source3/smbd/uid.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    uid/user handling
   5    Copyright (C) Andrew Tridgell 1992-1998
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 /* what user is current? */
  25 extern struct current_user current_user;
  26
  27 /****************************************************************************
  28  Become the guest user without changing the security context stack.
  29 ****************************************************************************/
  30
  31 BOOL change_to_guest(void)
  32 {
  33         static struct passwd *pass=NULL;
  34         static uid_t guest_uid = (uid_t)-1;
  35         static gid_t guest_gid = (gid_t)-1;
  36         static fstring guest_name;
  37
  38         if (!pass) {
  39                 pass = sys_getpwnam(lp_guestaccount());
  40                 if (!pass)
  41                         return(False);
  42                 guest_uid = pass->pw_uid;
  43                 guest_gid = pass->pw_gid;
  44                 fstrcpy(guest_name, pass->pw_name);
  45         }
  46
  47 #ifdef AIX
  48         /* MWW: From AIX FAQ patch to WU-ftpd: call initgroups before
  49            setting IDs */
  50         initgroups(guest_name, guest_gid);
  51 #endif
  52
  53         set_sec_ctx(guest_uid, guest_gid, 0, NULL, NULL);
  54
  55         current_user.conn = NULL;
  56         current_user.vuid = UID_FIELD_INVALID;
  57
  58         return True;
  59 }
  60
  61 /*******************************************************************
  62  Check if a username is OK.
  63 ********************************************************************/
  64
  65 static BOOL check_user_ok(connection_struct *conn, user_struct *vuser,int snum)
  66 {
  67         int i;
  68         for (i=0;i<conn->uid_cache.entries;i++)
  69                 if (conn->uid_cache.list[i] == vuser->uid)
  70                         return(True);
  71
  72         if (!user_ok(vuser->user.unix_name,snum))
  73                 return(False);
  74
  75         i = conn->uid_cache.entries % UID_CACHE_SIZE;
  76         conn->uid_cache.list[i] = vuser->uid;
  77
  78         if (conn->uid_cache.entries < UID_CACHE_SIZE)
  79                 conn->uid_cache.entries++;
  80
  81         return(True);
  82 }
  83
  84 /****************************************************************************
  85  Become the user of a connection number without changing the security context
  86  stack, but modify the currnet_user entries.
  87 ****************************************************************************/
  88
  89 BOOL change_to_user(connection_struct *conn, uint16 vuid)
  90 {
  91         user_struct *vuser = get_valid_user_struct(vuid);
  92         int snum;
  93         gid_t gid;
  94         uid_t uid;
  95         char group_c;
  96         BOOL must_free_token = False;
  97         NT_USER_TOKEN *token = NULL;
  98
  99         if (!conn) {
 100                 DEBUG(2,("change_to_user: Connection not open\n"));
 101                 return(False);
 102         }
 103
 104         /*
 105          * We need a separate check in security=share mode due to vuid
 106          * always being UID_FIELD_INVALID. If we don't do this then
 107          * in share mode security we are *always* changing uid's between
 108          * SMB's - this hurts performance - Badly.
 109          */
 110
 111         if((lp_security() == SEC_SHARE) && (current_user.conn == conn) &&
 112            (current_user.uid == conn->uid)) {
 113                 DEBUG(4,("change_to_user: Skipping user change - already user\n"));
 114                 return(True);
 115         } else if ((current_user.conn == conn) &&
 116                    (vuser != 0) && (current_user.vuid == vuid) &&
 117                    (current_user.uid == vuser->uid)) {
 118                 DEBUG(4,("change_to_user: Skipping user change - already user\n"));
 119                 return(True);
 120         }
 121
 122         snum = SNUM(conn);
 123
 124         if((vuser != NULL) && !check_user_ok(conn, vuser, snum))
 125                 return False;
 126
 127         if (conn->force_user ||
 128                 conn->admin_user ||
 129             (lp_security() == SEC_SHARE)) {
 130                 uid = conn->uid;
 131                 gid = conn->gid;
 132                 current_user.groups = conn->groups;
 133                 current_user.ngroups = conn->ngroups;
 134                 token = conn->nt_user_token;
 135         } else {
 136                 if (!vuser) {
 137                         DEBUG(2,("change_to_user: Invalid vuid used %d\n",vuid));
 138                         return(False);
 139                 }
 140                 uid = vuser->uid;
 141                 gid = vuser->gid;
 142                 current_user.ngroups = vuser->n_groups;
 143                 current_user.groups  = vuser->groups;
 144                 token = vuser->nt_user_token;
 145         }
 146
 147         /*
 148          * See if we should force group for this service.
