samba.git
10 years agos4:samldb LDB module - "samldb_check_primaryGroupID" - support RID derivation from...
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 16:26:06 +0000 (18:26 +0200)]
s4:samldb LDB module - "samldb_check_primaryGroupID" - support RID derivation from "userAccountControl"

Specified in MS-SAMR 3.1.1.8.1 and probably fixes also bug #7441.

10 years agolibds:flag_mapping.c - introduce a call which maps the "userAccountControl" to the...
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 16:00:21 +0000 (18:00 +0200)]
libds:flag_mapping.c - introduce a call which maps the "userAccountControl" to the default primary group RID

10 years agolibds:flag_mapping.c - fix counter variable types
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 15:49:47 +0000 (17:49 +0200)]
libds:flag_mapping.c - fix counter variable types

10 years agos4:samldb LDB module - free the "ac" context after the delete checks
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 13:05:19 +0000 (15:05 +0200)]
s4:samldb LDB module - free the "ac" context after the delete checks

10 years agos4:samldb LDB module - simplify the message handling on add and modify operations
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 12:38:11 +0000 (14:38 +0200)]
s4:samldb LDB module - simplify the message handling on add and modify operations

We perform always only one shallow copy operation of the message on the "req"
context. This allows to free the "ac" context when we've prepared all our
changes.

10 years agos4:samldb LDB module - move "samldb_prim_group_users_check" more down to see that...
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 12:41:53 +0000 (14:41 +0200)]
s4:samldb LDB module - move "samldb_prim_group_users_check" more down to see that it is only in use by the delete operation

add and modify helpers will stay on the top of the add and modify operation
since they will likely be shared as much as possible.

10 years agos4:samldb LDB module - add a comment to mark the beginning of the extended operation...
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 12:40:17 +0000 (14:40 +0200)]
s4:samldb LDB module - add a comment to mark the beginning of the extended operation handler

10 years agos4:samldb LDB module - refactor "samldb_find_for_defaultObjectCategory" to be again...
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 11:14:36 +0000 (13:14 +0200)]
s4:samldb LDB module - refactor "samldb_find_for_defaultObjectCategory" to be again synchronous

Also to make it easier to comprehend

10 years agos4:samldb LDB module - refactor the "primaryGroupID" check on user creation
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 10:54:31 +0000 (12:54 +0200)]
s4:samldb LDB module - refactor the "primaryGroupID" check on user creation

This looks more straight-forward now.

10 years agos4:samldb LDB module - get rid of the SID context variable
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 10:53:37 +0000 (12:53 +0200)]
s4:samldb LDB module - get rid of the SID context variable

Since we get more and more rid of async stuff we don't need this in the context
anymore.

10 years agos4:samldb LDB module - use also here the real attribute denomination "sAMAccountName"
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 10:31:41 +0000 (12:31 +0200)]
s4:samldb LDB module - use also here the real attribute denomination "sAMAccountName"

Purely cosmetic - but nicer to read

10 years agos4:samldb LDB module - rename "check_SamAccountType" into "check_sAMAccountType"
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 10:29:21 +0000 (12:29 +0200)]
s4:samldb LDB module - rename "check_SamAccountType" into "check_sAMAccountType"

And a small cosmetic change.
I like to have the real attribute names in the function denominations

10 years agos4:samldb LDB module - make "samldb_check_sAMAccountName" synchronous again
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 10:25:55 +0000 (12:25 +0200)]
s4:samldb LDB module - make "samldb_check_sAMAccountName" synchronous again

To make it more understandable

10 years agos4:fsmo.py - fix an obvious typo
Matthias Dieter Wallnöfer [Sun, 12 Sep 2010 13:05:46 +0000 (15:05 +0200)]
s4:fsmo.py - fix an obvious typo

10 years agos3: Remove a nesting level in winbindd_dual_pam_chauthtok
Volker Lendecke [Sat, 11 Sep 2010 16:24:54 +0000 (18:24 +0200)]
s3: Remove a nesting level in winbindd_dual_pam_chauthtok

