summaryrefslogtreecommitdiffstats
path: root/source4/libcli/security
Commit message (Collapse)AuthorAgeFilesLines
* r17848: Ok, this did not do it. Still got the same problem.Volker Lendecke2007-10-101-8/+1
| | | | (This used to be commit bb393603707ada3d4b917f8374b7738f16c78f46)
* r17846: Ok, this is a patch that needs further discussion. On Solaris, ↵Volker Lendecke2007-10-101-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | snprintf seems to be broken. The %lu modifies apparently can not cope with the high bit==1. In dom_sid_string I added some printfs and got: auth: 21 auth: 2666793276 auth: 679821296 auth: 2310223117 auth: 1206 sid=S-1-5-21-8446744072081377596-679821296-8446744071724807437-1206 The "auth:" values are direct printfs, the sid= is the resulting code from dom_sid_string. I could not reproduce it with a simple test program, and #ifdef'ing out HAVE_SNPRINTF in config.h manually does not help either, probably because the dynamic linker overwrites the symbol in lib/replace. Checking it in because it fixes the RPC-SAMBA3-SHARESEC test directly on host "sunx", I would like to see whether it also fixes IRIX and AIX. Volker (This used to be commit 1a9401738f652a87d377a32086342f5f98525fc2)
* r17082: Add a test that walks and tests denying tconX access via the share ↵Volker Lendecke2007-10-101-0/+18
| | | | | | | | | | | | | | | | security descriptor. This is something that W2k3 does _not_ pass and probably is not expected to, it seems the don't check access at tconX time. Thanks to metze for the hint how in the srvsvc_NetShareInfo1501 struct the length of the sd can be encoded in idl. As metze says, there's probably more to the share secdesc, this needs more testing. This one is here to walk the samba3 code. Volker (This used to be commit 67185508229a8d7f144c22cb194f573c932d6de5)
* r15573: Fix build of systems that have iconv headers in non-standard locationsJelmer Vernooij2007-10-101-1/+1
| | | | | | | Split of system/locale.h header from system/iconv.h Previously, iconv wasn't being used on these systems (This used to be commit aa6d66fda69779d1c2948a1aca85dbd5208f1cba)
* r15457: Get rid of more usages of uint_tJelmer Vernooij2007-10-101-1/+1
| | | | (This used to be commit 849818dcdeb8eaf2eb22fea3896a4f7c777d8c5f)
* r15328: Move some functions around, remove dependencies.Jelmer Vernooij2007-10-104-3/+34
| | | | | | Remove some autogenerated headers (which had prototypes now autogenerated by pidl) Remove ndr_security.h from a few places - it's no longer necessary (This used to be commit c19c2b51d3e1ad347120b06a22bda5ec586c22e8)
* r15297: Move create_security_token() to samdb as it requires SAMDB (and the ↵Jelmer Vernooij2007-10-102-78/+4
| | | | | | | | rest of LIBSECURITY doesn't) Make the ldb password_hash module only depend on some keys manipulation code, not full heimdal Some other dependency fixes (This used to be commit 5b3ab728edfc9cdd9eee16ad0fe6dfd4b5ced630)
* r15207: Introduce PRIVATE_DEPENDENCIES and PUBLIC_DEPENDENCIES as replacementJelmer Vernooij2007-10-101-1/+1
| | | | | for REQUIRED_SUBSYSTEMS. (This used to be commit adc8a019b6da256f104abed1b82bfde6998a2ac9)
* r15079: w2k3 returns NT_STATUS_PRIVILEGE_NOT_HELD if SEC_FLAG_SYSTEM_SECURITY isStefan Metzmacher2007-10-101-1/+1
| | | | | | | desired but SeSecurityPrivilege isn't granted metze (This used to be commit be7285bdebd58e7a86fcc64f7b22b9f533bcc4f5)
* r14894: - add some 'const'Stefan Metzmacher2007-10-103-37/+21
| | | | | | | | - remove sid_active_in_token() was the same as security_token_has_sid() - rename some functions metze (This used to be commit 81390dcda50f53d61e70059fb33014de0d283dc5)
* r14891: fix a bug found by the ibm checkerStefan Metzmacher2007-10-102-24/+46
| | | | | | | | | | | | the problem was that we shift with <<= (privilege-1) and we called the function with privilege=0 add some checks to catch invalid privilege values and hide the mask representation in privilege.c metze (This used to be commit a69f000324764bcd4cf420f2ecba1aca788258e4)
