summaryrefslogtreecommitdiffstats
path: root/source/smbd/sec_ctx.c
Commit message (Collapse)AuthorAgeFilesLines
* Move to common user token debugging, and ensure we always print both theAndrew Bartlett2002-09-251-11/+2
| | | | | | | NT_TOKEN and the unix credentials - as we incresingly use the NT stuff we want to make it easy to check they don't get out of wack. Andrew Bartlett
* fixed a problem with getgroups() where it could include our currentAndrew Tridgell2002-07-151-12/+27
| | | | | | | | | effective gid which could mean that the user gets group 0 in their group list for acl interpretation this is a replacement fix for the one richard did in 2.2 (which didn't cope wiith variable behaviour depending on which nss module was in use)
* Removed version number from file header.Tim Potter2002-01-301-2/+1
| | | | Changed "SMB/Netbios" to "SMB/CIFS" in file header.
* Some more 'winbind default domain' support patches from Alexander BokovoyAndrew Bartlett2002-01-271-1/+1
| | | | | | | | | | | <a.bokovoy@sam-solutions.net>. This patch is designed to remove the 'special cases' required for this support. In particular this now kills off winbind_initgroups, as it appears no longer to be required. Andrew Bartlett
* Added NT_USER_TOKEN into server_info to fix extra groups problem.Jeremy Allison2001-11-031-40/+0
| | | | | Got "medieval on our ass" about const warnings (as many as I could :-). Jeremy.
* Fixed confusing debug message - it was always printing uid 0 instead of theTim Potter2001-10-291-1/+1
| | | | correct uid.
* Merge the become_XXX -> change_to_XXX fixes from 2.2.2 to HEAD.Jeremy Allison2001-10-181-4/+0
| | | | | Ensure make_conection() can only be called as root. Jeremy.
* Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter2001-10-021-1/+0
|
* don't try to initgroups in non root modeAndrew Tridgell2001-09-191-0/+4
|
* move to SAFE_FREE()Simo Sorce2001-09-171-9/+7
|
* Excellent patch from Anselm Kruis <A.Kruis@science-computing.de> to fixJeremy Allison2001-07-251-1/+1
| | | | | problem with wrong token being used in current_user. Jeremy.
* Remove warning about trapdoor systems for non-root mode.Andrew Bartlett2001-06-261-0/+4
| | | | Andrew Bartlett
* rpcclient/rpcclient.c: Non-void return in void function.Jeremy Allison2001-04-281-1/+3
| | | | | | | smbd/sec_ctx.c: Fixed potential memory leak spotted by Kenichi Okuyama@Tokyo Research Lab, IBM-Japan, Co. utils/nmblookup.c: gcc warning on Solaris fix. Jeremy.
* Tidy up args to DEBUG Statements - found by gcc on Solaris.Jeremy Allison2001-04-271-5/+7
| | | | Jeremy.
* Merge of new 2.2 code into HEAD (Gerald I hate you :-) :-). Allows new SAMRJeremy Allison2001-03-111-2/+0
| | | | | | RPC code to merge with new passdb code. Currently rpcclient doesn't compile. I'm working on it... Jeremy.
* Changes from APPLIANCE_HEAD:David O'Neill2001-01-041-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | source/Makefile.in - changes to ctags and etags rules that somehow got lost along the way. source/include/proto.h - make proto source/smbd/sec_ctx.c source/smbd/password.c - merge debugs for debugging user groups and NT token stuff. source/lib/util_str.c - capitalise domain name returned from parse_domain_user() source/nsswitch/wb_client.c - fix broken conditional in debug statement. source/include/rpc_secdes.h source/include/rpc_spoolss.h source/printing/nt_printing.c source/lib/util_seaccess.c - fix printer permission bugs related to ACE masks for printers. This adds mapping of generic access rights to object specific rights for NT printers. Still need to work out whether or not to ignore ACEs with certain flags set, though. See comments in util_seaccess.c:check_ace() for details. source/printing/nt_printing.c source/printing/printing.c - use PRINTER_ACCESS_ADMINISTER instead of JOB_ACCESS_ADMINISTER until we sort out printer/printjob permission stuff.