10 years agos4:unittest: Test wbinfo --group-info and --gid-info
Matthieu Patou [Tue, 9 Mar 2010 12:39:56 +0000 (15:39 +0300)]
s4:unittest: Test wbinfo --group-info and --gid-info

Signed-off-by: Matthias Dieter Wallnöfer <mdw@samba.org>
10 years agotest_wbinfo.c - count more possible failures
Matthias Dieter Wallnöfer [Sat, 11 Sep 2010 17:13:13 +0000 (19:13 +0200)]
test_wbinfo.c - count more possible failures

10 years agoldb:tools/cmdline.c - reorganise imports
Matthias Dieter Wallnöfer [Sat, 11 Sep 2010 15:44:43 +0000 (17:44 +0200)]
ldb:tools/cmdline.c - reorganise imports

10 years agos4:param/secrets.c - reorganise imports
Matthias Dieter Wallnöfer [Sat, 11 Sep 2010 16:01:57 +0000 (18:01 +0200)]
s4:param/secrets.c - reorganise imports

10 years agos4:rpc_server/common/common.h - introduce two forward declarations to suppress parame...
Matthias Dieter Wallnöfer [Sat, 11 Sep 2010 15:53:32 +0000 (17:53 +0200)]
s4:rpc_server/common/common.h - introduce two forward declarations to suppress parameter declaration warnings

Always Tru64 in file "param/loadparm.c" and possibly others.

10 years agoldb:tools/cmdline.c - make a counter unsigned where appropriate
Matthias Dieter Wallnöfer [Sat, 11 Sep 2010 15:43:44 +0000 (17:43 +0200)]
ldb:tools/cmdline.c - make a counter unsigned where appropriate

10 years agos4:ldb_register_samba_handlers - fix up and convert result codes to LDB/LDAP results
Matthias Dieter Wallnöfer [Sat, 11 Sep 2010 15:41:38 +0000 (17:41 +0200)]
s4:ldb_register_samba_handlers - fix up and convert result codes to LDB/LDAP results

10 years agolib/replace/wscript:Tru64 build - Better use version 600 for _XOPEN_SOURCE
Matthias Dieter Wallnöfer [Sat, 11 Sep 2010 14:50:47 +0000 (16:50 +0200)]
lib/replace/wscript:Tru64 build - Better use version 600 for _XOPEN_SOURCE

This means we request the "Single UNIX Specification, Version 3" with C99
compatibility as the Python 2.5 release on the system. This prevents
redefinitions with different values.

> [ 451/1918] Compiling scripting/python/pyglue.c
> cc: Warning: /usr/local/include/python2.5/pyconfig.h, line 951: The redefinition of the macro "_XOPEN_SOURCE" conflicts with a current definition because the replacement lists differ.  The redefinition is now in effect. (macroredef)
> #define _XOPEN_SOURCE 600
> ----------------------^
> cc: Warning: default/source4/include/config.h, line 54: The redefinition of the macro "_XOPEN_SOURCE" conflicts with a current definition because the replacement lists differ.  The redefinition is now in effect. (macroredef)
> #define _XOPEN_SOURCE 500
> ----------------------^

10 years agos4:dcesrv_samr_GetGroupsForUser - also universal group memberships are returned here
Matthias Dieter Wallnöfer [Sat, 11 Sep 2010 12:02:11 +0000 (14:02 +0200)]
s4:dcesrv_samr_GetGroupsForUser - also universal group memberships are returned here

Tested using User Manager for Domains against Windows Server 2008.
MS-SAMR 3.1.5.9.1 is wrong in this case therefore I've informed the dochelp team.

