This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "system/passwd.h"
#include "auth/auth.h"
#include "ntvfs/ntvfs.h"
-#include "dsdb/samdb/samdb.h"
+#include "libcli/wbclient/wbclient.h"
+#define TEVENT_DEPRECATED
+#include <tevent.h>
struct unixuid_private {
- struct sidmap_context *sidmap;
+ struct wbc_context *wbc_ctx;
struct unix_sec_ctx *last_sec_ctx;
struct security_token *last_token;
};
return NT_STATUS_OK;
}
+static int unixuid_nesting_level;
+
+/*
+ called at the start and end of a tevent nesting loop. Needs to save/restore
+ unix security context
+ */
+static int unixuid_event_nesting_hook(struct tevent_context *ev,
+ void *private_data,
+ uint32_t level,
+ bool begin,
+ void *stack_ptr,
+ const char *location)
+{
+ struct unix_sec_ctx *sec_ctx;
+
+ if (unixuid_nesting_level == 0) {
+ /* we don't need to do anything unless we are nested
+ inside of a call in this module */
+ return 0;
+ }
+
+ if (begin) {
+ sec_ctx = save_unix_security(ev);
+ if (sec_ctx == NULL) {
+ DEBUG(0,("%s: Failed to save security context\n", location));
+ return -1;
+ }
+ *(struct unix_sec_ctx **)stack_ptr = sec_ctx;
+ if (seteuid(0) != 0 || setegid(0) != 0) {
+ DEBUG(0,("%s: Failed to change to root\n", location));
+ return -1;
+ }
+ } else {
+ /* called when we come out of a nesting level */
+ NTSTATUS status;
+
+ sec_ctx = *(struct unix_sec_ctx **)stack_ptr;
+ if (sec_ctx == NULL) {
+ /* this happens the first time this function
+ is called, as we install the hook while
+ inside an event in unixuid_connect() */
+ return 0;
+ }
+
+ sec_ctx = talloc_get_type_abort(sec_ctx, struct unix_sec_ctx);
+ status = set_unix_security(sec_ctx);
+ talloc_free(sec_ctx);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(0,("%s: Failed to revert security context (%s)\n",
+ location, nt_errstr(status)));
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+
/*
form a unix_sec_ctx from the current security_token
*/
struct security_token *token,
struct unix_sec_ctx **sec)
{
- struct unixuid_private *private = ntvfs->private_data;
+ struct unixuid_private *priv = ntvfs->private_data;
int i;
NTSTATUS status;
+ struct id_mapping *ids;
+ struct composite_context *ctx;
*sec = talloc(req, struct unix_sec_ctx);
/* we can't do unix security without a user and group */
return NT_STATUS_ACCESS_DENIED;
}
- status = sidmap_sid_to_unixuid(private->sidmap,
- token->user_sid, &(*sec)->uid);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
+ ids = talloc_array(req, struct id_mapping, token->num_sids);
+ NT_STATUS_HAVE_NO_MEMORY(ids);
- status = sidmap_sid_to_unixgid(private->sidmap,
- token->group_sid, &(*sec)->gid);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
+ ids[0].unixid = NULL;
+ ids[0].sid = token->user_sid;
+ ids[0].status = NT_STATUS_NONE_MAPPED;
+
+ ids[1].unixid = NULL;
+ ids[1].sid = token->group_sid;
+ ids[1].status = NT_STATUS_NONE_MAPPED;
(*sec)->ngroups = token->num_sids - 2;
(*sec)->groups = talloc_array(*sec, gid_t, (*sec)->ngroups);
- if ((*sec)->groups == NULL) {
- return NT_STATUS_NO_MEMORY;
+ NT_STATUS_HAVE_NO_MEMORY((*sec)->groups);
+
+ for (i=0;i<(*sec)->ngroups;i++) {
+ ids[i+2].unixid = NULL;
+ ids[i+2].sid = token->sids[i+2];
+ ids[i+2].status = NT_STATUS_NONE_MAPPED;
+ }
+
+ ctx = wbc_sids_to_xids_send(priv->wbc_ctx, ids, token->num_sids, ids);
+ NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+ status = wbc_sids_to_xids_recv(ctx, &ids);
+ NT_STATUS_NOT_OK_RETURN(status);
+
+ if (ids[0].unixid->type == ID_TYPE_BOTH ||
+ ids[0].unixid->type == ID_TYPE_UID) {
+ (*sec)->uid = ids[0].unixid->id;
+ } else {
+ return NT_STATUS_INVALID_SID;
+ }
+
+ if (ids[1].unixid->type == ID_TYPE_BOTH ||
+ ids[1].unixid->type == ID_TYPE_GID) {
+ (*sec)->gid = ids[1].unixid->id;
+ } else {
+ return NT_STATUS_INVALID_SID;
}
for (i=0;i<(*sec)->ngroups;i++) {
- status = sidmap_sid_to_unixgid(private->sidmap,
- token->sids[i+2], &(*sec)->groups[i]);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
+ if (ids[i+2].unixid->type == ID_TYPE_BOTH ||
+ ids[i+2].unixid->type == ID_TYPE_GID) {
+ (*sec)->groups[i] = ids[i+2].unixid->id;
+ } else {
+ return NT_STATUS_INVALID_SID;
}
}
static NTSTATUS unixuid_setup_security(struct ntvfs_module_context *ntvfs,
struct ntvfs_request *req, struct unix_sec_ctx **sec)
{
- struct unixuid_private *private = ntvfs->private_data;
+ struct unixuid_private *priv = ntvfs->private_data;
struct security_token *token;
struct unix_sec_ctx *newsec;
NTSTATUS status;
- if (req->session_info == NULL) {
+ /* If we are asked to set up, but have not had a successful
+ * session setup or tree connect, then these may not be filled