 149          * If so this overrides any group set in the force
 150          * user code.
 151          */
 152
 153         if((group_c = *lp_force_group(snum))) {
 154                 BOOL is_guest = False;
 155
 156                 if(group_c == '+') {
 157
 158                         /*
 159                          * Only force group if the user is a member of
 160                          * the service group. Check the group memberships for
 161                          * this user (we already have this) to
 162                          * see if we should force the group.
 163                          */
 164
 165                         int i;
 166                         for (i = 0; i < current_user.ngroups; i++) {
 167                                 if (current_user.groups[i] == conn->gid) {
 168                                         gid = conn->gid;
 169                                         break;
 170                                 }
 171                         }
 172                 } else {
 173                         gid = conn->gid;
 174                 }
 175
 176                 /*
 177                  * We've changed the group list in the token - we must
 178                  * re-create it.
 179                  */
 180
 181                 if (vuser && vuser->guest)
 182                         is_guest = True;
 183
 184                 token = create_nt_token(uid, gid, current_user.ngroups, current_user.groups, is_guest, NULL);
 185                 must_free_token = True;
 186         }
 187
 188         set_sec_ctx(uid, gid, current_user.ngroups, current_user.groups, token);
 189
 190         /*
 191          * Free the new token (as set_sec_ctx copies it).
 192          */
 193
 194         if (must_free_token)
 195                 delete_nt_token(&token);
 196
 197         current_user.conn = conn;
 198         current_user.vuid = vuid;
 199
 200         DEBUG(5,("change_to_user uid=(%d,%d) gid=(%d,%d)\n",
 201                  (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
 202
 203         return(True);
 204 }
 205
 206 /****************************************************************************
 207  Go back to being root without changing the security context stack,
 208  but modify the current_user entries.
 209 ****************************************************************************/
 210
 211 BOOL change_to_root_user(void)
 212 {
 213         set_root_sec_ctx();
 214
 215         DEBUG(5,("change_to_root_user: now uid=(%d,%d) gid=(%d,%d)\n",
 216                 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
 217
 218         current_user.conn = NULL;
 219         current_user.vuid = UID_FIELD_INVALID;
 220
 221         return(True);
 222 }
 223
 224 /****************************************************************************
 225  Become the user of an authenticated connected named pipe.
 226  When this is called we are currently running as the connection
 227  user. Doesn't modify current_user.
 228 ****************************************************************************/
 229
 230 BOOL become_authenticated_pipe_user(pipes_struct *p)
 231 {
 232         if (!push_sec_ctx())
 233                 return False;
 234
 235         set_sec_ctx(p->pipe_user.uid, p->pipe_user.gid,
 236                     p->pipe_user.ngroups, p->pipe_user.groups, p->pipe_user.nt_user_token);
 237
 238         return True;
 239 }
 240
 241 /****************************************************************************
 242  Unbecome the user of an authenticated connected named pipe.
 243  When this is called we are running as the authenticated pipe
 244  user and need to go back to being the connection user. Doesn't modify
 245  current_user.
