summaryrefslogtreecommitdiffstats
path: root/source/smbd/uid.c
Commit message (Collapse)AuthorAgeFilesLines
* THE Idmap patch :-)Simo Sorce2003-04-021-2/+120
| | | | | | | | | | | | | | | | | | | includes a --with-idmap=no switch to disable idmap usage if you find problems. cosmetic fixes and param aliases to separate winbind from idamp roles. A temporarily remote idmap winbind compatibility backend. As I have time I will further change code to not call directly winbind (partly done but not tested) and a specilized module will be built in place for the current glue hack. The patch has been tested locally in my limited time, the patch is simple and clear and should not reserve problems, if any just disable it. As usual, comments and fisex are welcome :-) Simo.
* local_gid_to_sid() could use pdb_ldap, which for now requires ROOT.Andrew Bartlett2003-03-271-0/+2
|
* Fix inspired by Stefan (metze) Metzmacher - cache the sidtype also.Jeremy Allison2003-02-191-19/+27
| | | | Jeremy.
* This patch fixes one of my longest-standing pet hates with Samba :-).Andrew Bartlett2003-02-171-2/+2
| | | | | | | | | | | | | | | | | When we look see if a user is in a list, and we try to 'expand' an @group, we should lookup the user's own list of groups, rather than looking for all the members of a group. I'm sure this will fix some nasty performance issues, particularly on large domains etc. In particular, this avoids contacting winbind at all, if the group is not a winbind group. (This caused a deadlock on my winbind-on-PDC setup). The groups list always includes the user's primary group, as per the getgrouplist manpage, and my recent changes to our implementation. Andrew Bartlett
* Added code based on Michael Steffens <michael.steffens@hp.com> uid/gidJeremy Allison2003-02-121-1/+205
| | | | | | caching code. Reduces load on winbindd. Probably should be moved to use gencache at some future date. Jeremy.
* Removed global_myworkgroup, global_myname, global_myscope. Added liberalJeremy Allison2002-11-121-4/+2
| | | | | | dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy.
* Fix a nice little memory leak in our uid changing code.Andrew Bartlett2002-10-291-0/+2
| | | | Andrew Bartlett
* First cut of new ACL mapping code from Andreas Gruenbacher <agruen@suse.de>.Jeremy Allison2002-10-231-1/+1
| | | | | | | This is not 100% the same as what SuSE shipped in their Samba, there is a crash bug fix, a race condition fix, and a few logic changes I'd like to discuss with Andreas. Added Andreas to (C) notices for posix_acls.c Jeremy.
* Ensure we don't change to a user that we can't get an NT_TOKEN for.Andrew Bartlett2002-08-221-0/+4
|
* Based orginally by work by Kai, this patch moves our NT_TOKEN generation intoAndrew Bartlett2002-08-201-18/+20
| | | | | | | | | | | | | | | our authenticaion code - removing some of the duplication from the current code. This also gets us *much* closer to supporting a real SAM backend, becouse the SAM can give us the right info then. This also changes our service.c code, so that we do a VUID (rather than uid) cache on the connection struct, and do full NT ACL/NT_TOKEN checks (or cached equivilant) on every packet, for the same r or rw mode the whole share was open for. Andrew Bartlett
* Add some const to the 'in' paramaters for these functions.Andrew Bartlett2002-08-161-2/+2
| | | | Andrew Bartlett
* fix debug, at idra's suggestion.Andrew Bartlett2002-07-311-1/+1
| | | | Andrew Bartlett
* Update a pile of Samba's SID lookup code to ensure:Andrew Bartlett2002-07-301-35/+39