* r14860: create libcli/security/security.hStefan Metzmacher2007-10-105-6/+26
| | | | | metze (This used to be commit 9ec706238c173992dc938d537bdf1103bf519dbf)
* r14840: - rename some functionsStefan Metzmacher2007-10-101-31/+41
| | | | | | | - stack specific functions on top of generic ones metze (This used to be commit e391f3c98aae600c5f64d5975dd55567a09c3100)
* r14641: fix typoStefan Metzmacher2007-10-101-2/+2
| | | | | metze (This used to be commit 0ad464f686dddc5befdf1ec8d20101ee0ad83585)
* r14542: Remove librpc, libndr and libnbt from includes.hJelmer Vernooij2007-10-105-1/+5
| | | | (This used to be commit 51b4270513752d2eafbe77f9de598de16ef84a1f)
* r14464: Don't include ndr_BASENAME.h files unless strictly required, insteadJelmer Vernooij2007-10-102-0/+2
| | | | | try to include just the BASENAME.h files (containing only structs) (This used to be commit 3dd477ca5147f28a962b8437e2611a8222d706bd)
* r13924: Split more prototypes out of include/proto.h + initial work on headerJelmer Vernooij2007-10-105-0/+5
| | | | | file dependencies (This used to be commit 122835876748a3eaf5e8d31ad1abddab9acb8781)
* r12858: This moves the libnet_LookupPdc code to use a GetDC request to findAndrew Bartlett2007-10-101-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the remote server's name, or in the absence of a local nbt_server to communicate with (or without root access), a node status request. The result is that we are in a better position to use kerberos, as well as to remove the 'password server' mandatory parameter for the samsync and samdump commands. (I need this to put these into SWAT). The only problem I have is that I must create a messaging context, which requires a server ID. As a client process, I don't expect to get messages, but it is currently required for replies, so I generate a random() number. We probably need the servers to accept connections on streamed sockets too, for client-only tasks that want IRPC. Because I wanted to test this code, I have put the NET-API-* tests into our test scripts, to ensure they pass and keep passing. They are good frontends onto the libnet system, and I see no reason not to test them. In doing so the NET-API-RPCCONNECT test was simplified to take a binding string on the command line, removing duplicate code, and testing the combinations in the scripts instead. (I have done a bit of work on the list shares code in libnet_share.c to make it pass 'make test') In the future, I would like to extend the libcli/findds.c code (based off volker's winbind/wb_async_helpers.c, which is why it shows up a bit odd in the patch) to handle getting multiple name replies, sending a getdc request to each in turn. (posted to samba-technical for review, and I'll happily update with any comments) Andrew Bartlett (This used to be commit 7ccddfd3515fc2c0d6f447c768ccbf7a220c3380)
* r12747: Add a couple more token tests, used by the kludge ACL module.Andrew Bartlett2007-10-101-0/+30
| | | | | Andrew Bartlett (This used to be commit 10eadf48124d61f2eb586fb277a66aa4b9e6cad3)
* r12608: Remove some unused #include lines.Jelmer Vernooij2007-10-106-6/+0
| | | | (This used to be commit 70e7449318aa0e9d2639c76730a7d1683b2f4981)
* r12592: Remove some useless dependenciesJelmer Vernooij2007-10-101-19/+2
| | | | (This used to be commit ca8db1a0cd77682ac2c6dc4718f5d753a4fcc4db)
* r12542: Move some more prototypes out to seperate headersJelmer Vernooij2007-10-101-0/+1
| | | | (This used to be commit 0aca5fd5130d980d07398f3291d294202aefe3c2)
* r12498: Eliminate INIT_OBJ_FILES and ADD_OBJ_FILES. We were not usingJelmer Vernooij2007-10-101-3/+3
| | | | | | | the difference between these at all, and in the future the fact that INIT_OBJ_FILES include smb_build.h will be sufficient to have recompiles at the right time. (This used to be commit b24f2583edee38abafa58578d8b5c4b43e517def)