 246 ****************************************************************************/
 247
 248 BOOL unbecome_authenticated_pipe_user(void)
 249 {
 250         return pop_sec_ctx();
 251 }
 252
 253 /****************************************************************************
 254  Utility functions used by become_xxx/unbecome_xxx.
 255 ****************************************************************************/
 256
 257 struct conn_ctx {
 258         connection_struct *conn;
 259         uint16 vuid;
 260 };
 261
 262 /* A stack of current_user connection contexts. */
 263
 264 static struct conn_ctx conn_ctx_stack[MAX_SEC_CTX_DEPTH];
 265 static int conn_ctx_stack_ndx;
 266
 267 static void push_conn_ctx(void)
 268 {
 269         struct conn_ctx *ctx_p;
 270
 271         /* Check we don't overflow our stack */
 272
 273         if (conn_ctx_stack_ndx == MAX_SEC_CTX_DEPTH) {
 274                 DEBUG(0, ("Connection context stack overflow!\n"));
 275                 smb_panic("Connection context stack overflow!\n");
 276         }
 277
 278         /* Store previous user context */
 279         ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 280
 281         ctx_p->conn = current_user.conn;
 282         ctx_p->vuid = current_user.vuid;
 283
 284         DEBUG(3, ("push_conn_ctx(%u) : conn_ctx_stack_ndx = %d\n",
 285                 (unsigned int)ctx_p->vuid, conn_ctx_stack_ndx ));
 286
 287         conn_ctx_stack_ndx++;
 288 }
 289
 290 static void pop_conn_ctx(void)
 291 {
 292         struct conn_ctx *ctx_p;
 293
 294         /* Check for stack underflow. */
 295
 296         if (conn_ctx_stack_ndx == 0) {
 297                 DEBUG(0, ("Connection context stack underflow!\n"));
 298                 smb_panic("Connection context stack underflow!\n");
 299         }
 300
 301         conn_ctx_stack_ndx--;
 302         ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 303
 304         current_user.conn = ctx_p->conn;
 305         current_user.vuid = ctx_p->vuid;
 306
 307         ctx_p->conn = NULL;
 308         ctx_p->vuid = UID_FIELD_INVALID;
 309 }
 310
 311 void init_conn_ctx(void)
 312 {
 313     int i;
 314
 315     /* Initialise connection context stack */
 316         for (i = 0; i < MAX_SEC_CTX_DEPTH; i++) {
 317                 conn_ctx_stack[i].conn = NULL;
 318                 conn_ctx_stack[i].vuid = UID_FIELD_INVALID;
 319     }
 320 }
 321
 322 /****************************************************************************
 323  Temporarily become a root user.  Must match with unbecome_root(). Saves and
 324  restores the connection context.
 325 ****************************************************************************/
 326
 327 void become_root(void)
 328 {
 329         push_sec_ctx();
 330         push_conn_ctx();
 331         set_root_sec_ctx();
 332 }
 333
 334 /* Unbecome the root user */
 335
 336 void unbecome_root(void)
 337 {
 338         pop_sec_ctx();
 339         pop_conn_ctx();
 340 }
 341
 342 /****************************************************************************
 343  Push the current security context then force a change via change_to_user().
 344  Saves and restores the connection context.
 345 ****************************************************************************/
 346
 347 BOOL become_user(connection_struct *conn, uint16 vuid)
 348 {
 349         if (!push_sec_ctx())
 350                 return False;
 351
 352         push_conn_ctx();
 353
 354         if (!change_to_user(conn, vuid)) {
 355                 pop_sec_ctx();
 356                 pop_conn_ctx();
 357                 return False;
 358         }
 359
 360         return True;
 361 }
 362
 363 BOOL unbecome_user(void)
 364 {
 365         pop_sec_ctx();
 366         pop_conn_ctx();
 367         return True;
 368 }
 369
 370 /*****************************************************************
 371  Convert the suplimentary SIDs returned in a netlogon into UNIX
 372  group gid_t's. Add to the total group array.
