diff options
| author | Jeremy Allison <jra@samba.org> | 2000-08-04 00:59:09 +0000 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2000-08-04 00:59:09 +0000 |
| commit | 06e4f11acd3aedd6c8e4adf365932a01eca902b8 (patch) | |
| tree | 07a8837ca9915b56fa0829a537f1e8a68f4e5a0c /source3/rpc_server | |
| parent | f87399915b009f88c41cb75a583c2972fe3daf30 (diff) | |
| download | samba-06e4f11acd3aedd6c8e4adf365932a01eca902b8.tar.gz samba-06e4f11acd3aedd6c8e4adf365932a01eca902b8.tar.bz2 samba-06e4f11acd3aedd6c8e4adf365932a01eca902b8.zip | |
Fixed up the user/group contexts when using authenticated pipes.
Added a become_root()/unbecome_root() (push/pop security context)
around the initgroups() call to ensure it would succeed. Hmmm - I
wonder if this call being done as non-root might explain any "group access"
bugs we've had in the past....
Jeremy.
(This used to be commit 06a65972e872f37d88b84f22ea714feebd38f6c0)
Diffstat (limited to 'source3/rpc_server')
| -rw-r--r-- | source3/rpc_server/srv_pipe.c | 13 | ||||
| -rw-r--r-- | source3/rpc_server/srv_pipe_hnd.c | 3 |
2 files changed, 15 insertions, 1 deletions
diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c index 049db69ca7..ded01e4e21 100644 --- a/source3/rpc_server/srv_pipe.c +++ b/source3/rpc_server/srv_pipe.c @@ -282,6 +282,11 @@ static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlm memset(p->domain, '\0', sizeof(p->domain)); memset(p->wks, '\0', sizeof(p->wks)); + /* Set up for non-authenticated user. */ + delete_nt_token(&p->pipe_user.nt_user_token); + p->pipe_user.ngroups = 0; + safe_free( p->pipe_user.groups); + /* * Setup an empty password for a guest user. */ @@ -456,7 +461,13 @@ failed authentication on named pipe %s.\n", domain, pipe_user_name, wks, p->name p->pipe_user.uid = pass->pw_uid; p->pipe_user.gid = pass->pw_gid; - /* XXX also set up pipe user group membership */ + /* Set up pipe user group membership. */ + initialize_groups(pipe_user_name, p->pipe_user.uid, p->pipe_user.gid); + get_current_groups( &p->pipe_user.ngroups, &p->pipe_user.groups); + + /* Create an NT_USER_TOKEN struct for this user. */ + p->pipe_user.nt_user_token = create_nt_token(p->pipe_user.uid,p->pipe_user.gid, + p->pipe_user.ngroups, p->pipe_user.groups); p->ntlmssp_auth_validated = True; return True; diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c index e6aeb26d63..b8ee235185 100644 --- a/source3/rpc_server/srv_pipe_hnd.c +++ b/source3/rpc_server/srv_pipe_hnd.c @@ -825,6 +825,9 @@ BOOL close_rpc_pipe_hnd(pipes_struct *p, connection_struct *conn) DLIST_REMOVE(Pipes, p); + delete_nt_token(&p->pipe_user.nt_user_token); + safe_free(p->pipe_user.groups); + ZERO_STRUCTP(p); free(p); |