10 years agos4-privs Fix enum privileges in LSARPC server
Andrew Bartlett [Sat, 11 Sep 2010 10:38:15 +0000 (20:38 +1000)]
s4-privs Fix enum privileges in LSARPC server

We were returning the index, not the LUID value

Andrew Bartlett

10 years agos3-auth Fix typo in comment
Andrew Bartlett [Sat, 11 Sep 2010 10:38:02 +0000 (20:38 +1000)]
s3-auth Fix typo in comment

10 years agonss-waf: use the right winbind pipe path
Andrew Tridgell [Mon, 19 Jul 2010 05:43:25 +0000 (15:43 +1000)]
nss-waf: use the right winbind pipe path

s4 uses a different location for the winbind pipe to s3

10 years agowinbind-waf: the installed name is libnss_winbind.so.2
Andrew Tridgell [Mon, 19 Jul 2010 05:42:42 +0000 (15:42 +1000)]
winbind-waf: the installed name is libnss_winbind.so.2

the .2 is what libc adds to the name for this version of the nss API

10 years agos4:gensec Put the "NTLM" string for NTLMSSP's SASL name in a header
Andrew Bartlett [Tue, 1 Jun 2010 09:12:29 +0000 (19:12 +1000)]
s4:gensec Put the "NTLM" string for NTLMSSP's SASL name in a header

10 years agos4-param: removed the lp_ varients of the functions
Andrew Tridgell [Wed, 11 Aug 2010 03:40:48 +0000 (13:40 +1000)]
s4-param: removed the lp_ varients of the functions

these made debugging much harder. We should replace these with
generated macros

10 years agos4-param: move back to auto-generation of loadparm prototypes
Andrew Tridgell [Wed, 11 Aug 2010 03:36:48 +0000 (13:36 +1000)]
s4-param: move back to auto-generation of loadparm prototypes

10 years agos4-credentials: get all attributes in cli_credentials_set_secrets()
Andrew Tridgell [Wed, 28 Jul 2010 07:30:09 +0000 (17:30 +1000)]
s4-credentials: get all attributes in cli_credentials_set_secrets()

This ensures we get whenChanged, which is needed by the s3 winbind
code to ensure we don't repeatedly try to change the password

10 years agosecurity.idl Clarify that this is not a network structure
Andrew Bartlett [Sat, 11 Sep 2010 09:42:17 +0000 (19:42 +1000)]
security.idl Clarify that this is not a network structure

10 years agolibcli/auth/schannel_state_tdb.c - fix includes
Matthias Dieter Wallnöfer [Sat, 11 Sep 2010 10:53:21 +0000 (12:53 +0200)]
libcli/auth/schannel_state_tdb.c - fix includes

Otherwise we get a "declared inside parameter list" warning.

10 years agolib/replace:wscript - additional attempt to fix the build on Tru64
Matthias Dieter Wallnöfer [Sat, 11 Sep 2010 10:15:20 +0000 (12:15 +0200)]
lib/replace:wscript - additional attempt to fix the build on Tru64

Obviously we really need both definitions ("socklen_t" has been found by
"_XOPEN_SOURCE"=500). But now FIONREAD wasn't accessible.

10 years agolibcli/security Use talloc_zero when making a struct security_token
Andrew Bartlett [Sat, 11 Sep 2010 07:00:10 +0000 (17:00 +1000)]
libcli/security Use talloc_zero when making a struct security_token

10 years agolibcli/privileges Fix comment
Andrew Bartlett [Sat, 11 Sep 2010 06:59:53 +0000 (16:59 +1000)]
libcli/privileges Fix comment

10 years agos4-privs Seperate rights and privileges
Andrew Bartlett [Sat, 11 Sep 2010 06:58:45 +0000 (16:58 +1000)]
s4-privs Seperate rights and privileges

These are related, but slightly different concepts.  The biggest difference
is that rights are not enumerated as a system-wide list.

This moves the rights to security.idl due to dependencies.

Andrew Bartlett

10 years agos3-krb5 Fix Kerberos on FreeBSD with Samba4 DCs
Andrew Bartlett [Sat, 11 Sep 2010 06:13:33 +0000 (16:13 +1000)]
s3-krb5 Fix Kerberos on FreeBSD with Samba4 DCs

The idea of this patch is: Don't support a mix of different kerberos
features.

Either we should prepare a GSSAPI (8003) checksum and mark the request as
such, or we should use the old behaviour (a normal kerberos checksum of 0 data).

Sending the GSSAPI checksum data, but without marking it as GSSAPI broke
Samba4, and seems well outside the expected behaviour, even if Windows accepts it.