 373 *****************************************************************/
 374
 375 void add_supplementary_nt_login_groups(int *n_groups, gid_t **pp_groups, NT_USER_TOKEN **pptok)
 376 {
 377         int total_groups;
 378         int current_n_groups = *n_groups;
 379         gid_t *final_groups = NULL;
 380         size_t i;
 381         NT_USER_TOKEN *ptok = *pptok;
 382         NT_USER_TOKEN *new_tok = NULL;
 383
 384         if (!ptok || (ptok->num_sids == 0))
 385                 return;
 386
 387         new_tok = dup_nt_token(ptok);
 388         if (!new_tok) {
 389                 DEBUG(0,("add_supplementary_nt_login_groups: Failed to malloc new token\n"));
 390                 return;
 391         }
 392         /* Leave the allocated space but empty the number of SIDs. */
 393         new_tok->num_sids = 0;
 394
 395         total_groups = current_n_groups + ptok->num_sids;
 396
 397         final_groups = (gid_t *)malloc(total_groups * sizeof(gid_t));
 398         if (!final_groups) {
 399                 DEBUG(0,("add_supplementary_nt_login_groups: Failed to malloc new groups.\n"));
 400                 delete_nt_token(&new_tok);
 401                 return;
 402         }
 403
 404         memcpy(final_groups, *pp_groups, current_n_groups * sizeof(gid_t));
 405         for (i = 0; i < ptok->num_sids; i++) {
 406                 enum SID_NAME_USE sid_type;
 407                 gid_t new_grp;
 408
 409                 if (sid_to_gid(&ptok->user_sids[i], &new_grp, &sid_type)) {
 410                         /*
 411                          * Don't add the gid_t if it is already in the current group
 412                          * list. Some UNIXen don't like the same group more than once.
 413                          */
 414                         int j;
 415
 416                         for (j = 0; j < current_n_groups; j++)
 417                                 if (final_groups[j] == new_grp)
 418                                         break;
 419
 420                         if ( j == current_n_groups) {
 421                                 /* Group not already present. */
 422                                 final_groups[current_n_groups++] = new_grp;
 423                         }
 424                 } else {
 425                         /* SID didn't map. Copy to the new token to be saved. */
 426                         sid_copy(&new_tok->user_sids[new_tok->num_sids++], &ptok->user_sids[i]);
 427                 }
 428         }
 429
 430         SAFE_FREE(*pp_groups);
 431         *pp_groups = final_groups;
 432         *n_groups = current_n_groups;
 433
 434         /* Replace the old token with the truncated one. */
 435         delete_nt_token(&ptok);
 436         *pptok = new_tok;
 437 }
 438
 439 /*****************************************************************
 440  *THE CANONICAL* convert name to SID function.
 441  Tries winbind first - then uses local lookup.
 442 *****************************************************************/
 443
 444 BOOL lookup_name(const char *name, DOM_SID *psid, enum SID_NAME_USE *name_type)
 445 {
 446         extern pstring global_myname;
 447         extern fstring global_myworkgroup;
 448         fstring sid;
 449         char *sep = lp_winbind_separator();
 450
 451         *name_type = SID_NAME_UNKNOWN;
 452
 453         if (!winbind_lookup_name(name, psid, name_type) || (*name_type != SID_NAME_USER) ) {
 454                 BOOL ret = False;
 455
 456                 DEBUG(10, ("lookup_name: winbind lookup for %s failed - trying local\n", name));
 457
 458                 /* If we are looking up a domain user, make sure it is
 459                    for the local machine only */
 460
 461                 if (strchr_m(name, sep[0]) || strchr_m(name, '\\')) {
 462                         fstring domain, username;
 463
 464                         split_domain_name(name, domain, username);
 465
 466                         switch (lp_server_role()) {
 467                                 case ROLE_DOMAIN_PDC:
 468                                 case ROLE_DOMAIN_BDC:
 469                                         if (strequal(domain, global_myworkgroup)) {
 470                                                 fstrcpy(domain, global_myname);
 471                                                 ret = local_lookup_name(domain, username, psid, name_type);
 472                                         }
 473                                         /* No break is deliberate here. JRA. */
 474                                 default:
 475                                         if (strcasecmp(global_myname, domain) != 0) {
 476                                                 DEBUG(5, ("lookup_name: domain %s is not local\n", domain));
 477                                                 ret = local_lookup_name(global_myname, username, psid, name_type);
 478                                         }
 479                         }
 480                 } else {
 481                         ret = local_lookup_name(global_myname, name, psid, name_type);
 482                 }
 483
 484                 if (ret) {
 485                         DEBUG(10,
 486                               ("lookup_name: (local) %s -> SID %s (type %u)\n",
 487                                name, sid_to_string(sid,psid),
 488                                (unsigned int)*name_type ));
 489                 } else {
 490                         DEBUG(10,("lookup name: (local) %s failed.\n", name));
 491                 }
 492
 493                 return ret;
 494         }
 495
 496         DEBUG(10,("lookup_name (winbindd): %s -> SID %s (type %u)\n",
 497                   name, sid_to_string(sid, psid),
 498                   (unsigned int)*name_type));
 499         return True;
 500 }
 501
 502 /*****************************************************************
 503  *THE CANONICAL* convert SID to name function.
