summaryrefslogtreecommitdiffstats
path: root/source3/smbd/uid.c
Commit message (Collapse)AuthorAgeFilesLines
* s3-smbd: avoid using pipes_struct when only session_info is needed.Günther Deschner2011-05-021-5/+4
| | | | Guenther
* s3-smbd: Added a become_user_by_session() function.Andreas Schneider2011-04-111-0/+17
| | | | | | | | This uses the provided session_info instead of searching the user via the vuid. This is useful to work with fake connnection you need to create if someone connects directly to a rpc service. Signed-off-by: Jeremy Allison <jra@samba.org>
* s3-smbd: Added a change_to_user_by_session() function.Andreas Schneider2011-04-111-74/+96
| | | | Signed-off-by: Jeremy Allison <jra@samba.org>
* s3-includes: only include ntdomain.h where needed.Günther Deschner2011-03-301-0/+1
| | | | Guenther
* s3-auth: smbd needs auth.hGünther Deschner2011-03-301-0/+1
| | | | Guenther
* s3: include smbd/smbd.h where needed.Günther Deschner2011-03-301-0/+1
| | | | Guenther
* s3-passdb: use passdb headers where needed.Günther Deschner2011-03-301-0/+1
| | | | Guenther
* s3-includes: only include system/passwd.h when needed.Günther Deschner2011-03-301-0/+1
| | | | Guenther
* s3-smbd: Increase debug level von context messages.Andreas Schneider2011-03-091-1/+1
|
* s3-auth struct security_unix_token replaces UNIX_USER_TOKENAndrew Bartlett2011-03-011-1/+1
|
* s3-auth Rename auth_serversupplied_info varaiables: server_info -> session_infoAndrew Bartlett2011-02-221-60/+60
| | | | | | | | | | | | | | | | | | | | | These variables, of type struct auth_serversupplied_info were poorly named when added into 2001, and in good consistant practice, this has extended all over the codebase in the years since. The structure is also not ideal for it's current purpose. Originally intended to convey the results of the authentication modules, it really describes all the essential attributes of a session. This rename will reduce the volume of a future patch to replaced these with a struct auth_session_info, with auth_serversupplied_info confined to the lower levels of the auth subsystem, and then eliminated. (The new structure will be the output of create_local_token(), and the change in struct definition will ensure that this is always run, populating local groups and privileges). Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
* s3-auth Rename cryptic 'ptok' to security_tokenAndrew Bartlett2011-02-101-9/+9
| | | | | | | | | This will allow the auth_serversupplied_info struct to be migrated to auth_session_info easier. Adnrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-smbd: Fixed a possible null pointer dereference.Andreas Schneider2011-01-191-1/+3
|
* Make getpwnam_alloc() static to lib/username.c, and ensure all username ↵Jeremy Allison2010-10-201-1/+1
| | | | | | | | | | | | lookups go through Get_Pwnam_alloc(), which is the correct wrapper function. We were using it *some* of the time anyway, so this just makes us properly consistent. Jeremy. Autobuild-User: Jeremy Allison <jra@samba.org> Autobuild-Date: Wed Oct 20 16:02:12 UTC 2010 on sn-devel-104
* libcli/security Provide a common, top level libcli/security/security.hAndrew Bartlett2010-10-121-0/+1
| | | | | | | | | | | | | | This will reduce the noise from merges of the rest of the libcli/security code, without this commit changing what code is actually used. This includes (along with other security headers) dom_sid.h and security_token.h Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Tue Oct 12 05:54:10 UTC 2010 on sn-devel-104
* s3: Remove talloc_autofree_context() from change_to_guest()Volker Lendecke2010-09-261-1/+1
| | | | pass is freed at the exit of this routine
* s3:auth Remove NT_USER_TOKENAndrew Bartlett2010-09-111-1/+1
| | | | | | | | | The all UPPER case typedef is no longer the preferred Samba style and this makes it easier to see that this is the IDL-derivied structure Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-auth Rename NT_USER_TOKEN user_sids -> sidsAndrew Bartlett2010-08-311-2/+2
| | | | This is closer to the struct security_token from security.idl
* s3-netlogon: remove global include of netlogon.h.Günther Deschner2010-08-061-0/+1
| | | | | | | This reduces precompiled headers by another 4 MB and also slightly speeds up the build. Guenther
* s3-uid: Use struct pipes_struct.Andreas Schneider2010-07-281-1/+1
|
* s3: Remove smbd_server_conn from change_to_userVolker Lendecke2010-06-121-2/+1
|
* s3:auth use info3 in auth_serversupplied_infoSimo Sorce2010-05-281-3/+3
| | | | Signed-off-by: Günther Deschner <gd@samba.org>
* Remove the bool admin_user from conn struct. We no longer look at this to ↵Jeremy Allison2010-03-151-5/+5
| | | | | | make access decisions. Jeremy.