| | | | | | | | | | | | | | | - That we never call winbind recursivly - That we never use an 'algorithmic' RID when we have a fixed uid or gid mapping in either the passdb or the group mapping db. Also, remove restrictions that say 'this domain only'. If we have a mapping configured, allow it to be returned. If we later decide certian mappings are invalid, then we sould put that in the code that actually does the map. Allow 'sid->name' transtations on the fixed 'well known' groups for NT, even if they are not represented by Unix groups yet. Andrew Bartlett
* We must be root to access the passdb, so ensure all calls to local_lookup_sid()Andrew Bartlett2002-07-241-1/+5
| | | | | | | | have become_root()/unbecome_root() wrappers. (this should be the last of them, the rest were done ages ago). Andrew Bartlett
* Updates to the 'name -> sid' code:Andrew Bartlett2002-07-071-3/+3
| | | | | | | | | | Correct the 'none mapped' behaviour, (so that it matches Win2k) and add a function to make the SID types appear as text strings in logs/rpcclient. Also, remove a silly case that would cause 'failure' to be 'success'. (Might look at this a bit more in future). Andrew Bartlett
* Globally replace 'global_sam_sid' with get_global_sam_sid(), a selfAndrew Bartlett2002-06-071-2/+2
| | | | | | | | | initialising function. This patch thanks to the work of "Stefan (metze) Metzmacher" <metze@metzemix.de> This is partly to enable the transition to SIDs in the the passdb. Andrew Bartlett
* Better handling of uid/gid -> RID and RID -> uid/gid code.Andrew Bartlett2002-04-131-2/+3
| | | | | | | | | | | | | | | | | | | All uids and gids must create valid RIDs, becouse other code expects this, and can't handle the failure case. (ACL code in particular) Allow admins to adjust the base of the RID algorithm, so avoid clashes with users brought in from NT (for example). Put all the algorithm code back in one place, so that this change is global. Better coping with NULL sid pointers - but it still breaks a lot of stuff. BONUS: manpage entry for new paramater :-) counter based rids for normal users in tdbsam is disabled for the timebeing, idra and I will work out some things here soon I hope. Andrew Bartlett
* Much better support for both non-algorithic RIDs (where the RID is stored inAndrew Bartlett2002-04-111-5/+15
| | | | | | | | | | | | | the passdb) and RIDs not in the passdb, due to being NIS users etc. The main fix here is to add become_root()/unbecome_root() at critical places. This (finally) fixes the bug where you could not see local users's names in a file's security properties as non-root. Tested. The similar bug in uid_to_sid is also fixed, but is not (yet) Tested. Andrew Bartlett
* if we know that the SID is local then don't try via winbinddAndrew Tridgell2002-03-131-0/+5
|
* fixed mapping of SIDs for local usersAndrew Tridgell2002-03-131-1/+1
|
* Fixed compiler warning about unused variables.Tim Potter2002-03-051-5/+5
|
* this allows us to support foreign SIDs in winbindd and smbdAndrew Tridgell2002-02-271-2/+13
| | | | | | | this means "xcopy /o" has a chance of working with ACLs that contain ACEs that use SIDs that the Samba server has no knowledge of. It's a bit hackish, Tim, can you look at my uid.c changes?
* Removed version number from file header.Tim Potter2002-01-301-2/+1
| | | | Changed "SMB/Netbios" to "SMB/CIFS" in file header.
* - Provide sid->name lookup support for non-unix accounts.Andrew Bartlett2002-01-261-36/+33
| | | | | | | | | - Rework the name -> sid lookup function to always try local lookup first (for local domain names) before trying winbind. This seems to eliminate my winbind feedback loop problems. (I don't use winbind for nsswitch, where there are almost certainly further issues). Andrew Bartlett
* Rework lookup_name() to take seperate username/domain args, and to removeAndrew Bartlett2002-01-261-31/+24
| | | | | varioius crazy 'if winbind didn't find it' cases. This makes winbind default domain support easier to intergrate with smbd.