Andrew Bartlett

10 years agolibcli/security Remove unused SE_NONE define
Andrew Bartlett [Fri, 3 Sep 2010 23:32:21 +0000 (09:32 +1000)]
libcli/security Remove unused SE_NONE define

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Move 'private' privileges functions to another header
Andrew Bartlett [Fri, 3 Sep 2010 23:23:12 +0000 (09:23 +1000)]
libcli/security Move 'private' privileges functions to another header

These functions work on the bitmap, and are only exposed because
the source3/ privileges storage uses the bitmap in account_policy.tdb

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-samr Explian better the use of two privileges in this call
Andrew Bartlett [Fri, 3 Sep 2010 23:18:05 +0000 (09:18 +1000)]
s3-samr Explian better the use of two privileges in this call

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Remove 'always true' return from se_priv_put_all_privileges
Andrew Bartlett [Fri, 3 Sep 2010 23:16:23 +0000 (09:16 +1000)]
libcli/security Remove 'always true' return from se_priv_put_all_privileges

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-util_sid Tidy up global struct security_token
Andrew Bartlett [Fri, 3 Sep 2010 22:37:21 +0000 (08:37 +1000)]
s3-util_sid Tidy up global struct security_token

This no longer needs to be global, and should be const.  We now also
init it with the C99 style initialisers.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos4-rpc_server Put all 'logon failure' messages at the same debug level 4
Andrew Bartlett [Fri, 3 Sep 2010 21:02:38 +0000 (07:02 +1000)]
s4-rpc_server Put all 'logon failure' messages at the same debug level 4

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/auth Failure to find the cached session key for SCHANNEL isn't level 0
Andrew Bartlett [Fri, 3 Sep 2010 21:01:38 +0000 (07:01 +1000)]
libcli/auth Failure to find the cached session key for SCHANNEL isn't level 0

This happens all the time, particularly now that we don't keep the
db around after a reboot.  Don't scare the admins with the level 0.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Add const
Andrew Bartlett [Fri, 3 Sep 2010 10:30:50 +0000 (20:30 +1000)]
s3-privs Add const

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Remove extra pointer on privilege mask
Andrew Bartlett [Fri, 3 Sep 2010 10:30:16 +0000 (20:30 +1000)]
s3-privs Remove extra pointer on privilege mask

Now that this is a scalar, this isn't required.

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privileges: add handling of both old and new formats in database
Andrew Tridgell [Fri, 3 Sep 2010 06:33:41 +0000 (16:33 +1000)]
s3-privileges: add handling of both old and new formats in database

We update privileges on a per-record basis instead of all at once, as
this maintains maximum compatibility is someone uses old tools with a
new version of Samba. The also auto-detects the byte order of the old
entries in the database, and copes with either native or reversed byte
order.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>

10 years agos4-lsa: privilege IDs should use the enum, not an int
Andrew Tridgell [Thu, 2 Sep 2010 04:15:13 +0000 (14:15 +1000)]
s4-lsa: privilege IDs should use the enum, not an int

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>

10 years agoprivileges: privilege luids are not all below 64
Andrew Tridgell [Thu, 2 Sep 2010 04:14:51 +0000 (14:14 +1000)]
privileges: privilege luids are not all below 64

the ones brought across from s3 have higher values

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>

10 years agolibcli/security Make sec_privilege_from_index() return SEC_PRIV_INVALID on failure
Andrew Bartlett [Mon, 30 Aug 2010 23:28:51 +0000 (09:28 +1000)]
libcli/security Make sec_privilege_from_index() return SEC_PRIV_INVALID on failure

This is clearer and more consistent than using a magic -1 return

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Remove unused declarations from privileges.h
Andrew Bartlett [Mon, 30 Aug 2010 23:20:39 +0000 (09:20 +1000)]
libcli/security Remove unused declarations from privileges.h

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Remove unused function
Andrew Bartlett [Mon, 30 Aug 2010 06:29:05 +0000 (16:29 +1000)]
s3-privs Remove unused function

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Overhaul PRIVILEGE_SET handling, avoid dealing with the bitmap
Andrew Bartlett [Mon, 30 Aug 2010 05:38:18 +0000 (15:38 +1000)]
s3-privs Overhaul PRIVILEGE_SET handling, avoid dealing with the bitmap

