Replace all uses of setXX[ug]id() and setgroups with samba_setXX[ug]id() calls.
[kai/samba.git] / source3 / lib / system_smbd.c
index 6c65f61ad7a0db0493c9074971647c4af2f7c5f3..10d7f38d528b2f6989a775200644045cd4e1ad15 100644 (file)
@@ -6,7 +6,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
@@ -15,8 +15,7 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 /* 
 */
 
 #include "includes.h"
+#include "system/passwd.h"
+#include "nsswitch/winbind_client.h"
+#include "../lib/util/setid.h"
 
 #ifndef HAVE_GETGROUPLIST
 
-static int int_compare( int *a, int *b )
+#ifdef HAVE_GETGRSET
+static int getgrouplist_getgrset(const char *user, gid_t gid, gid_t *groups,
+                                int *grpcnt)
 {
-       if ( *a == *b )
-               return 0;
-       else if ( *a < *b )
-               return -1;
-       else
-               return 1;
-}
+       char *grplist;
+       char *grp;
+       gid_t temp_gid;
+       int num_gids = 1;
+       int ret = 0;
+       long l;
 
-void remove_duplicate_gids( int *num_groups, gid_t *groups )
-{
-       int i;
-       int count = *num_groups;
+       grplist = getgrset(user);
 
-       if ( *num_groups <= 0 || !groups )
-               return;
+       DEBUG(10, ("getgrset returned %s\n", grplist));
 
-       DEBUG(8,("remove_duplicate_gids: Enter %d gids\n", *num_groups));
+       if (grplist == NULL) {
+               return -1;
+       }
 
-       qsort( groups, *num_groups, sizeof(gid_t), QSORT_CAST int_compare );
+       if (*grpcnt > 0) {
+               groups[0] = gid;
+       }
 
-       for ( i=1; i<count; ) {
-               if ( groups[i-1] == groups[i] ) {
-                       memmove( &groups[i-1], &groups[i], (count - i + 1)*sizeof(gid_t) );
+       while ((grp = strsep(&grplist, ",")) != NULL) {
+               l = strtol(grp, NULL, 10);
+               temp_gid = (gid_t) l;
+               if (temp_gid == gid) {
+                       continue;
+               }
 
-                       /* decrement the total number of groups and do not increment
-                          the loop counter */
-                       count--;
+               if (num_gids + 1 > *grpcnt) {
+                       num_gids++;
                        continue;
                }
-               i++;
+               groups[num_gids++] = temp_gid;
        }
+       free(grplist);
 
-       *num_groups = count;
+       if (num_gids > *grpcnt) {
+               ret = -1;
+       }
+       *grpcnt = num_gids;
 
-       DEBUG(8,("remove_duplicate_gids: Exit %d gids\n", *num_groups));
+       DEBUG(10, ("Found %d groups for user %s\n", *grpcnt, user));
 
-       return;
+       return ret;
 }
 
+#else /* HAVE_GETGRSET */
+
 /*
   This is a *much* faster way of getting the list of groups for a user
   without changing the current supplementary group list. The old
@@ -79,7 +90,8 @@ void remove_duplicate_gids( int *num_groups, gid_t *groups )
   NOTE!! this function only works if it is called as root!
   */
 
-static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, int *grpcnt)
+static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups,
+                                 int *grpcnt)
 {
        gid_t *gids_saved;
        int ret, ngrp_saved, num_gids;
@@ -109,7 +121,7 @@ static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, in
                return -1;
        }
 
-       if (initgroups(user, gid) != 0) {
+       if (initgroups(user, gid) == -1) {
                DEBUG(0, ("getgrouplist_internals: initgroups() failed!\n"));
                SAFE_FREE(gids_saved);
                return -1;
@@ -119,7 +131,7 @@ static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, in
           return from getgroups() */
        save_re_gid();
        set_effective_gid(gid);
-       setgid(gid);
+       samba_setgid(gid);
 
        num_gids = getgroups(0, NULL);
        if (num_gids == -1) {
@@ -140,81 +152,76 @@ static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, in
                }
                groups[0] = gid;
                *grpcnt = ret + 1;
-
-               /* remove any duplicates gids in the list */
-               remove_duplicate_gids( grpcnt, groups );
        }
 
        restore_re_gid();
 
-       if (sys_setgroups(ngrp_saved, gids_saved) != 0) {
+       if (sys_setgroups(gid, ngrp_saved, gids_saved) != 0) {
                /* yikes! */
                DEBUG(0,("ERROR: getgrouplist: failed to reset group list!\n"));
-               smb_panic("getgrouplist: failed to reset group list!\n");
-               free(gids_saved);
-               return -1;
+               smb_panic("getgrouplist: failed to reset group list!");
        }
 
        free(gids_saved);
        return ret;
 }
-#endif
+#endif /* HAVE_GETGRSET */
+#endif /* HAVE_GETGROUPLIST */
 
 static int sys_getgrouplist(const char *user, gid_t gid, gid_t *groups, int *grpcnt)
 {
        int retval;
+       bool winbind_env;
 
