make the UID_WRAPPER skip checks at runtime

This fixes two issues pointed out by Andrew. It adds a runtime
uwrap_enabled() call that wraps the skips needed for uid emulation. It
also makes the skip in the directory_create_or_exist() function only
change the uid checking code, not the permissions code

diff --git a/lib/uid_wrapper/uid_wrapper.c b/lib/uid_wrapper/uid_wrapper.c
index e009fa0b5c3eedf607e68df962e0e6b874b26c32..948ff65b352f0e68484c02c781ca7e3428b91efc 100644 (file)
--- a/lib/uid_wrapper/uid_wrapper.c
+++ b/lib/uid_wrapper/uid_wrapper.c
@@ -45,6 +45,13 @@ static void uwrap_init(void)
        }
 }
 
        }
 }
 

+#undef uwrap_enabled
+_PUBLIC_ int uwrap_enabled(void)
+{
+       uwrap_init();
+       return uwrap.enabled?1:0;
+}
+

 _PUBLIC_ int uwrap_seteuid(uid_t euid)
 {
        uwrap_init();
 _PUBLIC_ int uwrap_seteuid(uid_t euid)
 {
        uwrap_init();

diff --git a/lib/uid_wrapper/uid_wrapper.h b/lib/uid_wrapper/uid_wrapper.h
index e2df613f504ac686a35dc4a7cb5c09548ee029c2..5d7c99d2b27da60fe22d3bbe11c6b6a7e3c4862e 100644 (file)
--- a/lib/uid_wrapper/uid_wrapper.h
+++ b/lib/uid_wrapper/uid_wrapper.h
@@ -58,4 +58,6 @@
 #endif
 #define getgid uwrap_getgid
 
 #endif
 #define getgid uwrap_getgid
 

+int uwrap_enabled(void);
+

 #endif /* __UID_WRAPPER_H__ */
 #endif /* __UID_WRAPPER_H__ */

diff --git a/lib/util/config.mk b/lib/util/config.mk
index 47e026865e7d57d6b5505f5feb34767a1e5050e0..6dc8354948d1680cf02736ca939749fc8df74e9f 100644 (file)
--- a/lib/util/config.mk
+++ b/lib/util/config.mk
@@ -2,7 +2,7 @@
 PUBLIC_DEPENDENCIES = \
                LIBTALLOC LIBCRYPTO \
                SOCKET_WRAPPER LIBREPLACE_NETWORK \
 PUBLIC_DEPENDENCIES = \
                LIBTALLOC LIBCRYPTO \
                SOCKET_WRAPPER LIBREPLACE_NETWORK \

-               CHARSET EXECINFO
+               CHARSET EXECINFO UID_WRAPPER

 
 LIBSAMBA-UTIL_VERSION = 0.0.1
 LIBSAMBA-UTIL_SOVERSION = 0
 
 LIBSAMBA-UTIL_VERSION = 0.0.1
 LIBSAMBA-UTIL_SOVERSION = 0

diff --git a/lib/util/util.c b/lib/util/util.c
index dea140148fa52e2e1d7561e5b25dc4202c1f9f11..2a809d3ccb021d077e99e0c8a08b475ba2eb6dee 100644 (file)
--- a/lib/util/util.c
+++ b/lib/util/util.c
@@ -133,14 +133,17 @@ _PUBLIC_ bool directory_create_or_exist(const char *dname, uid_t uid,
                        umask(old_umask);
                        return false;
                }
                        umask(old_umask);
                        return false;
                }

-               if ((st.st_uid != uid) || 
-                   ((st.st_mode & 0777) != dir_perms)) {
-#ifndef UID_WRAPPER_REPLACE
+               if (st.st_uid != uid && !uwrap_enabled()) {
+                       DEBUG(0, ("invalid ownership on directory "
+                                 "%s\n", dname));
+                       umask(old_umask);
+                       return false;
+               }
+               if ((st.st_mode & 0777) != dir_perms) {

                        DEBUG(0, ("invalid permissions on directory "
                                  "%s\n", dname));
                        umask(old_umask);
                        return false;
                        DEBUG(0, ("invalid permissions on directory "
                                  "%s\n", dname));
                        umask(old_umask);
                        return false;