 504  Tries winbind first - then uses local lookup.
 505 *****************************************************************/
 506
 507 BOOL lookup_sid(DOM_SID *sid, fstring dom_name, fstring name, enum SID_NAME_USE *name_type)
 508 {
 509         if (!name_type)
 510                 return False;
 511
 512         *name_type = SID_NAME_UNKNOWN;
 513
 514         /* Check if this is our own sid.  This should perhaps be done by
 515            winbind?  For the moment handle it here. */
 516
 517         if (sid->num_auths == 5) {
 518                 DOM_SID tmp_sid;
 519                 uint32 rid;
 520
 521                 sid_copy(&tmp_sid, sid);
 522                 sid_split_rid(&tmp_sid, &rid);
 523
 524                 if (sid_equal(&global_sam_sid, &tmp_sid)) {
 525
 526                         return map_domain_sid_to_name(&tmp_sid, dom_name) &&
 527                                 local_lookup_rid(rid, name, name_type);
 528                 }
 529         }
 530
 531         if (!winbind_lookup_sid(sid, dom_name, name, name_type)) {
 532                 fstring sid_str;
 533                 DOM_SID tmp_sid;
 534                 uint32 rid;
 535
 536                 DEBUG(10,("lookup_sid: winbind lookup for SID %s failed - trying local.\n", sid_to_string(sid_str, sid) ));
 537
 538                 sid_copy(&tmp_sid, sid);
 539                 sid_split_rid(&tmp_sid, &rid);
 540                 return map_domain_sid_to_name(&tmp_sid, dom_name) &&
 541                                 lookup_known_rid(&tmp_sid, rid, name, name_type);
 542         }
 543         return True;
 544 }
 545
 546 /*****************************************************************
 547  *THE CANONICAL* convert uid_t to SID function.
 548  Tries winbind first - then uses local lookup.
 549  Returns SID pointer.
 550 *****************************************************************/
 551
 552 DOM_SID *uid_to_sid(DOM_SID *psid, uid_t uid)
 553 {
 554         fstring sid;
 555
 556         if (!winbind_uid_to_sid(psid, uid)) {
 557                 DEBUG(10,("uid_to_sid: winbind lookup for uid %u failed - trying local.\n", (unsigned int)uid ));
 558
 559                 return local_uid_to_sid(psid, uid);
 560         }
 561
 562         DEBUG(10,("uid_to_sid: winbindd %u -> %s\n",
 563                 (unsigned int)uid, sid_to_string(sid, psid) ));
 564
 565         return psid;
 566 }
 567
 568 /*****************************************************************
 569  *THE CANONICAL* convert gid_t to SID function.
 570  Tries winbind first - then uses local lookup.
 571  Returns SID pointer.
 572 *****************************************************************/
 573
 574 DOM_SID *gid_to_sid(DOM_SID *psid, gid_t gid)
 575 {
 576         fstring sid;
 577
 578         if (!winbind_gid_to_sid(psid, gid)) {
 579                 DEBUG(10,("gid_to_sid: winbind lookup for gid %u failed - trying local.\n", (unsigned int)gid ));
 580
 581                 return local_gid_to_sid(psid, gid);
 582         }
 583
 584         DEBUG(10,("gid_to_sid: winbindd %u -> %s\n",
 585                 (unsigned int)gid, sid_to_string(sid,psid) ));
 586
 587         return psid;
 588 }
 589
 590 /*****************************************************************
 591  *THE CANONICAL* convert SID to uid function.