* Added OLD_NTDOMAIN to remove warnings about undefined functions.Jeremy Allison2000-12-081-0/+2
| | | | Jeremy.
* Merge from appliance head of JR's changes for driver versioning.Jeremy Allison2000-11-141-1/+1
| | | | Jeremy.
* David Lee's utmp patch (finally). Thanks David !Jeremy Allison2000-10-281-1/+1
| | | | Jeremy.
* Sorry JF - no billable hours :-). I fixed the "stream of events" problemJeremy Allison2000-10-261-2/+0
| | | | | | | | | with PCL drivers. The problem was we were updating the changeid on every SETPRINTERDATA/DELETEPRINTERDATA call. We should not do this, we should just update the 'setprinter' called count. We update the changeid on calls to SETPRINTER/ADDPRINTER/ADDPRINTEREX etc. Also fixed the correct returning of the create time on printers. Jeremy.
* use macros for incrementing profile countersHerb Lewis2000-10-121-3/+1
|
* Added uid and gid to push_sec_ctx() debug.Tim Potter2000-10-051-2/+3
|
* Oops - missed a file.Tim Potter2000-08-281-0/+42
|
* Fixed memory leak with NT tokens.Jeremy Allison2000-08-091-5/+12
| | | | | | Added debug messages to se_access_check(). Added FULL_ACCESS acl to default acl on printers. Jeremy.
* Added an NT_USER_TOKEN structure that is copied/passed around associatedJeremy Allison2000-08-031-13/+85
| | | | | | | with the current user. This will allow se_access_check() to quickly do a SD check without having to translate uid/gid's to SIDs. Still needs work on pipe calls. Jeremy.
* Started to canonicalize our handling of uid -> sid code in order toJeremy Allison2000-08-021-7/+27
| | | | | | | | | | | | | | | | | | | | | | | | | get ready and fix se_access_check(). Added cannonical lookup_name(), lookup_sid(), uid_to_sid(), gid_to_sid() functions that look via winbind first the fall back on local lookup. All Samba should use these rather than trying to call winbindd code directly. Added NT_USER_TOKEN struct in user_struct, contains list of NT sids associated with this user. se_access_check() should use this (cached) value rather than attempting to do the same thing itself when given a uid/gid pair. More work needs to be done to preserve these things accross security context changes (especially with the tricky pipe problem) but I'm beginning to see how this will be done..... probably by registering a new vuid for an authenticated RPC pipe and not treating the pipe calls specially. More thoughts needed - but we're almost there... Jeremy.
* Fix a malloc of zero problem.Jeremy Allison2000-06-231-38/+49
| | | | Jeremy.
* lib/util_unistr.c: Off-by-one fix for dos_PutUniStr from John Reilly ↵Jeremy Allison2000-06-231-1/+5
| | | | | | | jreilly@hp.com. Memory leak fix for new sec_ctx code (sorry Tim :-). Jeremy.
* I've been working on refactoring some of the mess that is the become_user()Tim Potter2000-06-231-0/+295
code. This code is now implemented as a stack of security contexts, where a security context is defined as a set of effective user, group and supplementary group ids. The following functions are implemented: BOOL push_sec_ctx(void); Create a new security context on the stack which is the same as the current security context. void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups); Set the current security context to a given set of user and group ids. void set_root_sec_ctx(void); Set to uid = gid = 0. No supplementary groups are set. BOOL pop_sec_ctx(void); Pop a security context from the stack and restore the user and group permissions of the previous context. void init_sec_ctx(void); Initialise the security context stack. This must be called before any of the other operations are used or weird things may happen. The idea is that there is a base security context which is either root or some authenticated unix user. Other security contexts can be pushed and popped as needed for things like changing passwords, or rpc pipe operations where the rpc pipe user is different from the smb user.
generated by cgit (git 2.34.1) at 2025-09-26 19:31:51 +0000