Correctly check for errors in strlower_m() returns.

[kai/samba.git] / source3 / lib / system_smbd.c

diff --git a/source3/lib/system_smbd.c b/source3/lib/system_smbd.c
index 5eda37d90345f868c9ca1b73c593fd4ed8abdb2f..10d7f38d528b2f6989a775200644045cd4e1ad15 100644 (file)
--- a/source3/lib/system_smbd.c
+++ b/source3/lib/system_smbd.c
@@ -6,7 +6,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by

-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or

    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,


@@ -15,8 +15,7 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License

-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.

 */
 
 /* 
 */
 
 /* 


@@ -25,21 +24,77 @@
 */
 
 #include "includes.h"
 */
 
 #include "includes.h"

+#include "system/passwd.h"
+#include "nsswitch/winbind_client.h"
+#include "../lib/util/setid.h"

 
 #ifndef HAVE_GETGROUPLIST
 
 #ifndef HAVE_GETGROUPLIST

+
+#ifdef HAVE_GETGRSET
+static int getgrouplist_getgrset(const char *user, gid_t gid, gid_t *groups,
+                                int *grpcnt)
+{
+       char *grplist;
+       char *grp;
+       gid_t temp_gid;
+       int num_gids = 1;
+       int ret = 0;
+       long l;
+
+       grplist = getgrset(user);
+
+       DEBUG(10, ("getgrset returned %s\n", grplist));
+
+       if (grplist == NULL) {
+               return -1;
+       }
+
+       if (*grpcnt > 0) {
+               groups[0] = gid;
+       }
+
+       while ((grp = strsep(&grplist, ",")) != NULL) {
+               l = strtol(grp, NULL, 10);
+               temp_gid = (gid_t) l;
+               if (temp_gid == gid) {
+                       continue;
+               }
+
+               if (num_gids + 1 > *grpcnt) {
+                       num_gids++;
+                       continue;
+               }
+               groups[num_gids++] = temp_gid;
+       }
+       free(grplist);
+
+       if (num_gids > *grpcnt) {
+               ret = -1;
+       }
+       *grpcnt = num_gids;
+
+       DEBUG(10, ("Found %d groups for user %s\n", *grpcnt, user));
+
+       return ret;
+}
+
+#else /* HAVE_GETGRSET */
+

 /*
   This is a *much* faster way of getting the list of groups for a user
 /*
   This is a *much* faster way of getting the list of groups for a user

-  without changing the current supplemenrary group list. The old
+  without changing the current supplementary group list. The old

   method used getgrent() which could take 20 minutes on a really big
   network with hundeds of thousands of groups and users. The new method
   takes a couple of seconds.
 
   NOTE!! this function only works if it is called as root!
   */
   method used getgrent() which could take 20 minutes on a really big
   network with hundeds of thousands of groups and users. The new method
   takes a couple of seconds.
 
   NOTE!! this function only works if it is called as root!
   */

-static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, int *grpcnt)
+
+static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups,
+                                 int *grpcnt)

 {
        gid_t *gids_saved;
 {
        gid_t *gids_saved;

-       int ret, ngrp_saved;
+       int ret, ngrp_saved, num_gids;

 
        if (non_root_mode()) {
                *grpcnt = 0;
 
        if (non_root_mode()) {
                *grpcnt = 0;


@@ -52,8 +107,8 @@ static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, in
                /* this shouldn't happen */
                return -1;
        }
                /* this shouldn't happen */
                return -1;
        }

-       
-       gids_saved = (gid_t *)malloc(sizeof(gid_t) * (ngrp_saved+1));
+
+       gids_saved = SMB_MALLOC_ARRAY(gid_t, ngrp_saved+1);

        if (!gids_saved) {
                errno = ENOMEM;
                return -1;
        if (!gids_saved) {
                errno = ENOMEM;
                return -1;


@@ -61,13 +116,14 @@ static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, in
 
        ngrp_saved = getgroups(ngrp_saved, gids_saved);
        if (ngrp_saved == -1) {
 
        ngrp_saved = getgroups(ngrp_saved, gids_saved);
        if (ngrp_saved == -1) {

-               free(gids_saved);
+               SAFE_FREE(gids_saved);

                /* very strange! */
                return -1;
        }
 
                /* very strange! */
                return -1;
        }
 

-       if (initgroups(user, gid) != 0) {
-               free(gids_saved);
+       if (initgroups(user, gid) == -1) {
+               DEBUG(0, ("getgrouplist_internals: initgroups() failed!\n"));
+               SAFE_FREE(gids_saved);

                return -1;
        }
 
                return -1;
        }
 


@@ -75,37 +131,126 @@ static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, in
           return from getgroups() */
        save_re_gid();
        set_effective_gid(gid);
           return from getgroups() */
        save_re_gid();
        set_effective_gid(gid);