 592  Tries winbind first - then uses local lookup.
 593  Returns True if this name is a user sid and the conversion
 594  was done correctly, False if not. sidtype is set by this function.
 595 *****************************************************************/
 596
 597 BOOL sid_to_uid(DOM_SID *psid, uid_t *puid, enum SID_NAME_USE *sidtype)
 598 {
 599         fstring dom_name, name, sid_str;
 600         enum SID_NAME_USE name_type;
 601
 602         *sidtype = SID_NAME_UNKNOWN;
 603
 604         /*
 605          * First we must look up the name and decide if this is a user sid.
 606          */
 607
 608         if ( (!winbind_lookup_sid(psid, dom_name, name, &name_type)) || (name_type != SID_NAME_USER) ) {
 609                 DEBUG(10,("sid_to_uid: winbind lookup for sid %s failed - trying local.\n",
 610                                 sid_to_string(sid_str, psid) ));
 611
 612                 return local_sid_to_uid(puid, psid, sidtype);
 613         }
 614
 615         /*
 616          * Ensure this is a user sid.
 617          */
 618
 619         if (name_type != SID_NAME_USER) {
 620                 DEBUG(10,("sid_to_uid: winbind lookup succeeded but SID is not a uid (%u)\n",
 621                                 (unsigned int)name_type ));
 622                 return False;
 623         }
 624
 625         *sidtype = SID_NAME_USER;
 626
 627         /*
 628          * Get the uid for this SID.
 629          */
 630
 631         if (!winbind_sid_to_uid(puid, psid)) {
 632                 DEBUG(10,("sid_to_uid: winbind lookup for sid %s failed.\n",
 633                                 sid_to_string(sid_str, psid) ));
 634                 return False;
 635         }
 636
 637         DEBUG(10,("sid_to_uid: winbindd %s -> %u\n",
 638                 sid_to_string(sid_str, psid),
 639                 (unsigned int)*puid ));
 640
 641         return True;
 642 }
 643
 644 /*****************************************************************
 645  *THE CANONICAL* convert SID to gid function.
 646  Tries winbind first - then uses local lookup.
 647  Returns True if this name is a user sid and the conversion
 648  was done correctly, False if not.
 649 *****************************************************************/
 650
 651 BOOL sid_to_gid(DOM_SID *psid, gid_t *pgid, enum SID_NAME_USE *sidtype)
 652 {
 653         fstring dom_name, name, sid_str;
 654         enum SID_NAME_USE name_type;
 655
 656         *sidtype = SID_NAME_UNKNOWN;
 657
 658         /*
 659          * First we must look up the name and decide if this is a group sid.
 660          */
 661
 662         if (!winbind_lookup_sid(psid, dom_name, name, &name_type)) {
 663                 DEBUG(10,("sid_to_gid: winbind lookup for sid %s failed - trying local.\n",
 664                                 sid_to_string(sid_str, psid) ));
 665
 666                 return local_sid_to_gid(pgid, psid, sidtype);
 667         }
 668
 669         /*
 670          * Ensure this is a group sid.
 671          */
 672
 673         if ((name_type != SID_NAME_DOM_GRP) && (name_type != SID_NAME_ALIAS) && (name_type != SID_NAME_WKN_GRP)) {
 674                 DEBUG(10,("sid_to_gid: winbind lookup succeeded but SID is not a known group (%u)\n",
 675                                 (unsigned int)name_type ));
 676
 677                 return local_sid_to_gid(pgid, psid, sidtype);
 678         }
 679
 680         *sidtype = name_type;
 681
 682         /*
 683          * Get the gid for this SID.
 684          */
 685
 686         if (!winbind_sid_to_gid(pgid, psid)) {
 687                 DEBUG(10,("sid_to_gid: winbind lookup for sid %s failed.\n",
 688                                 sid_to_string(sid_str, psid) ));
 689                 return False;
 690         }
 691
 692         DEBUG(10,("sid_to_gid: winbindd %s -> %u\n",
 693                 sid_to_string(sid_str, psid),
 694                 (unsigned int)*pgid ));
 695
 696         return True;
 697 }