summaryrefslogtreecommitdiffstats
path: root/libcli/security
Commit message (Collapse)AuthorAgeFilesLines
* Fix whitespaceVolker Lendecke2015-02-261-7/+7
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli/security: add a function that checks for MS NFS ACEsRalph Boehme2014-12-042-0/+24
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli/security: add NFS SID mappingsRalph Boehme2014-12-042-0/+22
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli/security: add better detection of SECINFO_[UN]PROTECTED_[D|S]ACL in ↵Stefan Metzmacher2014-08-221-16/+20
| | | | | | | | | | | | get_sec_info() Bug: https://bugzilla.samba.org/show_bug.cgi?id=10773 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Aug 22 02:52:50 CEST 2014 on sn-devel-104
* libcli: Add a NULL check in dom_sid_stringVolker Lendecke2014-06-101-0/+3
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Jun 10 21:46:15 CEST 2014 on sn-devel-104
* libcli/security: remove sec_ace_equalDavid Disseldorp2014-05-292-33/+0
| | | | | | | | | | | This function is a duplicate of security_ace_equal(), and is no longer used. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu May 29 03:34:38 CEST 2014 on sn-devel-104
* secdesc: use security_ace_equal instead of sec_ace_equalDavid Disseldorp2014-05-291-1/+1
| | | | | | | Both offer the same functionality, sec_ace_equal() will be removed. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: cleanup security_ace_equal()David Disseldorp2014-05-291-8/+20
| | | | | | | | This change cleans up the white-space damage, and converts the single line if-then statements to match Samba's coding conventions. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: remove unused sec_ace_del_sid()David Disseldorp2014-05-292-33/+0
| | | | | | | With sec_desc_del_sid() now gone, this can also be removed. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: remove unused sec_desc_del_sid()David Disseldorp2014-05-292-37/+0
| | | | | | | | The function is unused, and shares mostly the same behaviour as security_descriptor_acl_del(). Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: remove dup_sec_acl()David Disseldorp2014-05-292-13/+0
| | | | | | | | With make_sec_desc() converted to use security_acl_dup(), which offers the same behaviour, this function is no longer needed. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: clean up and fix make_sec_descDavid Disseldorp2014-05-291-48/+29
| | | | | | | | | | | | It currently leaks memory onto the provided talloc context on error, fix this. Use X_acl_dup() functions provided by secuity_descriptor.c, rather than the redundant secdesc.c calls. Also, use the IDL generated functions to calculate the security descriptor structure size. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/secdesc: remove dup_sec_desc()David Disseldorp2014-05-282-21/+0
| | | | | | | | | With all callers converted to use security_descriptor_copy(), this function can be removed. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
* libcli/secdesc: replace dup_sec_desc() usageDavid Disseldorp2014-05-281-2/+5
| | | | | | | | | Use security_descriptor_copy() instead, which is also provided by libcli. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
* libcli/sd: remove redundant sec_ace_add_sid()David Disseldorp2014-05-282-27/+0
| | | | | | | | | | | | This function adds a new allow-type ACE to an existing ACE list. With the removal of sec_desc_add_sid(), this is no longer used internally. The same behaviour can be achieved via the much cleaner security_ace_create() function. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
* libcli/sd: remove redundant sec_desc_add_sid()David Disseldorp2014-05-282-38/+0
| | | | | | | | | | This function adds an ACE to a security descriptor DACL. The same can be achieved via the more flexible and much cleaner security_ace_create() and security_descriptor_dacl_add() functions. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
* libcli: Simplify desc_ace_has_generic()Volker Lendecke2014-05-271-9/+6
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
* libcli: Simplify desc_expand_generic()Volker Lendecke2014-05-271-13/+6
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
* libcli: Avoid an explicit memset callVolker Lendecke2014-05-271-4/+4
| | | | | | | On x86 with -O3, this saves surprising 160 bytes .text Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
* libcli: Avoid a talloc/freeVolker Lendecke2014-05-271-4/+6
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
* libcli: Avoid a talloc/freeVolker Lendecke2014-05-271-4/+6
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
* libcli: Fix a memleakVolker Lendecke2014-05-271-5/+3
| | | | | | | | | | | struct security_ace has a struct dom_sid, not a pointer to it. So we don't have to talloc it first and then not free it. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Tue May 27 12:54:55 CEST 2014 on sn-devel-104
* libcli/security: s/remove/remove_ace/Stefan Metzmacher2014-04-021-3/+3
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* secacl: Slightly simplify make_sec_aclVolker Lendecke2013-12-141-3/+6
| | | | | | | | | | This avoids a complex if-expression Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Dec 14 00:10:21 CET 2013 on sn-devel-104
* secacl: Fix a memleak in an error pathVolker Lendecke2013-12-131-0/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* secacl: Don't use talloc_zeroVolker Lendecke2013-12-131-1/+4
