summaryrefslogtreecommitdiffstats
path: root/source
Commit message (Collapse)AuthorAgeFilesLines
...
* r23485: This checkin consists mostly of refactorings in preparation of theMichael Adam2007-10-1010-680/+874
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | activation of global registry options in loadparm.c, mainly to extract functionality from net_conf.c to be made availabel elsewhere and to minimize linker dependencies. In detail: * move functions registry_push/pull_value from lib/util_reg.c to new file lib/util_reg_api.c * create a fake user token consisting of builtin administrators sid and se_disk_operators privilege by hand instead of using get_root_nt_token() to minimize linker deps for bin/net. + new function registry_create_admin_token() in new lib/util_reg_smbconf.c + move dup_nt_token from auth/token_util.c to new file lib/util_nttoken.c + adapt net_conf.c and Makefile.in accordingly. * split lib/profiles.c into two parts: new file lib/profiles_basic.c takes all the low level mask manipulation and format conversion functions (se_priv, privset, luid). the privs array is completely hidden from profiles.c by adding some access-functions. some mask-functions are not static anymore. Generally, SID- and LUID-related stuff that has more dependencies is kept in lib/profiles.c * Move initialization of regdb from net_conf.c into a function registry_init_regdb() in lib/util_reg_smbconf.c. Michael
* r23483: Revert 23482, I must have run 'make test' in the wrong subdir.Volker Lendecke2007-10-101-14/+18
|
* r23482: Slightly simplify the rename code: Remove two local variables that areVolker Lendecke2007-10-101-18/+14
| | | | not really needed.
* r23480: Fix DEVELOPER_CFLAGS quoting.James Peach2007-10-101-1/+1
|
* r23478: Change the handling of the developer CFLAGS so that they are alwaysJames Peach2007-10-102-13/+32
| | | | | | | emited to the Makefile in the DEVELOPER_CFLAGS variable. This makes it easy to turn developer mode on and off without waiting for configure to run. The developer flags are only added to CFLAGS for the --enable-developer and --enable-krb5developer cases.
* r23477: Build farm fix: Use int rather than MIT's krb5_int32 when setting ↵Gerald Carter2007-10-101-1/+1
| | | | context flags.
* r23475: Fix the prototype for sys_broken_setgroups and log *BSD group listJames Peach2007-10-101-2/+2
| | | | truncation a bit more verbosely.
* r23474: Here's a small patch that disables the libkrb5.so replay cacheGerald Carter2007-10-104-42/+68
| | | | | | | | | | | | | | | | | | when verifying a ticket from winbindd_pam.c. I've found during multiple, fast, automated SSH logins (such as from a cron script) that the replay cache in MIT's krb5 lib will occasionally fail the krb5_rd_req() as a replay attack. There seems to be a small window during which the MIT krb5 libs could reproduce identical time stamps for ctime and cusec in the authenticator since Unix systems only give back milli-seconds rather than the micro-seconds needed by the authenticator. Checked against MIT 1.5.1. Have not researched how Heimdal does it. My thinking is that if someone can spoof the KDC and TDS services we are pretty hopeless anyways.
* r23472: add missing default setting for 'winbind nss info' (merge from 3.0.26)Gerald Carter2007-10-101-0/+1
|
* r23471: Here's a rough patch for expanding domain group membershipGerald Carter2007-10-103-155/+351
| | | | | | | | | | | | in the winbindd_getgrnam() call. Couple of comments: * Adds "winbind expand groups" parameter which defines the max depth winbindd will expand group members. The default is the current behavior of one level of expansion. * The entire getrgnam() interface should be async. I haven't done that. * Refactors the domain users hack in fill_grent_mem() into its own function.
* r23470: Fix supplementary group list truncation for *BSD. We need to passJames Peach2007-10-101-2/+8
| | | | | the correct group list length and only truncate to NGROUPS_MAX if it is too long.
* r23469: Fix a commentVolker Lendecke2007-10-101-1/+1
|
* r23468: Open registry.tdb with sequence number.Michael Adam2007-10-101-3/+15
| | | | | | | | | Add a function to retrieve the registry db sequence number. This is in preparation of loadparm integration of registry global smb.conf options: this will allow to detect changes in order to trigger reload. Michael
* r23467: Next little simplification: In rename_internals it's a bit pointless toVolker Lendecke2007-10-101-38/+13
| | | | | | first ask for existence of a file when we do the open_file_ntcreate in can_rename later on anyway. That also gets us the right error message in case the file is not there automatically.
