This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
#ifndef HAVE_GETGROUPLIST
-static int int_compare( int *a, int *b )
-{
- if ( *a == *b )
- return 0;
- else if ( *a < *b )
- return -1;
- else
- return 1;
-}
-
-void remove_duplicate_gids( int *num_groups, gid_t *groups )
-{
- int i;
- int count = *num_groups;
-
- if ( *num_groups <= 0 || !groups )
- return;
-
- DEBUG(8,("remove_duplicate_gids: Enter %d gids\n", *num_groups));
-
- qsort( groups, *num_groups, sizeof(gid_t), QSORT_CAST int_compare );
-
- for ( i=1; i<count; ) {
- if ( groups[i-1] == groups[i] ) {
- memmove( &groups[i-1], &groups[i], (count - i + 1)*sizeof(gid_t) );
-
- /* decrement the total number of groups and do not increment
- the loop counter */
- count--;
- continue;
- }
- i++;
- }
-
- *num_groups = count;
-
- DEBUG(8,("remove_duplicate_gids: Exit %d gids\n", *num_groups));
-
- return;
-}
-
/*
This is a *much* faster way of getting the list of groups for a user
without changing the current supplementary group list. The old
NOTE!! this function only works if it is called as root!
*/
-static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, int *grpcnt)
+static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups,
+ int *grpcnt)
{
gid_t *gids_saved;
int ret, ngrp_saved, num_gids;
}
groups[0] = gid;
*grpcnt = ret + 1;
-
- /* remove any duplicates gids in the list */
- remove_duplicate_gids( grpcnt, groups );
}
restore_re_gid();
- if (sys_setgroups(ngrp_saved, gids_saved) != 0) {
+ if (sys_setgroups(gid, ngrp_saved, gids_saved) != 0) {
/* yikes! */
DEBUG(0,("ERROR: getgrouplist: failed to reset group list!\n"));
- smb_panic("getgrouplist: failed to reset group list!\n");
- free(gids_saved);
- return -1;
+ smb_panic("getgrouplist: failed to reset group list!");
}
free(gids_saved);
static int sys_getgrouplist(const char *user, gid_t gid, gid_t *groups, int *grpcnt)
{
int retval;
+ BOOL winbind_env;
DEBUG(10,("sys_getgrouplist: user [%s]\n", user));
-
- /* see if we should disable winbindd lookups for local users */
- if (strchr(user, *lp_winbind_separator()) == NULL) {
- if ( !winbind_off() )
- DEBUG(0,("sys_getgroup_list: Insufficient environment space for %s\n",
- WINBINDD_DONT_ENV));
- else
- DEBUG(10,("sys_getgrouplist(): disabled winbindd for group lookup [user == %s]\n",
- user));
- }
+
+ /* This is only ever called for Unix users, remote memberships are
+ * always determined by the info3 coming back from auth3 or the
+ * PAC. */
+ winbind_env = winbind_env_set();
+ winbind_off();
#ifdef HAVE_GETGROUPLIST
retval = getgrouplist(user, gid, groups, grpcnt);
unbecome_root();
#endif
- /* allow winbindd lookups */
- winbind_on();
-
+ /* allow winbindd lookups, but only if they were not already disabled */
+ if (!winbind_env) {
+ winbind_on();
+ }
+
return retval;
}
-BOOL getgroups_user(const char *user, gid_t primary_gid,
- gid_t **ret_groups, size_t *p_ngroups)
+BOOL getgroups_unix_user(TALLOC_CTX *mem_ctx, const char *user,
+ gid_t primary_gid,
+ gid_t **ret_groups, size_t *p_ngroups)
{
size_t ngrp;
int max_grp;
gid_t *groups;
int i;
- max_grp = groups_max();
+ max_grp = MIN(32, groups_max());
temp_groups = SMB_MALLOC_ARRAY(gid_t, max_grp);
if (! temp_groups) {
return False;
}
if (sys_getgrouplist(user, primary_gid, temp_groups, &max_grp) == -1) {
- gid_t *groups_tmp;
-
- groups_tmp = SMB_REALLOC_ARRAY(temp_groups, gid_t, max_grp);
-
- if (!groups_tmp) {
- SAFE_FREE(temp_groups);
+ temp_groups = SMB_REALLOC_ARRAY(temp_groups, gid_t, max_grp);
+ if (!temp_groups) {
return False;
}
- temp_groups = groups_tmp;
if (sys_getgrouplist(user, primary_gid,
temp_groups, &max_grp) == -1) {
groups = NULL;
/* Add in primary group first */
- add_gid_to_array_unique(NULL, primary_gid, &groups, &ngrp);
+ if (!add_gid_to_array_unique(mem_ctx, primary_gid, &groups, &ngrp)) {
+ SAFE_FREE(temp_groups);
+ return False;
+ }
- for (i=0; i<max_grp; i++)
- add_gid_to_array_unique(NULL, temp_groups[i], &groups, &ngrp);
+ for (i=0; i<max_grp; i++) {
+ if (!add_gid_to_array_unique(mem_ctx, temp_groups[i],
+ &groups, &ngrp)) {
+ SAFE_FREE(temp_groups);
+ return False;
+ }
+ }
*p_ngroups = ngrp;
*ret_groups = groups;
SAFE_FREE(temp_groups);
return True;
}
-
-NTSTATUS pdb_default_enum_group_memberships(struct pdb_methods *methods,
- const char *username,
- gid_t primary_gid,
- DOM_SID **pp_sids,
- gid_t **pp_gids,
- size_t *p_num_groups)
-{
- size_t i;
-
- if (!getgroups_user(username, primary_gid, pp_gids, p_num_groups)) {
- return NT_STATUS_NO_SUCH_USER;
- }
-
- if (*p_num_groups == 0) {
- smb_panic("primary group missing");
- }
-
- *pp_sids = SMB_MALLOC_ARRAY(DOM_SID, *p_num_groups);
-
- if (*pp_sids == NULL) {
- SAFE_FREE(pp_gids);
- return NT_STATUS_NO_MEMORY;
- }
-
- for (i=0; i<*p_num_groups; i++) {
- if (!NT_STATUS_IS_OK(gid_to_sid(&(*pp_sids)[i], (*pp_gids)[i]))) {
- DEBUG(1, ("get_user_groups: failed to convert "
- "gid %ld to a sid!\n",
- (long int)(*pp_gids)[i+1]));
- SAFE_FREE(*pp_sids);
- SAFE_FREE(*pp_gids);
- return NT_STATUS_NO_SUCH_USER;
- }
- }
-
- return NT_STATUS_OK;
-}
git.samba.org / tprouty / samba.git / blobdiff