This avoids us dealing with the privilege bitmap in the LSA server, and
overhauls much of the rest of the handling to be currnet with the modern
world of talloc.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Hide the bitmap-based grant_privilege and revoke_privilege
Andrew Bartlett [Mon, 30 Aug 2010 05:27:40 +0000 (15:27 +1000)]
s3-privs Hide the bitmap-based grant_privilege and revoke_privilege

The new wrappers avoid anything but the core privileges code
dealing with the bitmap values directly.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Make privilege_enum_sids() take an LUID, not a bitmap
Andrew Bartlett [Mon, 30 Aug 2010 04:17:02 +0000 (14:17 +1000)]
s3-privs Make privilege_enum_sids() take an LUID, not a bitmap

This moves one more privileges call away from direct bitmap manipuation.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Expose sec_privilege_mask()
Andrew Bartlett [Mon, 30 Aug 2010 04:16:36 +0000 (14:16 +1000)]
libcli/security Expose sec_privilege_mask()

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security make sec_privilege_id() return SEC_PRIV_INVALID on failure.
Andrew Bartlett [Mon, 30 Aug 2010 04:00:50 +0000 (14:00 +1000)]
libcli/security make sec_privilege_id() return SEC_PRIV_INVALID on failure.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Remove unused functions and constants.
Andrew Bartlett [Mon, 30 Aug 2010 03:33:19 +0000 (13:33 +1000)]
libcli/security Remove unused functions and constants.

All the callers to these functions have been removed or reworked.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Rework access_check_object() to take two privileges
Andrew Bartlett [Mon, 30 Aug 2010 03:30:38 +0000 (13:30 +1000)]
s3-privs Rework access_check_object() to take two privileges

This allows the privileges bitmap to be used only when setting
privileges, and uses an the LUID constant for all 'does this user
have this privilege' operations.

The advantage is that we now only need one API to determine if a
token has a privilege, and much less code needs to know what type
is used for the underlying bitmap.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Rename all privilege bitmaps constants
Andrew Bartlett [Mon, 30 Aug 2010 03:28:19 +0000 (13:28 +1000)]
libcli/security Rename all privilege bitmaps constants

The idea here to to make it very clear how they differ from the
enumerated LUID values.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Rework privilege enumeration to also use new DB format
Andrew Bartlett [Mon, 30 Aug 2010 03:24:43 +0000 (13:24 +1000)]
s3-privs Rework privilege enumeration to also use new DB format

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Remove luid_to_se_priv() and luid_to_privilege_name()
Andrew Bartlett [Mon, 30 Aug 2010 03:17:48 +0000 (13:17 +1000)]
libcli/security Remove luid_to_se_priv() and luid_to_privilege_name()

These functions duplicate other functions in the merged code.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Directly manipulate the privileges bitmap.
Andrew Bartlett [Mon, 30 Aug 2010 03:14:40 +0000 (13:14 +1000)]
s3-privs Directly manipulate the privileges bitmap.

There is no longer any reason to go via the se_ functions to
manipulate this bitmap.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Add an invalid LUID privilege value
Andrew Bartlett [Mon, 30 Aug 2010 03:09:29 +0000 (13:09 +1000)]
libcli/security Add an invalid LUID privilege value

This helps code that may not want to specify any privilege

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Improve dump of privileges: Just walk the table
Andrew Bartlett [Mon, 30 Aug 2010 03:06:18 +0000 (13:06 +1000)]
libcli/security Improve dump of privileges:  Just walk the table

This removes some logic recently added that was just too smart - it
is easier to just walk the table and do a bit match here.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Convert from user_has_privileges() -> security_token_has_privilege()
Andrew Bartlett [Mon, 30 Aug 2010 03:04:27 +0000 (13:04 +1000)]
s3-privs Convert from user_has_privileges() -> security_token_has_privilege()

This new call is available in the merged privileges code, and
takes an enum as the parameter, rather than a bitmask.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Remove a pointer from grant_privilege()
Andrew Bartlett [Mon, 30 Aug 2010 02:59:38 +0000 (12:59 +1000)]
s3-privs Remove a pointer from grant_privilege()