* r23466: Fix RAW-NOTIFY: by using delete on close the notify is triggered deepVolker Lendecke2007-10-101-6/+0
| | | | inside close_file() already.
* r23465: There was this diff between reg_printing in 3_0 and 3_0_26:Michael Adam2007-10-101-1/+4
| | | | | | | | | | | before writing to secdesc_buf->sd, 3_0 checked secdesc_buf->sd while 3_0_26 checked secdesc_buf->sd_size. This patch makes both revisions check _both_ befor writing. Jerry / Jeremy : please check if this is correct! Michael
* r23460: Re-add whitespace to reduce diff between branches.Michael Adam2007-10-101-1/+1
| | | | | | Sorry for the noise... Michael
* r23459: Remove one superfluous cast.Michael Adam2007-10-101-1/+1
|
* r23458: Cosmetic fix in debug output.Michael Adam2007-10-101-1/+1
|
* r23457: After Jeremy's ack:Volker Lendecke2007-10-101-24/+29
| | | | | | | | | | | | | | The attached patch removes a little race condition for people with real kernel oplock support, and reduces some code paths. It changes reply_unlink to open_file_ntcreate, set_delete_on_close and close_file. The race condition happens if we break the oplock in can_delete via open_file_ntcreate, we close the file, someone else gets a batch oplock and we try to unlink. It reduces code paths by calling SMB_VFS_UNLINK in 2 fewer places.
* r23450: max_params_return is complete fiction when getting a changenotifyJeremy Allison2007-10-102-18/+6
| | | | | | request. Ignore it. Should fix bug #4689 but more tests and valgrinding will follow. Jeremy.
* r23448: Doh ! Don't call winbind_child_died() *before* theJeremy Allison2007-10-101-7/+6
| | | | | kill call as that sets pid = 0 ! :-). Jeremy.
* r23447: Add kill signal to child dead path. After talkingJeremy Allison2007-10-101-0/+3
| | | | | to Jerry add to 3.0.25b. Jeremy.
* r23446: Restore Jeremy's original formatting, just fix the comment.Volker Lendecke2007-10-101-21/+17
|
* r23445: Fix suggested by Volker. Don't call rename_open_filesJeremy Allison2007-10-101-2/+0
| | | | | if the name wasn't changed. Jeremy.
* r23434: Coorect a comment.Michael Adam2007-10-101-1/+1
|
* r23433: remove superfluous semicolon.Michael Adam2007-10-101-1/+1
|
* r23432: Remove superfluous comment.Michael Adam2007-10-101-2/+0
| | | | | | (A relict from regkey_open_internal days.) Michael
* r23429: Ooops, sorry.Volker Lendecke2007-10-101-3/+3
| | | | | | Revert an accidential checkin of r23410. Volker
* r23426: Correct a comment. The default timeout is not 1min, but 30s. WhileVolker Lendecke2007-10-101-17/+21
| | | | | | | | there, do some reformatting. Jeremy, I think we should also kill the child. It might hang in something (an fcntl lock for example) that the next child might run into immediately again.
* r23425: Volker noticed this obvious fix for the wins serverJeremy Allison2007-10-101-2/+2
| | | | | code :-). Thanks Volker ! Jeremy.
* r23424: Thanks to Jerry, we finally tracked down the :Jeremy Allison2007-10-101-0/+62
| | | | | | winbindd: Exceeding 200 client connections, no idle connection found" bug #3204. This fixes it in Jerry's testing ! Jeremy.
* r23423: Use the correct structure types in the NT_ACL operations. It's notJames Peach2007-10-101-2/+2
| | | | | clear to my why the catia module feels it's necessary to implement these operations, but at least they're now the right type.
* r23411: We were missing displayName and that was preventing usSimo Sorce2007-10-101-0/+1
| | | | | | | | from successfully deleting an entry when "account" is the STRUCTURAL objectclass used for users and machines. "account" is used each time the user entry is in /etc/passwd and we have only the samba attributes in ldap, as well as for rfc2307(bis) standard based directories.