* r12161: Fix a memleak and do the -O1 janitor :-)Volker Lendecke2007-10-101-1/+5
| | | | (This used to be commit 82d87d62614a33ec9d2ed20e63d80a7af64e8678)
* r12158: added ldif handlers for the ntSecurityDescriptor attribute, so whenAndrew Tridgell2007-10-101-8/+8
| | | | | | | | | | displaying security descriptors in ldbsearch or ldbedit you can see the SDDL version. This also allows us to specify security descriptors in our setup/*.ldif files in SDDL format, which is much more convenient than the NDR binary format! (This used to be commit 8185731c1846412c1b3366824cdb3d05b2d50b73)
* r12139: - fixed up the ace object flags checkingAndrew Tridgell2007-10-101-3/+8
| | | | | - allow for arbitrary access masks in sddl_encode_ace() (This used to be commit 5e2b1bd6afafe2eb96e98c4636e0a62235693183)
* r12138: added use of 2 letter SID codes in sddl_encode_sid()Andrew Tridgell2007-10-101-3/+42
| | | | (This used to be commit a0662ae9d3f719d2db193490361923095bd4d419)
* r12137: added sddl_encode(), the reverse of the sddl_decode() function added aAndrew Tridgell2007-10-101-0/+170
| | | | | | couple of days ago. Doesn't yet encode using the shorthand for well known SIDs. (This used to be commit 655a4ebe8e0ee18133103bfba0ca6d14cbf81d56)
* r12011: fixed another 'mixed code and declarations' bugAndrew Tridgell2007-10-101-1/+2
| | | | (This used to be commit 1eca19d597ea21a073361fc6fc550919abf97574)
* r12010: - added support for domain specific SID codes in SDDL stringsAndrew Tridgell2007-10-101-20/+67
| | | | | | | - added a bunch more tests to LOCAL-SDDL (all the ones from our schema) - fixed 'mixed coded declarations' bug (This used to be commit c30e7698e8e1d9991d35bf86c0d4041a1814ad92)
* r12005: added a SDDL (Security Descriptor Description Language) parser. NotAndrew Tridgell2007-10-102-0/+316
| | | | | | | | | | all flags are covered yet, and object aces aren't done yet. This is needed for ACL support in ldb, as the default security descriptor for each object class is given by the defaultSecurityDescriptor attribute in the schema, which is stored in SDDL format (This used to be commit dbdeecea01a8b362a9a525a3689cb03662a86776)
* r11244: Relative path names in .mk filesJelmer Vernooij2007-10-101-8/+8
| | | | (This used to be commit 24e10300906c380919d2d631bfb3b8fd6b3f54ba)
* r11214: Remove scons files (see ↵Jelmer Vernooij2007-10-101-0/+0
| | | | | | http://lists.samba.org/archive/samba-technical/2005-October/043443.html) (This used to be commit 7fffc5c9178158249be632ac0ca179c13bd1f98f)
* r11052: bring samba4 uptodate with the samba4-winsrepl branch,Stefan Metzmacher2007-10-101-5/+0
| | | | | | | before the bad merge metze (This used to be commit 471c0ca4abb17fb5f73c0efed195c67628c1c06e)
* r11037:Stefan Metzmacher2007-10-101-0/+5
| | | | (This used to be commit 6913e338405a5aca5c70cf6e022532c596ed0a36)
* r10810: This adds the hooks required to communicate the current user from theAndrew Bartlett2007-10-101-0/+25
| | | | | | | | | | | | | | | | | | | | | authenticated session down into LDB. This associates a session info structure with the open LDB, allowing a future ldb_ntacl module to allow/deny operations on that basis. Along the way, I cleaned up a few things, and added new helper functions to assist. In particular the LSA pipe uses simpler queries for some of the setup. In ldap_server, I have removed the 'ldasrv:hacked' module, which hasn't been worked on (other than making it continue to compile) since January, and I think the features of this module are being put into ldb anyway. I have also changed the partitions in ldap_server to be initialised after the connection, with the private pointer used to associate the ldb with the incoming session. Andrew Bartlett (This used to be commit fd7203789a2c0929eecea8125b57b833a67fed71)
