
        if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(result);
-               return NULL;
+               goto err;
        }
 
        if (is_guest) {
@@ -511,12 +513,16 @@ struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
                                                 &result->num_sids);
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(3, ("Failed to add SID to nt token\n"));
-                       TALLOC_FREE(result);
-                       return NULL;
+                       goto err;
                }
        }
 
-       return result;
+       *token = result;
+       return NT_STATUS_SUCCESS;
+
+err:
+       TALLOC_FREE(result);
+       return status;
 }
 
 /***************************************************
@@ -556,9 +562,11 @@ static NTSTATUS add_local_groups(struct security_token *result,
                pass = getpwuid_alloc(tmp_ctx, uid);
                if (pass == NULL) {
                        struct dom_sid_buf buf;
-                       DEBUG(1, ("SID %s -> getpwuid(%u) failed\n",
+                       DBG_ERR("SID %s -> getpwuid(%u) failed, is nsswitch configured?\n",
                                dom_sid_str_buf(&result->sids[0], &buf),
-                               (unsigned int)uid));
+                               (unsigned int)uid);
+                       TALLOC_FREE(tmp_ctx);
+                       return NT_STATUS_NO_SUCH_USER;
                }
        }
 
@@ -1115,11 +1123,10 @@ static NTSTATUS create_token_from_sid(TALLOC_CTX *mem_ctx,
        }
 
        /* Ensure we're creating the nt_token on the right context. */
-       *token = create_local_nt_token(mem_ctx, user_sid,
-                                      is_guest, num_group_sids, group_sids);
+       result = create_local_nt_token(mem_ctx, user_sid,
+                                      is_guest, num_group_sids, group_sids, token);
 
-       if (*token == NULL) {
-               result = NT_STATUS_NO_MEMORY;
+       if (!NT_STATUS_IS_OK(result)) {
                goto done;
        }
 

diff --git a/source3/rpc_server/svcctl/srv_svcctl_nt.c b/source3/rpc_server/svcctl/srv_svcctl_nt.c
index 8eaedfb764d83e8d2a3e9db9a1ba2b18edc4a59c..ae787066873aa6aaef756213c77ce1bea72b6d86 100644 (file)
--- a/source3/rpc_server/svcctl/srv_svcctl_nt.c
+++ b/source3/rpc_server/svcctl/srv_svcctl_nt.c
@@ -137,9 +137,13 @@ static struct service_control_op* find_service_by_name( const char *name )
 static NTSTATUS svcctl_access_check( struct security_descriptor *sec_desc, struct security_token *token,
                                      uint32_t access_desired, uint32_t *access_granted )
 {
+       NTSTATUS status;
        if ( geteuid() == sec_initial_uid() ) {
                DEBUG(5,("svcctl_access_check: using root's token\n"));
-               token = get_root_nt_token();
+               status = get_root_nt_token(&token);
+               if(!NT_STATUS_IS_OK(status)) {
+                       return status;
+               }
        }
 
        return se_access_check( sec_desc, token, access_desired, access_granted);