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Remove pointer indirection from se_priv_to_privilege_set()
Andrew Bartlett [Mon, 30 Aug 2010 02:50:49 +0000 (12:50 +1000)]
s3-privs Remove pointer indirection from se_priv_to_privilege_set()

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Call security_token_set_privilege() rather than manual assignment
Andrew Bartlett [Mon, 30 Aug 2010 02:47:29 +0000 (12:47 +1000)]
s3-privs Call security_token_set_privilege() rather than manual assignment

This avoids as much direct modifiction of the bitmask as possible.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Remove a pointer indirection from revoke_privilege()
Andrew Bartlett [Mon, 30 Aug 2010 02:44:08 +0000 (12:44 +1000)]
s3-privs Remove a pointer indirection from revoke_privilege()

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Don't export privs[] as a global variable
Andrew Bartlett [Fri, 27 Aug 2010 02:19:09 +0000 (12:19 +1000)]
libcli/security Don't export privs[] as a global variable

Instead, provide access functions for the LSA and net sam callers
for the information they need.

They still only enumerate the first 8 privileges that have traditionally
been exposed.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-lsa Use sec_privilege_id() to lookup name to LUID
Andrew Bartlett [Fri, 27 Aug 2010 02:12:10 +0000 (12:12 +1000)]
s3-lsa Use sec_privilege_id() to lookup name to LUID

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Merge privilege lists from source3 and source4
Andrew Bartlett [Fri, 27 Aug 2010 01:56:37 +0000 (11:56 +1000)]
libcli/security Merge privilege lists from source3 and source4

The LSA enumeration in source3 will not show the new privileges,
but otherwise, they are now in common, and can be set by name.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Return number of entries in the old source3 list
Andrew Bartlett [Fri, 27 Aug 2010 01:52:51 +0000 (11:52 +1000)]
libcli/security Return number of entries in the old source3 list

This ensures there isn't a behaviour change when the source3 list is combined
with the longer source4 list.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/privileges Simplify get_privilege_luid() to return just the enum
Andrew Bartlett [Fri, 27 Aug 2010 01:27:57 +0000 (11:27 +1000)]
libcli/privileges Simplify get_privilege_luid() to return just the enum

As Samba only deals with the lower 32 bits of the LUID, just return those
and let the LSA layer deal with the upper 0 bits.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Don't memcpy a uint64_t value, just assign it.
Andrew Bartlett [Fri, 27 Aug 2010 01:26:20 +0000 (11:26 +1000)]
libcli/security Don't memcpy a uint64_t value, just assign it.

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Use ARRAY_SIZE() consistantly.
Andrew Bartlett [Fri, 27 Aug 2010 00:52:38 +0000 (10:52 +1000)]
libcli/security Use ARRAY_SIZE() consistantly.

This avoids the use of SE_END, and has all callers walking the
array using the same termination condition.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Fix and clarify privilege manipulation function comments
Andrew Bartlett [Fri, 27 Aug 2010 00:30:18 +0000 (10:30 +1000)]
libcli/security Fix and clarify privilege manipulation function comments

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Make the two privileges tables share a common struct definition
Andrew Bartlett [Fri, 27 Aug 2010 00:21:13 +0000 (10:21 +1000)]
libcli/security Make the two privileges tables share a common struct definition

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Move source4/ privileges code into the common libcli/security
Andrew Bartlett [Thu, 26 Aug 2010 23:35:55 +0000 (09:35 +1000)]
libcli/security Move source4/ privileges code into the common libcli/security

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Move manual prototypes to common privileges.h
Andrew Bartlett [Thu, 26 Aug 2010 23:22:31 +0000 (09:22 +1000)]
s3-privs Move manual prototypes to common privileges.h

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Inline dump_se_priv into callers now that it's just a uint64_t
Andrew Bartlett [Fri, 27 Aug 2010 00:04:05 +0000 (10:04 +1000)]
s3-privs Inline dump_se_priv into callers now that it's just a uint64_t