* r10478: More work on proto headers; we now generate a couple of smaller onesJelmer Vernooij2007-10-101-5/+0
| | | | | that are then included by include/proto.h (This used to be commit 703ffbaaaca11f3d8781cfe9e7542fcaa626d991)
* r10348: Add scons scripts for remaining subsystems. Most subsystems build now,Jelmer Vernooij2007-10-101-0/+5
| | | | | | but final linking still fails (as does generating files asn1, et, idl and proto files) (This used to be commit 4f0d7f75b99c7f4388d8acb0838577d86baf68b5)
* r10185: Fix another two sets of unhandled enumeration warnings, plus correct ↵Tim Potter2007-10-101-7/+11
| | | | | | some awful indentation. (-: (This used to be commit 2f24fc7a7a195c04f88a25d52efc02ddf491126c)
* r9573: fixed a commentAndrew Tridgell2007-10-101-1/+1
| | | | (This used to be commit d151a9459dcbfc88b0dc2ec9dd1cafa18ad5b8f8)
* r9511: - fix the memory treesStefan Metzmacher2007-10-102-7/+8
| | | | | | | - add a note about a possible talloc_free() metze (This used to be commit 550e3030f0e02720b527f3b4923457f05f484e6e)
* r9510: fix the memory treeStefan Metzmacher2007-10-101-1/+1
| | | | | metze (This used to be commit 6d412cf0a4186ec04cee61dd5387903de051fde7)
* r9240: - move struct security_token to the idl file, with this we canStefan Metzmacher2007-10-106-41/+5
| | | | | | | | | the ndr_pull/push/print functions for it in the ntacl-lsm module - fix compiler warnings in the ldap_encode_ndr_* code metze (This used to be commit 83d65d0d7ed9c240ad44aa2c881c1f07212bfda4)
* r7679: update the documentation of security_description_create()Stefan Metzmacher2007-10-101-2/+5
| | | | | metze (This used to be commit 6ad7ffab043c3b510f4dff052973a054e5a75779)
* r6352: Two new composite calls:Alexander Bokovoy2007-10-101-3/+77
| | | | | | | | | | | | | | | | - qfsinfo (query file system information) - appendacl (append an ACL to existing file's security descriptor and get new full ACL) The second one also includes an improvement to security descriptor handling which allows to copy security descriptor. Written by Peter Novodvorsky <peter.novodvorsky@ru.ibm.com> Both functions have corresponding torture tests added. Tested under valgrind and work against Samba 4 and Windows XP. ToDo: document composite call creation process in prog_guide.txt (This used to be commit 441cff62ac75ed16851ce7b8daf9d03eb4c3ec79)
* r6287: sorted out a small but surprisingly tricky dependency problem with theAndrew Tridgell2007-10-102-32/+8
| | | | | | ndr code for handling sids and security descriptors now that we have a sid in the nbt IDL (This used to be commit f8e77fcdeac704aed5e501aa9108f3ed0ab26ca4)
* r5137: fix typesStefan Metzmacher2007-10-101-1/+1
| | | | | metze (This used to be commit add1c579375d08040f722946da31ee3862f9e7ac)
* r5037: got rid of all of the TALLOC_DEPRECATED stuff. My apologies for theAndrew Tridgell2007-10-103-13/+13
| | | | | | large commit. I thought this was worthwhile to get done for consistency. (This used to be commit ec32b22ed5ec224f6324f5e069d15e92e38e15c0)
* r4620: - add interface functions to the auth subsystem so that callers ↵Stefan Metzmacher2007-10-101-20/+25
| | | | | | | | | | | | | | | | | doesn't need to use function pointers anymore - make the module init much easier - a lot of cleanups don't try to read the diff in auth/ better read the new files it passes test_echo.sh and test_rpc.sh abartlet: please fix spelling fixes metze (This used to be commit 3c0d16b8236451f2cfd38fc3db8ae2906106d847)
* r4549: got rid of a lot more uses of plain talloc(), instead usingAndrew Tridgell2007-10-101-1/+1
| | | | | | | | talloc_size() or talloc_array_p() where appropriate. also fixed a memory leak in pvfs_copy_file() (failed to free a memory context) (This used to be commit 89b74b53546e1570b11b3702f40bee58aed8c503)
generated by cgit (git 2.34.1) at 2025-09-26 07:24:15 +0000