-       setgid(gid);
+       samba_setgid(gid);
+
+       num_gids = getgroups(0, NULL);
+       if (num_gids == -1) {
+               SAFE_FREE(gids_saved);
+               /* very strange! */
+               return -1;
+       }

 
 

-       ret = getgroups(*grpcnt, groups);
-       if (ret >= 0) {
-               *grpcnt = ret;
+       if (num_gids + 1 > *grpcnt) {
+               *grpcnt = num_gids + 1;
+               ret = -1;
+       } else {
+               ret = getgroups(*grpcnt - 1, &groups[1]);
+               if (ret < 0) {
+                       SAFE_FREE(gids_saved);
+                       /* very strange! */
+                       return -1;
+               }
+               groups[0] = gid;
+               *grpcnt = ret + 1;

        }
 
        restore_re_gid();
 
        }
 
        restore_re_gid();
 

-       if (setgroups(ngrp_saved, gids_saved) != 0) {
+       if (sys_setgroups(gid, ngrp_saved, gids_saved) != 0) {

                /* yikes! */
                DEBUG(0,("ERROR: getgrouplist: failed to reset group list!\n"));
                /* yikes! */
                DEBUG(0,("ERROR: getgrouplist: failed to reset group list!\n"));

-               smb_panic("getgrouplist: failed to reset group list!\n");
-               free(gids_saved);
-               return -1;
+               smb_panic("getgrouplist: failed to reset group list!");

        }
 
        free(gids_saved);
        return ret;
 }
        }
 
        free(gids_saved);
        return ret;
 }

-#endif
+#endif /* HAVE_GETGRSET */
+#endif /* HAVE_GETGROUPLIST */

 
 

-int sys_getgrouplist(const char *user, gid_t gid, gid_t *groups, int *grpcnt)
+static int sys_getgrouplist(const char *user, gid_t gid, gid_t *groups, int *grpcnt)

 {
 {

+       int retval;
+       bool winbind_env;
+
+       DEBUG(10,("sys_getgrouplist: user [%s]\n", user));
+
+       /* This is only ever called for Unix users, remote memberships are
+        * always determined by the info3 coming back from auth3 or the
+        * PAC. */
+       winbind_env = winbind_env_set();
+       (void)winbind_off();
+

 #ifdef HAVE_GETGROUPLIST
 #ifdef HAVE_GETGROUPLIST

-       return getgrouplist(user, gid, groups, grpcnt);
+       retval = getgrouplist(user, gid, groups, grpcnt);
+#else
+#ifdef HAVE_GETGRSET
+       retval = getgrouplist_getgrset(user, gid, groups, grpcnt);

 #else
 #else

-       int retval;

        become_root();
        retval = getgrouplist_internals(user, gid, groups, grpcnt);
        unbecome_root();
        become_root();
        retval = getgrouplist_internals(user, gid, groups, grpcnt);
        unbecome_root();

+#endif /* HAVE_GETGRSET */
+#endif /* HAVE_GETGROUPLIST */
+
+       /* allow winbindd lookups, but only if they were not already disabled */
+       if (!winbind_env) {
+               (void)winbind_on();
+       }
+

        return retval;
        return retval;

-#endif
+}
+
+bool getgroups_unix_user(TALLOC_CTX *mem_ctx, const char *user,
+                        gid_t primary_gid,
+                        gid_t **ret_groups, uint32_t *p_ngroups)
+{
+       uint32_t ngrp;
+       int max_grp;
+       gid_t *temp_groups;
+       gid_t *groups;
+       int i;
+
+       max_grp = MIN(128, groups_max());
+       temp_groups = SMB_MALLOC_ARRAY(gid_t, max_grp);
+       if (! temp_groups) {
+               return False;
+       }
+
+       if (sys_getgrouplist(user, primary_gid, temp_groups, &max_grp) == -1) {
+               temp_groups = SMB_REALLOC_ARRAY(temp_groups, gid_t, max_grp);
+               if (!temp_groups) {
+                       return False;
+               }
+               
+               if (sys_getgrouplist(user, primary_gid,
+                                    temp_groups, &max_grp) == -1) {
+                       DEBUG(0, ("get_user_groups: failed to get the unix "
+                                 "group list\n"));
+                       SAFE_FREE(temp_groups);
+                       return False;
+               }
+       }
+       
+       ngrp = 0;
+       groups = NULL;
+
+       /* Add in primary group first */
+       if (!add_gid_to_array_unique(mem_ctx, primary_gid, &groups, &ngrp)) {
+               SAFE_FREE(temp_groups);
+               return False;
+       }
+
+       for (i=0; i<max_grp; i++) {
+               if (!add_gid_to_array_unique(mem_ctx, temp_groups[i],
+                                       &groups, &ngrp)) {
+                       SAFE_FREE(temp_groups);
+                       return False;
+               }
+       }
+
+       *p_ngroups = ngrp;
+       *ret_groups = groups;
+       SAFE_FREE(temp_groups);
+       return True;

 }
 }