* Simplify processing of "admin user". If a user is an admin_user ensure their ↵Jeremy Allison2010-03-151-15/+14
| | | | | | | | | conn token is uid 0. This simplifies change_to_user() and removes special processing of the assignments we pass to set_sec_ctx(). Jeremy.
* Add accessor functions for current uid, gid, unix token, NT token and vuid.Jeremy Allison2010-03-151-0/+43
| | | | Jeremy.
* Rever e80ceb1d7355c8c46a2ed90d5721cf367640f4e8 "Remove more uses of "extern ↵Jeremy Allison2010-03-151-57/+15
| | | | | | | | struct current_user current_user;"." As requested by Volker, split this into smaller commits. Jeremy.
* Remove more uses of "extern struct current_user current_user;".Jeremy Allison2010-03-121-16/+58
| | | | | | | | | | | | | Use accessor functions to get to this value. Tidies up much of the user context code. Volker, please look at the changes in smbd/uid.c to familiarize yourself with these changes as I think they make the logic in there cleaner. Cause smbd/posix_acls.c code to look at current user context, not stored context on the conn struct - allows correct use of these function calls under a become_root()/unbecome_root() pair. Jeremy.
* s3:smbd: move more session specific globals to struct smbd_server_connectionStefan Metzmacher2009-06-031-1/+2
| | | | metze
* Fix bug #6315 smbd crashes doing vfs_full_audit on IPC$ close event.Jeremy Allison2009-05-041-3/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The underlying problem is that once SMBulogoff is called, all server_info contexts associated with the vuid should become invalid, even if that's the context being currently used by the connection struct (tid). When the SMBtdis comes in it doesn't need a valid vuid value, but the code called inside vfs_full_audit always assumes that there is one (and hence a valid conn->server_info pointer) available. This is actually a bug inside the vfs_full_audit and other code inside Samba, which should only indirect conn->server_info on calls which require AS_USER to be set in our process table. I could fix all these issues, but there's no guarentee that someone might not add more code that fails this assumption, as it's a hard assumption to break (it's usually true). So what I've done is to ensure that on SMBulogoff the previously used conn->server_info struct is kept around to be used for print debugging purposes (it won't be used to change to an invalid user context, as such calls need AS_USER set). This isn't strictly correct, as there's no association with the (now invalid) context being freed and the call that causes conn->server_info to be indirected, but it's good enough for most cases. The hard part was to ensure that once a valid context is used again (via new sessionsetupX calls, or new calls on a still valid vuid on this tid) that we don't leak memory by simply replacing the stored conn->server_info pointer. We would never actually leak the memory (as all conn->server_info pointers are talloc children of conn), but with the previous patch a malicious client could cause many server_info structs to be talloced by the right combination of SMB calls. This new patch introduces free_conn_server_info_if_unused(), which protects against the above. Jeremy.
* Fix bug found by Tim Prouty, logging off and then re-using a vuid can cause ↵Jeremy Allison2009-04-161-0/+11
| | | | | | | smbd to access a freed structure. Jeremy.
* Fix bug #6155 - "force group" is no longer working as expected.Jeremy Allison2009-03-031-3/+8
| | | | | | | We need to store the "force group" uid separately from the conn->server_info token as we need to apply it separately also. Volker PLEASE CHECK ! Jeremy.