| | | | | | | We initialize all but one field anyway Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* secacl: Fix whitespaceVolker Lendecke2013-12-131-11/+11
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4-dsacl: Fixed incorrect handling of privileges in sec_access_check_dsNadezhda Ivanova2013-10-251-8/+4
| | | | | | | | | | Restore and backup privileges are not relevant to ldap access checks, and the TakeOwnership privilege should grant write_owner right Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli: Add security_token_system_privilege().Andreas Schneider2013-08-062-0/+23
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
* libcli: fix conversion logic in dom_sid_string_bufJeff Layton2013-07-311-10/+18
| | | | | Signed-off-by: Jeff Layton <jlayton@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libcli: fix conversion logic in dom_sid_parse_endpJeff Layton2013-07-311-14/+15
| | | | | Signed-off-by: Jeff Layton <jlayton@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* Add a comment about why we are removing the INHERITED bit so people understand.Richard Sharpe2013-04-021-0/+9
| | | | | | | | Signed-off-by: Richard Sharpe <realrichardsharpe@gmail.com> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Apr 2 20:05:13 CEST 2013 on sn-devel-104
* Make sure that we only propogate the INHERITED flag when we are allowed to.Richard Sharpe2013-03-281-1/+2
| | | | | | | | Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Mar 28 19:43:41 CET 2013 on sn-devel-104
* Fix bug #9674 - Samba denies owner Read Control when there is a DENY entry ↵Richard Sharpe2013-02-231-3/+3
| | | | | | | | | | while W2K08 does not. Signed-off-by: Richard Sharpe <rsharpe@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Feb 23 19:28:15 CET 2013 on sn-devel-104
* libcli/security: calculate INHERIT_ONLY correcty for AUDIT and ALARM aces ↵Stefan Metzmacher2013-01-271-4/+16
| | | | | | | (bug #9481) Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli-acl: add documentationMatthieu Patou2013-01-221-1/+19
| | | | Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* security: Add documentationMatthieu Patou2013-01-211-0/+9
| | | | | | | Names seems to be a bit cryptic and misleading (at least for me). So documenting them should remove at least partially this problem. Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli-security: Add documentation for object_tree_modify_accessMatthieu Patou2013-01-211-2/+12
| | | | Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: remove useless if (root->num_of_children > 0) statementsAndrew Bartlett2013-01-211-8/+4
| | | | | | | | | | The for loop does this implicitly when comparing for (i = 0; i < root->num_of_children; i++) Andrew Bartlett Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: add init_mask to existing children in insert_in_object_treeStefan Metzmacher2013-01-211-0/+1
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: handle node initialisation in one spot in ↵Andrew Bartlett2013-01-212-38/+37
| | | | | | | | | | | | | | | | | | | | | | | insert_in_object_tree() This removes special-case for initalising the children array in insert_in_object_tree(). talloc_realloc() handles the intial allocate case perfectly well, so there is no need to have this duplicated. This also restores having just one place were the rest of the elements are intialised, to ensure uniform behaviour. To do this, we have to rework insert_in_object_tree to have only one output variable, both because having both root and new_node as output variables was too confusing, and because otherwise the two pointers were being allowed to point at the same memory. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: avoid usage of dom_sid_parse_talloc() in sec_access_check_ds()Stefan Metzmacher2013-01-211-8/+4
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: simplify get_ace_object_type()Stefan Metzmacher2013-01-211-8/+4
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: fix formating in access_check.cStefan Metzmacher2013-01-211-8/+12
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: fix whitespaces in access_check.cStefan Metzmacher2013-01-211-98/+100
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libcli/security: don't look at the inherited type in get_ace_object_type()Stefan Metzmacher2013-01-171-2/+0
| | | | | | | | The inherited_type is only used to decide if aces should be inherited effectively or not (INHERIT_ONLY) for the specified object. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Matthieu Patou <mat@matws.net>
* libcli/security: Ensure to fill in remaining_access for the initial case ↵Andrew Bartlett2013-01-151-0/+1
| | | | | | | | | | | | (bug #9554 - CVE-2013-0172) It is critically important that we initialise this element as otherwise all access is permitted. Andrew Bartlett Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit a75805490d96a85786287f5d0522dd7671d6816e)
* libcli/security: calculate the correct inherited_object GUIDStefan Metzmacher2012-12-111-1/+7
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
* libcli/security: implement object_in_list()Stefan Metzmacher2012-12-111-2/+23
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
* libcli/security: remove duplicate aces in se_create_child_secdesc()Stefan Metzmacher2012-12-021-0/+34
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
generated by cgit (git 2.34.1) at 2025-05-17 05:01:35 +0000