* This patch makes the 'winbind use default domain' code interact better withAndrew Bartlett2002-01-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | smbd, and also makes it much cleaner inside winbindd. It is mostly my code, with a few changes and testing performed by Alexander Bokovoy <a.bokovoy@sam-solutions.net>. ab has tested it in security=domain and security=ads, but more testing is always appricatiated. The idea is that we no longer cart around a 'domain\user' string, we keep them seperate until the last moment - when we push that string into a pwent on onto the socket. This removes the need to be constantly parsing that string - the domain prefix is almost always already provided, (only a couple of functions actually changed arguments in all this). Some consequential changes to the RPC client code, to stop it concatonating the two strings (it now passes them both back as params). I havn't changed the cache code, however the usernames will no longer have a double domain prefix in the key string. The actual structures are unchanged - but the meaning of 'username' in the 'rid' will have changed. (The cache is invalidated at startup, so on-disk formats are not an issue here). Andrew Bartlett
* A nice *big* change to the fundemental way we do things.Andrew Bartlett2002-01-171-9/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Samba (ab)uses the returns from getpwnam() a lot - in particular it keeps them around for a long time - often past the next call... This adds a getpwnam_alloc and a getpwuid_alloc to the collection. These function as expected, returning a malloced structure that can be free()ed with passwd_free(&passwd). This patch also cuts down on the number of calls to getpwnam - mostly by taking advantage of the fact that the passdb interface is already case-insensiteve. With this patch most of the recursive cases have been removed (that I know of) and the problems are reduced further by not using the sys_ interface in the new code. This means that pointers to the cache won't be affected. (This is a tempoary HACK, I intend to kill the password cache entirly). The only change I'm a little worried about is the change to rpc_server/srv_samr_nt.c for private groups. In this case we are getting groups from the new group mapping DB. Do we still need to check for private groups? I've toned down the check to a case sensitve match with the new code, but we might be able to kill it entirly. I've also added a make_modifyable_passwd() function, that copies a passwd struct into the form that the old sys_getpw* code provided. As far as I can tell this is only actually used in the pass_check.c crazies, where I moved the final 'special case' for shadow passwords (out of _Get_Pwnam()). The matching case for getpwent() is dealt with already, in lib/util_getent.c Also included in here is a small change to register the [homes] share at vuid creation rather than just in one varient of the session setup. (This picks up the SPNEGO cases). The home directory is now stored on the vuid, and I am hoping this might provide a saner way to do %H substitions. TODO: Kill off remaining Get_Pwnam_Modify calls (they are not needed), change the remaining sys_getpwnam() callers to use getpwnam_alloc() and move Get_Pwnam to return an allocated struct. Andrew Bartlett
* added a boolean to the group mapping functions to specify if we need orJean-François Micouleau2001-12-041-1/+1
| | | | | | | | | | | | | | | | | | | | | not the privileges. Usually we don't need them, so the memory is free early. lib/util_sid.c: added some helper functions to check an SID. passdb/passdb.c: renamed local_lookup_rid() to local_lookup_sid() and pass an RID all the way. If the group doesn't exist on the domain SID, don't return a faked one as it can collide with a builtin one. Some rpc structures have been badly designed, they return only rids and force the client to do subsequent lsa_lookup_sid() on the domain sid and the builtin sid ! rpc_server/srv_util.c: wrote a new version of get_domain_user_groups(). Only the samr code uses it atm. It uses the group mapping code instead of a bloody hard coded crap. The netlogon code will use it too, but I have to do some test first. J.F.
* Moved name_is_local to the correct place. Ooops.Jeremy Allison2001-12-041-10/+0
| | | | Jeremy.
* Tidyup of lib/username. Add name_is_local fn to determine if name isJeremy Allison2001-12-041-0/+10
| | | | | winbindd. Getting ready for efficiency fix in group lookups. Jeremy.
* space -> tab.Jeremy Allison2001-11-281-24/+20
| | | | Jeremy.
* Another merge from appliance-head: in [ug]id_to_sid don't call theTim Potter2001-11-261-14/+30
| | | | | winbind function if the id is obviously going to be local. Cleanup of winbind [ug]id parameter handling.