* r23410: Merge the core of the cluster code.Volker Lendecke2007-10-1022-18/+2396
| | | | | | | | | | | | | | | | I'm 100% certain I've forgotten to merge something, but the main code should be in. It's mainly in dbwrap_ctdb.c, ctdbd_conn.c and messages_ctdbd.c. There should be no changes to the non-cluster case, it does survive make test on my laptop. It survives some very basic tests with ctdbd enables, I did not do the full test suite for clusters yet. Phew... Volker
* r23408: Remove a bogus commentVolker Lendecke2007-10-101-1/+0
|
* r23407: While verifying a bug I found out that for some reasonSimo Sorce2007-10-101-17/+14
| | | | | | | | | | | the code to add a machine was different then the one used to add a user, the old code led to the machine SID not being built out correctly allocationg a new RID out of the passdb but instead by using the old algorithmic method. This may easily end up in creating duplicated SID when the RID counter get close to the values built by the algorithmic method. Simo.
* r23406: Evn if not strictly currently necessary do check for correctSimo Sorce2007-10-102-0/+16
| | | | | | init also in idmap_nss and idmap_passdb for coherency and to prevent errors in future if we change the init functions to actually do something and not just return NT_STATUS_OK
* r23404: Fix wrong (and missing) action on error condition in ldap reply ↵Simo Sorce2007-10-101-1/+5
| | | | | | evaluation loop Fixes one of the segfaults in bug #4667
* r23402: Got bitten by a talloc hierarchy. Make sure we allocJeremy Allison2007-10-101-3/+3
| | | | | | off the pipe ctx now ->names is part of the containing struct. Jeremy.
* r23400: Fix lsa crash bug #4683. The "names" enum structJeremy Allison2007-10-104-44/+23
| | | | | | | | | | | in a lookup_sidX reply isn't optional - like the lookup_sidX query it needs to be defined in the struct. All this will go away with PIDL (thank goodness....). Jerry - I think this is a showstopper to be merged for 3.0.25b. I'll be watching the build farm to see if anything broke. Jeremy.
* r23398: Support membership of >16 groups on Darwin by making sure we opt in ↵James Peach2007-10-102-0/+64
| | | | | | to the dynamic group resolution mechanism when switching UNIX credentials.
* r23396: Make VFS callbacks static. Mark operations as OPAQUE because theyJames Peach2007-10-101-8/+9
| | | | do not pass through.
* r23393: Support BSD group semantics by making sure that the effective GID is ↵James Peach2007-10-103-27/+103
| | | | | | always passed as the first GID when calling setgroups(2).
* r23391: Second part of the patch for Apple.Jeremy Allison2007-10-101-14/+22
| | | | | | | | | | | | | | | | | Change the sequence : gain_root(); sys_setgroups(ngroups, groups); become_id(uid, gid); to a function call : set_unix_security_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups) James - should be safe for you to create a Darwin-specific version of this function now. Jeremy.
* r23390: First part of the patch to make Apple's life easier.Jeremy Allison2007-10-101-6/+6
| | | | | | | | | | | | | | | | Doing this in two stages to make it very easy to review. Context switching must look like : gain_root(); sys_setgroups(ngroups, groups); become_id(uid, gid); Re-arrange order so these three calls are always seen together. Next will be to turn these into a function. Jeremy.
* r23389: Disabling ACL support on Darwin/Mac OS X for now.Michael Adam2007-10-101-1/+5
| | | | | | | | | | | | | Current configure check detects posix ACL support but compile of modules/vfs_posixacl.c fails due to missing defines in sys/acl.h: ACL_USER, ACL_USER_OBJ, ACL_GROUP, ACL_GROUP_OBJ, ACL_OTHER, ACL_MASK, ACL_WRITE, ACL_READ It has to be investigated, if this can be fixed within the posixacl vfs module or if we need a darwinacl module. Michael
* r23387: 1. This unifies the POSIX ACL detection code:Michael Adam2007-10-101-75/+40
| | | | | | | | | | | | | | | | | Linux, FreeBSD and other (which?) ACL implementations are now checked in the same block instead of in three separate blocks. This was inspired by Timur Bakeyev in Bug #4543. Since bugzilla is currently unavailable this patch is probably slightly different from Timurs original patch. This should finally fix Bug #4543. 2. The default of the --with-acl-support configure option is changed to "auto" (which is actually the same as "yes"). So configure tries to detect acl support by default. This had been discussed with Metze and others. Michael
* r23380: netr_getdcname returns WERROR not NTSTATUS.Günther Deschner2007-10-104-16/+16
| | | | Guenther
* r23379: Whitespace cosmetics, to reduce irritating diffs...Michael Adam2007-10-102-2/+2
| | | | Michael
generated by cgit (git 2.34.1) at 2025-09-26 11:12:44 +0000