-#endif

                }
        }
        return true;
                }
        }
        return true;

diff --git a/source4/heimdal_build/config.h b/source4/heimdal_build/config.h
index 8830942e30727dece1381414b7562d1448f4efec..8c0e6b0475968dddc1af495cb581d9af2b78095e 100644 (file)
--- a/source4/heimdal_build/config.h
+++ b/source4/heimdal_build/config.h
@@ -27,9 +27,13 @@
 
 #undef HAVE_KRB5_ENCRYPT_BLOCK
 
 
 #undef HAVE_KRB5_ENCRYPT_BLOCK
 

-#if defined(UID_WRAPPER) && !defined(UID_WRAPPER_REPLACE) && !defined(UID_WRAPPER_NOT_REPLACE)
+#if defined(UID_WRAPPER)
+#if !defined(UID_WRAPPER_REPLACE) && !defined(UID_WRAPPER_NOT_REPLACE)

 #define UID_WRAPPER_REPLACE
 #include "../uid_wrapper/uid_wrapper.h"
 #endif
 #define UID_WRAPPER_REPLACE
 #include "../uid_wrapper/uid_wrapper.h"
 #endif

+#else
+#define uwrap_enabled() 0
+#endif

 
 #endif
 
 #endif

diff --git a/source4/include/includes.h b/source4/include/includes.h
index 37c6115f0f5fc326b4d19d7eedf572030f6ceac9..e94c0fe633906afbd7d4108d1b976fd7ba9aba00 100644 (file)
--- a/source4/include/includes.h
+++ b/source4/include/includes.h
@@ -73,9 +73,13 @@
 #define TALLOC_ABORT(reason) smb_panic(reason)
 #endif
 
 #define TALLOC_ABORT(reason) smb_panic(reason)
 #endif
 

-#if defined(UID_WRAPPER) && !defined(UID_WRAPPER_REPLACE) && !defined(UID_WRAPPER_NOT_REPLACE)
+#if defined(UID_WRAPPER)
+#if !defined(UID_WRAPPER_REPLACE) && !defined(UID_WRAPPER_NOT_REPLACE)

 #define UID_WRAPPER_REPLACE
 #include "../uid_wrapper/uid_wrapper.h"
 #endif
 #define UID_WRAPPER_REPLACE
 #include "../uid_wrapper/uid_wrapper.h"
 #endif

+#else
+#define uwrap_enabled() 0
+#endif

 
 #endif /* _INCLUDES_H */
 
 #endif /* _INCLUDES_H */

diff --git a/source4/ntvfs/posix/pvfs_acl.c b/source4/ntvfs/posix/pvfs_acl.c
index f5a00c08a8fd93a7fe09dad994db0d4b86013af2..232883911e13ff136d28355a8533200ea941fecf 100644 (file)
--- a/source4/ntvfs/posix/pvfs_acl.c
+++ b/source4/ntvfs/posix/pvfs_acl.c
@@ -473,13 +473,13 @@ NTSTATUS pvfs_access_check_unix(struct pvfs_state *pvfs,
                max_bits |= SEC_STD_ALL;
        }
 
                max_bits |= SEC_STD_ALL;
        }
 

-#ifdef UID_WRAPPER_REPLACE
-       /* when running with the uid wrapper, files will be created
-          owned by the ruid, but we may have a different simulated 
-          euid. We need to force the permission bits as though the 
-          files owner matches the euid */
-       max_bits |= SEC_STD_ALL;
-#endif
+       if (!uwrap_enabled()) {
+               /* when running with the uid wrapper, files will be created
+                  owned by the ruid, but we may have a different simulated 
+                  euid. We need to force the permission bits as though the 
+                  files owner matches the euid */
+               max_bits |= SEC_STD_ALL;
+       }

 
        if (*access_mask == SEC_FLAG_MAXIMUM_ALLOWED) {
                *access_mask = max_bits;
 
        if (*access_mask == SEC_FLAG_MAXIMUM_ALLOWED) {
                *access_mask = max_bits;