* This change updates lp_guestaccount() to be a *global* paramater, rather thanAndrew Bartlett2001-11-091-1/+1
| | | | | | | | | | | | | | | | per-share. I beleive that almost all the things that this could have done on a per-share basis can be done with other tools, like 'force user'. Almost all the user's of this paramater used it as a global anyway... While this is one step at a time, I hope it will allow me to considerably simplfy the make_connection() code, particularly for the user-level security case. This already removes an absolute truckload of extra attempted password lookups on the guest account. Andrew Bartlett
* Fixed incorrect debug message. )-:Tim Potter2001-11-081-1/+1
|
* Added NT_USER_TOKEN into server_info to fix extra groups problem.Jeremy Allison2001-11-031-1/+70
| | | | | Got "medieval on our ass" about const warnings (as many as I could :-). Jeremy.
* This commit is number 3 of 4.Andrew Bartlett2001-10-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular this commit focuses on: Changing the Get_Pwnam code so that it can work in a const-enforced environment. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes allow for 'const' in the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username
* client : Fixed error return.Jeremy Allison2001-10-191-1/+1
| | | | | uid.c: Added missing void. Jeremy.
* Merge the become_XXX -> change_to_XXX fixes from 2.2.2 to HEAD.Jeremy Allison2001-10-181-20/+122
| | | | | Ensure make_conection() can only be called as root. Jeremy.
* fixed compiler warning.Tim Potter2001-10-121-1/+1
|
* Fixes from John Trostel (modified somewhat by me) to ensure that all lookup_XXJeremy Allison2001-10-091-14/+16
| | | | | | functions correctly deal with the SID_NAME_TYPE. One fix for connection user lookup in LSA. Jeremy.
* Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter2001-10-021-2/+0
|
* Fix invalid uid being used after logoff. Thanks to Nigel WilliamsJeremy Allison2001-07-281-2/+1
| | | | | for this bug report. Jeremy.
* strchr and strrchr are macros when compiling with optimisation in gcc, so we ↵Andrew Tridgell2001-07-041-1/+1
| | | | can't redefine them. damn.
* Fixed potential bug in "become_guest" pointed out by elrond. Get_Pwnam()Jeremy Allison2001-04-151-6/+13
| | | | | | returns a pointer to changable storage so ensure we save the details and don't use the pointer directly. Jeremy.
* Fix for crash when doing name lookup with a quoted string. Part ofJeremy Allison2001-03-201-2/+1
| | | | | | lookup_name was expecting to be able to write to the string. Changed lookup_name to use const. Jeremy.
* Merge of new 2.2 code into HEAD (Gerald I hate you :-) :-). Allows new SAMRJeremy Allison2001-03-111-4/+0
| | | | | | RPC code to merge with new passdb code. Currently rpcclient doesn't compile. I'm working on it... Jeremy.
* Excise snprintf -> slprintf.Jeremy Allison2001-02-161-3/+12
| | | | | | | srv_samr.c: duplicate gid fix. srv_spoolss_nt.c: Merge of JF's work. uid.c: Fix for returning names when a PDC. Jeremy.
* rpc_server/srv_samr.c:Jeremy Allison2001-01-111-1/+1
| | | | | | | | | | | | smbd/reply.c: Added fix needed for appliances. When using winbindd - a new user may exist (from winbind) but have no home directory. Extend add user script so it is called with a %H substitution when a user exists but their home directory does not. Thanks to Alex Win at VA Linux for finding this one and testing the fix. libsmb/clidgram.c: Fixed missing return statements. smbd/uid.c: Fixed typo in debug. Jeremy.
* Removed the special casing of SIDs in se_access_check. This is now done ↵Jeremy Allison2000-12-121-1/+6
| | | | | | | (correctly) when the NT_USER_TOKEN is *created*. Jeremy.
* Merge from appliance head of JR's changes for driver versioning.Jeremy Allison2000-11-141-13/+37
| | | | Jeremy.
generated by cgit (git 2.34.1) at 2025-09-25 02:15:17 +0000