summaryrefslogtreecommitdiffstats
path: root/source/lib/util_sid.c
Commit message (Collapse)AuthorAgeFilesLines
* Better handling of uid/gid -> RID and RID -> uid/gid code.Andrew Bartlett2002-04-131-5/+12
| | | | | | | | | | | | | | | | | | | All uids and gids must create valid RIDs, becouse other code expects this, and can't handle the failure case. (ACL code in particular) Allow admins to adjust the base of the RID algorithm, so avoid clashes with users brought in from NT (for example). Put all the algorithm code back in one place, so that this change is global. Better coping with NULL sid pointers - but it still breaks a lot of stuff. BONUS: manpage entry for new paramater :-) counter based rids for normal users in tdbsam is disabled for the timebeing, idra and I will work out some things here soon I hope. Andrew Bartlett
* Add "Creator Group" - was in 2.2.x and I'm syncing up the two.Jeremy Allison2002-03-131-0/+2
| | | | Jeremy.
* add a note about the meaning of global_sam_sidAndrew Tridgell2002-03-101-0/+3
|
* this fixes the problem of not being able to add a SD to a file on aAndrew Tridgell2002-01-311-2/+0
| | | | | | | | | | | | | non-domain Samba server from a NT4 client. Note that this exactly reverses a change by Jeremy on the 18th of December 2001, reverting the code back to what JF originally wrote. I have looked carefully with a sniffer and JFs original NULL sid is correct (ie. it matches what NT4 does) and also fixes the problem. Sending a blank sid (which is what jeremy's patch did) causes NT4 to give a classic "parameter is incorrect error" and prevents the addition of new ACLs.
* Removed version number from file header.Tim Potter2002-01-301-2/+1
| | | | Changed "SMB/Netbios" to "SMB/CIFS" in file header.
* freeing the wrong pointer, sorry my mistake.Simo Sorce2001-12-301-5/+5
|
* util_sid.c - respect a const variabile (addedd strdup)Simo Sorce2001-12-301-4/+12
| | | | | | cli_reg.c - indentation pdb_ldap.c - some checks on init fns parameters pdb_tdb.c - some checks on init fns parameters + make sure we close the db on failure
* fixed sid_compare_domain()Andrew Tridgell2001-12-191-3/+29
|
* Fixup JF's weird SID return :-).Jeremy Allison2001-12-181-2/+4
| | | | Jeremy
* make sid_binstring available without HAVE_ADSAndrew Tridgell2001-12-101-0/+17
|
* added a boolean to the group mapping functions to specify if we need orJean-François Micouleau2001-12-041-1/+48
| | | | | | | | | | | | | | | | | | | | | not the privileges. Usually we don't need them, so the memory is free early. lib/util_sid.c: added some helper functions to check an SID. passdb/passdb.c: renamed local_lookup_rid() to local_lookup_sid() and pass an RID all the way. If the group doesn't exist on the domain SID, don't return a faked one as it can collide with a builtin one. Some rpc structures have been badly designed, they return only rids and force the client to do subsequent lsa_lookup_sid() on the domain sid and the builtin sid ! rpc_server/srv_util.c: wrote a new version of get_domain_user_groups(). Only the samr code uses it atm. It uses the group mapping code instead of a bloody hard coded crap. The netlogon code will use it too, but I have to do some test first. J.F.
* put sid_to_name behind the winbindd backend interfaceAndrew Tridgell2001-12-031-12/+26
| | | | | | | I spent quite a while trying to work out how to make this call via ldap and failed. I then found that MS servers seem use rpc for sid_to_name, and it works even when in native mode, I ended up just implementing it via rpc
* added a basic ADS backend to winbind. More work needed, but atAndrew Tridgell2001-12-031-1/+17
| | | | least basic operations work
* Removed totally annoying verbose debug in sid_to_string()Tim Potter2001-11-051-2/+0
|
* Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter2001-10-021-2/+0
|
* Ignore unmappable (NT Authority, BUILTIN etc.) SIDs in an ACL set.Jeremy Allison2001-09-221-0/+24
| | | | Jeremy.
* strchr and strrchr are macros when compiling with optimisation in gcc, so we ↵Andrew Tridgell2001-07-041-2/+2
| | | | can't redefine them. damn.