* s3:smbd: move all globals and static variables in globals.[ch]Stefan Metzmacher2009-01-081-10/+1
| | | | | | The goal is to move all this variables into a big context structure. metze
* s3:smbd: remove pointless static variable in uid.cStefan Metzmacher2009-01-081-7/+4
| | | | | | | | We always free the value at the end of the function, so we don't need a static variable to hold just NULL for the time the function isn't executed. metze
* Fix bug #1254 - write list not working under share-level securityJeremy Allison2008-12-041-35/+46
| | | | | | | | A somewhat more elegant fix than I could use for 3.2.x or 3.0.x. Turns out the only part of check_user_ok() that needs to change for share level security is the VUID cache pieces, so I can just always use check_user_ok() for all lp_security() cases. Jeremy
* Get rid of pipes_struct->pipe_user, we have server_info now --- YESSS!Volker Lendecke2008-11-241-3/+3
|
* Fix bug #5900 reported by monyo@samba.gr.jp - vfs_readonly.so does not work.Jeremy Allison2008-11-171-1/+2
| | | | Jeremy.
* Make us clean under valgrind --leak-check=full by using ↵Jeremy Allison2008-11-061-1/+1
| | | | | | | | | | talloc_autofree_context() instead of NULL. Remove the code in memcache that does a TALLOC_FREE on stored pointers. That's a disaster waiting to happen. If you're storing talloc'ed pointers, you can't know their lifecycle and they should be deleted when their parent context is deleted, so freeing them at some arbitrary point later will be a double-free. Jeremy.
* Wrap the unix token info in a unix_user_token in auth_serversupplied_infoVolker Lendecke2008-06-191-13/+14
| | | | | No functional change, this is a preparation for more current_user ref removal (This used to be commit dcaedf345e62ab74ea87f0a3fa1e3199c75c5445)
* Move connection-specific vuid cache clear to uid.cVolker Lendecke2008-06-141-0/+22
| | | | (This used to be commit 1025f687910ce40283c7344ed67ebd5bf31217b7)
* Slight refactoring for check_user_ok: It only needs vuid and server_infoVolker Lendecke2008-06-141-20/+18
| | | | (This used to be commit 68944ea1ea7a0a63b08cbfc703f5ee29d2627696)
* Group the access checks together in check_user_ok()Volker Lendecke2008-06-141-6/+8
| | | | (This used to be commit 45662b5e8b3c7bc39cb33c5d7deb7e9a91f30a8b)
* Consistently use snum in check_user_okVolker Lendecke2008-06-141-2/+2
| | | | | | Most already used it, these two still used SNUM(conn), where the only caller of this routine (change_to_user) had set snum = SNUM(conn). (This used to be commit b14e59bfdbfb62494002e22d0665c4d420484245)
* Compare the pointer "vuser" to NULL, not 0Volker Lendecke2008-06-141-1/+1
| | | | (This used to be commit 5c916549f002d5e4e06f24d396a2bdca73d384c7)
* Remove the reference to current_user_info from share_access.cVolker Lendecke2008-05-251-2/+7
| | | | | This required to pass around the domain a bit (This used to be commit 17b0db20d28d1b737c5e86b78106657e8ca5ce9c)
* With force user, we have the same base token for all vuidsVolker Lendecke2008-05-111-1/+9
| | | | (This used to be commit 0f19bc3f65bfc132aea1de1e76fcb4ee625a050f)
* Remove the unix token info from connection_structVolker Lendecke2008-05-101-8/+8
| | | | (This used to be commit 2834dacc8d49f77fe55fb5d7e3eb2dda431d1d3d)
* Replace nt_user_token with server_info in connection_structVolker Lendecke2008-05-101-30/+28
| | | | (This used to be commit a3738aef59e97d4533010b048534d937d36c0950)
* Empty some nonempty blank linesVolker Lendecke2008-05-101-18/+18
| | | | (This used to be commit 1a406def02bf171b223467d6b76317586d6205fc)
* Make use of talloc_tos() in change_to_user()Volker Lendecke2008-05-101-1/+1
| | | | (This used to be commit c4bed3a48b86d44ad641250add2fc189af7e72f5)
* Next try at making the vuid cache circularVolker Lendecke2008-05-101-7/+7
| | | | | Jeremy, please check! (This used to be commit a34f73521712e3820d417f0d9ed811723b7681d6)
generated by cgit (git 2.34.1) at 2025-09-22 10:58:12 +0000