The previous 128 bit structure needed this helper function.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Use talloc_realloc() not TALLOC_REALLOC_ARRAY()
Andrew Bartlett [Thu, 26 Aug 2010 23:50:31 +0000 (09:50 +1000)]
libcli/security Use talloc_realloc() not TALLOC_REALLOC_ARRAY()

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Use C99 types
Andrew Bartlett [Thu, 26 Aug 2010 23:50:12 +0000 (09:50 +1000)]
libcli/security Use C99 types

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agolibcli/security Use true and false, not True and False
Andrew Bartlett [Thu, 26 Aug 2010 23:41:32 +0000 (09:41 +1000)]
libcli/security Use true and false, not True and False

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Move source3/ privileges implmentation into common
Andrew Bartlett [Thu, 26 Aug 2010 22:56:15 +0000 (08:56 +1000)]
s3-privs Move source3/ privileges implmentation into common

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Rename structure elements for greater clarity
Andrew Bartlett [Thu, 26 Aug 2010 12:49:27 +0000 (22:49 +1000)]
s3-privs Rename structure elements for greater clarity

It is important to make clear which is the LUID and which
is the Samba-only bitmap mask.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs More clarity in variable names
Andrew Bartlett [Thu, 26 Aug 2010 12:35:35 +0000 (22:35 +1000)]
s3-privs More clarity in variable names

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Rename mask -> privilege_mask to be more clear
Andrew Bartlett [Thu, 26 Aug 2010 12:30:26 +0000 (22:30 +1000)]
s3-privs Rename mask -> privilege_mask to be more clear

After SE_PRIV was removed, it became less clear what these
parameters were for.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3:auth Remove NT_USER_TOKEN
Andrew Bartlett [Thu, 26 Aug 2010 12:08:22 +0000 (22:08 +1000)]
s3:auth Remove NT_USER_TOKEN

The all UPPER case typedef is no longer the preferred Samba style
and this makes it easier to see that this is the IDL-derivied structure

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-auth Change struct nt_user_token -> struct security_token
Andrew Bartlett [Thu, 26 Aug 2010 10:04:11 +0000 (20:04 +1000)]
s3-auth Change struct nt_user_token -> struct security_token

This common structure is defined in security.idl

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-auth Change type of num_sids to uint32_t
Andrew Bartlett [Thu, 26 Aug 2010 10:54:13 +0000 (20:54 +1000)]
s3-auth Change type of num_sids to uint32_t

size_t is overkill here, and in struct security_token in the num_sids
is uint32_t.

This includes a change to the prototype of add_sid_to_array()
and add_sid_to_array_unique(), which has had a number of
consequnetial changes as I try to sort out all the callers using
a pointer to the number of sids.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agosecurity.idl Add comments
Andrew Bartlett [Thu, 26 Aug 2010 09:42:01 +0000 (19:42 +1000)]
security.idl Add comments

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agosecurity.idl Update Windows privileges list to Win2008R2
Andrew Bartlett [Thu, 26 Aug 2010 09:21:53 +0000 (19:21 +1000)]
security.idl Update Windows privileges list to Win2008R2

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos3-privs Only store low bits of luid in privileges table
Andrew Bartlett [Thu, 26 Aug 2010 09:20:32 +0000 (19:20 +1000)]
s3-privs Only store low bits of luid in privileges table

Samba only uses the low bits, and this makes the code simpler.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agos4-privs Add a lookup by index of privilages
Andrew Bartlett [Thu, 26 Aug 2010 08:38:59 +0000 (18:38 +1000)]
s4-privs Add a lookup by index of privilages

Now that privileges are no longer given luid values sequentially,
we need another way to look them up for enumeration.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agoprivs Add my Copyright
Andrew Bartlett [Thu, 26 Aug 2010 08:38:16 +0000 (18:38 +1000)]
privs Add my Copyright

Signed-off-by: Andrew Tridgell <tridge@samba.org>
10 years agosecurity.idl clarify which privilages are LUID and bitmap values
Andrew Bartlett [Thu, 26 Aug 2010 06:04:53 +0000 (16:04 +1000)]
security.idl clarify which privilages are LUID and bitmap values

Signed-off-by: Andrew Tridgell <tridge@samba.org>