* Added sid_peek_rid() function to return the rid of a sid. Saves muckingTim Potter2001-05-101-0/+13
| | | | around with copying a sid to a temporary variable and using sid_split_rid().
* Merging Gerald's PDC SAM name fix.Jeremy Allison2001-05-031-13/+76
| | | | Jeremy.
* - fixed the sort_acl bug, sorting now works rightAndrew Tridgell2001-02-231-9/+20
| | | | | - don't allow setting of duplicate ACEs - fixed a ACE delete bug
* Changes from APPLIANCE_HEAD:David O'Neill2001-01-151-4/+9
| | | | | | | | | | | | | | | | | | | | | source/rpc_parse/parse_lsa.c - off by one unistr length bug in init_lsa_trans_name() source/lib/util_sid.c - resolve more BUILTIN sid values to names. source/nsswitch/wb_client.c - fix typo in debug message - set errno on error so we don't get bogus value from last failure. source/rpc_server/srv_spoolss_nt.c - add debug to track number of open printer handles for ease of tracking handle leaks in the future. source/rpc_server/srv_lsa.c - fix off-by-one string bug. This was preventing NT from displaying names for well-know SIDs in printer permissions dialog.
* Removed the special casing of SIDs in se_access_check. This is now done ↵Jeremy Allison2000-12-121-10/+43
| | | | | | | (correctly) when the NT_USER_TOKEN is *created*. Jeremy.
* Adding Herb's compile warning fixes to HEAD.Jeremy Allison2000-10-041-3/+7
| | | | Jeremy.
* Removed annoying unecessary debug message.Tim Potter2000-09-281-1/+0
|
* Added code to do SID to uid/gid conversion. Needed for ACL support.Jeremy Allison2000-08-231-2/+2
| | | | Jeremy.
* Added an NT_USER_TOKEN structure that is copied/passed around associatedJeremy Allison2000-08-031-3/+5
| | | | | | | with the current user. This will allow se_access_check() to quickly do a SD check without having to translate uid/gid's to SIDs. Still needs work on pipe calls. Jeremy.
* if the sids are not the same pointer and either of the sids are NULLAndrew Tridgell2000-07-251-0/+3
| | | | then the two sids are not equal
* Added global_sid_NULL S-1-0-0 to list of global sids.Tim Potter2000-07-061-0/+2
|
* lib/util_sid.c: Uninitialized memory read.Jeremy Allison2000-06-241-0/+2
| | | | | | | | | | rpc_parse/parse_spoolss.c: Added note about prs_align when marshalling a SEC_DESC... rpc_server/srv_lsa.c: Tim - your changes broke the display of the 'everyone' group when doing file access with no winbindd running. This is a partial fix - more when I have analysed this more. rpc_server/srv_spoolss_nt.c: Fix for the 'change driver' problem ! Hurrah ! Jeremy.
* added se_access_check.Luke Leighton2000-06-081-0/+2
|
* Fixed LsaQueryInformationPolicy level 3 to return primary domain info.Matthew Chapman2000-05-291-9/+12
| | | | | | | Domain SID is saved in secrets.tdb upon joining domain. Added "Authenticated Users" and "SYSTEM" well-known SIDs (under NT Authority).
* fixed nttrans.cLuke Leighton2000-05-271-1/+1
|
* Roll back to using static MACHINE.SID after consultation with Andrew. ThisJeremy Allison2000-04-121-288/+0
| | | | | | code will be removed soon and a SID auto-generated from (probably) primary hostname and never stored in a file will replace it. Jeremy.
* simple mods to add msrpc pipe redirection. default behaviour: fall backLuke Leighton2000-01-031-1/+289
| | | | to using internal msrpc code in smbd.
* first pass at updating head branch to be to be the same as the SAMBA_2_0 branchAndrew Tridgell1999-12-131-411/+297
|
* default SID map now reads in "trusted domains" from smb.conf.Luke Leighton1999-12-021-5/+2
|
* doing a code reshuffle. want to add code to establish trust relationships.Luke Leighton1999-11-201-0/+296
|
* rewrote rpcclient enumaliases command.Luke Leighton1999-11-011-1/+1
|
* - typecast malloc / Realloc issues.Luke Leighton1999-10-251-0/+20
| | | | - signed / unsigned issues.