        DEBUG(10,("sys_getgrouplist: user [%s]\n", user));
-       
-       /* see if we should disable winbindd lookups for local users */
-       if (strchr(user, *lp_winbind_separator()) == NULL) {
-               if ( !winbind_off() )
-                       DEBUG(0,("sys_getgroup_list: Insufficient environment space for %s\n",
-                               WINBINDD_DONT_ENV));
-               else
-                       DEBUG(10,("sys_getgrouplist(): disabled winbindd for group lookup [user == %s]\n",
-                               user));
-       }
+
+       /* This is only ever called for Unix users, remote memberships are
+        * always determined by the info3 coming back from auth3 or the
+        * PAC. */
+       winbind_env = winbind_env_set();
+       (void)winbind_off();
 
 #ifdef HAVE_GETGROUPLIST
        retval = getgrouplist(user, gid, groups, grpcnt);
+#else
+#ifdef HAVE_GETGRSET
+       retval = getgrouplist_getgrset(user, gid, groups, grpcnt);
 #else
        become_root();
        retval = getgrouplist_internals(user, gid, groups, grpcnt);
        unbecome_root();
-#endif
+#endif /* HAVE_GETGRSET */
+#endif /* HAVE_GETGROUPLIST */
+
+       /* allow winbindd lookups, but only if they were not already disabled */
+       if (!winbind_env) {
+               (void)winbind_on();
+       }
 
-       /* allow winbindd lookups */
-       winbind_on();
-       
        return retval;
 }
 
-static BOOL getgroups_user(const char *user, gid_t primary_gid,
-                          gid_t **ret_groups, size_t *p_ngroups)
+bool getgroups_unix_user(TALLOC_CTX *mem_ctx, const char *user,
+                        gid_t primary_gid,
+                        gid_t **ret_groups, uint32_t *p_ngroups)
 {
-       size_t ngrp;
+       uint32_t ngrp;
        int max_grp;
        gid_t *temp_groups;
        gid_t *groups;
        int i;
 
-       max_grp = groups_max();
+       max_grp = MIN(128, groups_max());
        temp_groups = SMB_MALLOC_ARRAY(gid_t, max_grp);
        if (! temp_groups) {
                return False;
        }
 
        if (sys_getgrouplist(user, primary_gid, temp_groups, &max_grp) == -1) {
-               gid_t *groups_tmp;
-
-               groups_tmp = SMB_REALLOC_ARRAY(temp_groups, gid_t, max_grp);
-               
-               if (!groups_tmp) {
-                       SAFE_FREE(temp_groups);
+               temp_groups = SMB_REALLOC_ARRAY(temp_groups, gid_t, max_grp);
+               if (!temp_groups) {
                        return False;
                }
-               temp_groups = groups_tmp;
                
                if (sys_getgrouplist(user, primary_gid,
                                     temp_groups, &max_grp) == -1) {
@@ -229,51 +236,21 @@ static BOOL getgroups_user(const char *user, gid_t primary_gid,
        groups = NULL;
 
        /* Add in primary group first */
-       add_gid_to_array_unique(NULL, primary_gid, &groups, &ngrp);
+       if (!add_gid_to_array_unique(mem_ctx, primary_gid, &groups, &ngrp)) {
+               SAFE_FREE(temp_groups);
+               return False;
+       }
 
-       for (i=0; i<max_grp; i++)
-               add_gid_to_array_unique(NULL, temp_groups[i], &groups, &ngrp);
+       for (i=0; i<max_grp; i++) {
+               if (!add_gid_to_array_unique(mem_ctx, temp_groups[i],
+                                       &groups, &ngrp)) {
+                       SAFE_FREE(temp_groups);
+                       return False;
+               }
+       }
 
        *p_ngroups = ngrp;
        *ret_groups = groups;
        SAFE_FREE(temp_groups);
        return True;
 }
-
-NTSTATUS pdb_default_enum_group_memberships(struct pdb_methods *methods,
-                                           const char *username,
-                                           gid_t primary_gid,
-                                           DOM_SID **pp_sids,
-                                           gid_t **pp_gids,
-                                           size_t *p_num_groups)
-{
-       size_t i;
-
-       if (!getgroups_user(username, primary_gid, pp_gids, p_num_groups)) {
-               return NT_STATUS_NO_SUCH_USER;
-       }
-
-       if (*p_num_groups == 0) {
-               smb_panic("primary group missing");
-       }
-
-       *pp_sids = SMB_MALLOC_ARRAY(DOM_SID, *p_num_groups);
-
-       if (*pp_sids == NULL) {
-               SAFE_FREE(pp_gids);
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       for (i=0; i<*p_num_groups; i++) {
-               if (!NT_STATUS_IS_OK(gid_to_sid(&(*pp_sids)[i], (*pp_gids)[i]))) {
-                       DEBUG(1, ("get_user_groups: failed to convert "
-                                 "gid %ld to a sid!\n", 
-                                 (long int)(*pp_gids)[i+1]));
-                       SAFE_FREE(*pp_sids);
-                       SAFE_FREE(*pp_gids);
-                       return NT_STATUS_NO_SUCH_USER;
-               }
-       }
-
-       return NT_STATUS_OK;
-}