+ * in. ACCESS_DENIED is the right error code here */
+ if (req->session_info == NULL || priv == NULL) {
return NT_STATUS_ACCESS_DENIED;
}
token = req->session_info->security_token;
- *sec = save_unix_security(req);
+ *sec = save_unix_security(ntvfs);
if (*sec == NULL) {
return NT_STATUS_NO_MEMORY;
}
- if (token == private->last_token) {
- newsec = private->last_sec_ctx;
+ if (token == priv->last_token) {
+ newsec = priv->last_sec_ctx;
} else {
status = nt_token_to_unix_security(ntvfs, req, token, &newsec);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(*sec);
return status;
}
- if (private->last_sec_ctx) {
- talloc_free(private->last_sec_ctx);
+ if (priv->last_sec_ctx) {
+ talloc_free(priv->last_sec_ctx);
}
- private->last_sec_ctx = newsec;
- private->last_token = token;
- talloc_steal(private, newsec);
+ priv->last_sec_ctx = newsec;
+ priv->last_token = token;
+ talloc_steal(priv, newsec);
}
status = set_unix_security(newsec);
if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(*sec);
return status;
}
NTSTATUS status2; \
struct unix_sec_ctx *sec; \
status = unixuid_setup_security(ntvfs, req, &sec); \
- if (NT_STATUS_IS_OK(status)) status = ntvfs_next_##op args; \
+ NT_STATUS_NOT_OK_RETURN(status); \
+ unixuid_nesting_level++; \
+ status = ntvfs_next_##op args; \
+ unixuid_nesting_level--; \
status2 = set_unix_security(sec); \
+ talloc_free(sec); \
if (!NT_STATUS_IS_OK(status2)) smb_panic("Unable to reset security context"); \
} while (0)
connect to a share - used when a tree_connect operation comes in.
*/
static NTSTATUS unixuid_connect(struct ntvfs_module_context *ntvfs,
- struct ntvfs_request *req, const char *sharename)
+ struct ntvfs_request *req, union smb_tcon *tcon)
{
- struct unixuid_private *private;
+ struct unixuid_private *priv;
NTSTATUS status;
- private = talloc(ntvfs, struct unixuid_private);
- if (!private) {
+ priv = talloc(ntvfs, struct unixuid_private);
+ if (!priv) {
return NT_STATUS_NO_MEMORY;
}
- private->sidmap = sidmap_open(private);
- if (private->sidmap == NULL) {
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ priv->wbc_ctx = wbc_init(priv, ntvfs->ctx->msg_ctx,
+ ntvfs->ctx->event_ctx);
+ if (priv->wbc_ctx == NULL) {
+ talloc_free(priv);
+ return NT_STATUS_INTERNAL_ERROR;
}
- ntvfs->private_data = private;
- private->last_sec_ctx = NULL;
- private->last_token = NULL;
+ priv->last_sec_ctx = NULL;
+ priv->last_token = NULL;
+ ntvfs->private_data = priv;
+
+ tevent_loop_set_nesting_hook(ntvfs->ctx->event_ctx,
+ unixuid_event_nesting_hook,
+ &unixuid_nesting_level);
/* we don't use PASS_THRU_REQ here, as the connect operation runs with
root privileges. This allows the backends to setup any database
links they might need during the connect. */
- status = ntvfs_next_connect(ntvfs, req, sharename);
+ status = ntvfs_next_connect(ntvfs, req, tcon);
return status;
}
*/
static NTSTATUS unixuid_disconnect(struct ntvfs_module_context *ntvfs)
{
- struct unixuid_private *private = ntvfs->private_data;
+ struct unixuid_private *priv = ntvfs->private_data;
NTSTATUS status;
- talloc_free(private);
+ talloc_free(priv);
ntvfs->private_data = NULL;
status = ntvfs_next_disconnect(ntvfs);
static NTSTATUS unixuid_logoff(struct ntvfs_module_context *ntvfs,
struct ntvfs_request *req)
{
- struct unixuid_private *private = ntvfs->private_data;
+ struct unixuid_private *priv = ntvfs->private_data;
NTSTATUS status;
PASS_THRU_REQ(ntvfs, req, logoff, (ntvfs, req));
- private->last_token = NULL;
+ priv->last_token = NULL;
return status;
}
*/
static NTSTATUS unixuid_async_setup(struct ntvfs_module_context *ntvfs,
struct ntvfs_request *req,
- void *private)
+ void *private_data)
{
NTSTATUS status;
- PASS_THRU_REQ(ntvfs, req, async_setup, (ntvfs, req, private));
+ PASS_THRU_REQ(ntvfs, req, async_setup, (ntvfs, req, private_data));
return status;
}
change notify
*/
static NTSTATUS unixuid_notify(struct ntvfs_module_context *ntvfs,
- struct ntvfs_request *req, struct smb_notify *info)
+ struct ntvfs_request *req, union smb_notify *info)
{
NTSTATUS status;
static NTSTATUS unixuid_search_first(struct ntvfs_module_context *ntvfs,
struct ntvfs_request *req, union smb_search_first *io,
void *search_private,
- BOOL (*callback)(void *, union smb_search_data *))
+ bool (*callback)(void *, const union smb_search_data *))
{
NTSTATUS status;
static NTSTATUS unixuid_search_next(struct ntvfs_module_context *ntvfs,
struct ntvfs_request *req, union smb_search_next *io,
void *search_private,
- BOOL (*callback)(void *, union smb_search_data *))
+ bool (*callback)(void *, const union smb_search_data *))
{
NTSTATUS status;
git.samba.org / samba.git / blobdiff