* reverted jeremy's c++-like security descriptor modifications as theLuke Leighton1999-08-031-20/+0
| | | | | | | | | simplest method to get rpcclient's reggetsec command working. the buffers passed as arguments in do_reg_get_key_sec() do need to be locally allocated not dynamically allocated, as two calls to reg_get_key_sec() are needed. on the first, the server fills in the size of the security descriptor buffer needed. on the second, the server fills in the security descriptor buffer.
* added jeremy's new c++-like code for parsing of security descriptors.Luke Leighton1999-02-231-0/+20
|
* string_to_sid was using next_token() this is bad as it stops you fromLuke Leighton1998-12-021-43/+44
| | | | | being able to use next_token() outside of string_to_sid calls. use strchr instead
* weekend work. user / group database API.Luke Leighton1998-11-291-6/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - split sam_passwd and smb_passwd into separate higher-order function tables - renamed struct smb_passwd's "smb_user" to "unix_user". added "nt_user" plus user_rid, and added a "wrap" function in both sam_passwd and smb_passwd password databases to fill in the blank entries that are not obtained from whatever password database API instance is being used. NOTE: whenever a struct smb_passwd or struct sam_passwd is used, it MUST be initialised with pwdb_sam_init() or pwd_smb_init(), see chgpasswd.c for the only example outside of the password database APIs i could find. - added query_useraliases code to rpcclient. - dealt with some nasty interdependencies involving non-smbd programs and the password database API. this is still not satisfactorily resolved completelely, but it's the best i can do for now. - #ifdef'd out some password database options so that people don't mistakenly set them unless they recompile to _use_ those options. lots of debugging done, it's still not finished. the unix/NT uid/gid and user-rid/group-rid issues are better, but not perfect. the "BUILTIN" domain is still missing: users cannot be added to "BUILTIN" groups yet, as we only have an "alias" db API and a "group" db API but not "builtin-alias" db API...
* Makefile.in: Added maintainer mode fixes.Jeremy Allison1998-11-251-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | aclocal.m4: Added AC_LIBTESTFUNC. configure.in: Fixed -lsecurity -lsec problems. client.c: dos_ fixes. groupdb/aliasunix.c: Dead code removal. include/includes.h: Added default PRINTCAP_NAME. lib/genrand.c: dos_ fixes. lib/replace.c: Added strtoul. lib/system.c: dos_ fixes. lib/util.c: dos_ fixes. lib/util_sid.c: Signed/unsigned fixes. lib/util_str.c: removed bad const. locking/locking_slow.c: dos_ fixes. printing/printing.c: dos_ fixes. rpc_server/srv_samr.c: Dead code removal. rpc_server/srv_sid.c: global_myworkgroup defined with wrong size AGAIN ! smbd/dir.c: dos_ fixes. smbd/open.c: dos_ fixes. smbd/oplock.c: dos_ fixes. smbd/reply.c smbd/server.c smbd/service.c smbd/uid.c: dos_ fixes. Jeremy.
* sorting out difference between aliases and groups in the cases whereLuke Leighton1998-11-241-1/+4
| | | | | | | | | | | | | | | unix groups are not explicitly mapped. i.e as a PDC or BDC you can have domain groups, as a member of a domain you cannot. as a member of a domain, unmapped unix groups are assumed to be aliases, and as a PDC or BDC, unmapped unix groups are assumed to be unix groups. there is _one_ other check needed with aliases to be added: unmapped unix groups that have the same name as an NT group on the PDC (for which i will need to write an LsaLookupNames call) should be assumed to be domain groups on the PDC.
* unix instance of group database APILuke Leighton1998-11-231-2/+9
|
* security descriptors.Luke Leighton1998-11-121-0/+13
| | | | kanji const char* warnings.
* util_file.c:Luke Leighton1998-11-051-0/+178
split some routines out of various places (e.g smbpass.c) because they now get used in more than one location. util_sid.c: need sid_copy, compare, split rid, append rid etc etc...
generated by cgit (git 2.34.1) at 2025-09-25 22:16:36 +0000