Roll back to using static MACHINE.SID after consultation with Andrew. This

code will be removed soon and a SID auto-generated from (probably) primary
hostname and never stored in a file will replace it.
Jeremy.
(This used to be commit fbfe94a799cda7f728bc920d4f0655d4f537e3b6)

4 files changed, 203 insertions, 363 deletions

diff --git a/source3/include/proto.h b/source3/include/proto.h
index b7cfb83501..215529f697 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -403,9 +403,6 @@ DOM_SID *sid_dup(DOM_SID *src);
 BOOL sid_linearize(char *outbuf, size_t len, DOM_SID *sid);
 BOOL sid_equal(DOM_SID *sid1, DOM_SID *sid2);
 size_t sid_size(DOM_SID *sid);
-BOOL read_sid(char *sam_name, DOM_SID *sid);
-BOOL write_sid(char *sam_name, DOM_SID *sid);
-BOOL create_new_sid(DOM_SID *sid);
 
 /*The following definitions come from  lib/util_sock.c  */
 
@@ -1486,7 +1483,7 @@ void pdb_set_last_set_time(char *p, int max_len, time_t t);
 void pdb_sethexpwd(char *p, unsigned char *pwd, uint16 acct_ctrl);
 BOOL pdb_gethexpwd(char *p, unsigned char *pwd);
 BOOL pdb_name_to_rid(char *user_name, uint32 *u_rid, uint32 *g_rid);
-BOOL pdb_generate_sam_sid(char *domain_name, DOM_SID *sid);
+BOOL pdb_generate_sam_sid(void);
 uid_t pdb_user_rid_to_uid(uint32 user_rid);
 gid_t pdb_user_rid_to_gid(uint32 user_rid);
 uint32 pdb_uid_to_user_rid(uid_t uid);
diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c
index f2f7b3c8ae..65bc2fe85d 100644
--- a/source3/lib/util_sid.c
+++ b/source3/lib/util_sid.c
@@ -424,291 +424,3 @@ size_t sid_size(DOM_SID *sid)
 
 	return sid->num_auths * sizeof(uint32) + 8;
 }
-
-static BOOL read_sid_from_file(int fd, char *sid_file, DOM_SID *sid)
-{   
-  fstring fline;
-	fstring sid_str;
-    
-  memset(fline, '\0', sizeof(fline));
-
-  if (read(fd, fline, sizeof(fline) -1 ) < 0) {
-    DEBUG(0,("unable to read file %s. Error was %s\n",
-           sid_file, strerror(errno) ));
-    return False;
-  }
-
-  /*
-   * Convert to the machine SID.
-   */
-
-  fline[sizeof(fline)-1] = '\0';
-  if (!string_to_sid(sid, fline)) {
-    DEBUG(0,("unable to read sid.\n"));
-    return False;
-  }
-
-	sid_to_string(sid_str, sid);
-	DEBUG(5,("read_sid_from_file: sid %s\n", sid_str));
-
-  return True;
-}
-
-/****************************************************************************
- Generate the global machine sid. Look for the DOMAINNAME.SID file first, if
- not found then look in smb.conf and use it to create the DOMAINNAME.SID file.
-****************************************************************************/
-BOOL read_sid(char *sam_name, DOM_SID *sid)
-{
-	int fd;
-	char *p;
-	pstring sid_file;
-	fstring file_name;
-	SMB_STRUCT_STAT st;
-
-	pstrcpy(sid_file, lp_smb_passwd_file());
-
-	DEBUG(10,("read_sid: Domain: %s\n", sam_name));
-
-	if (sid_file[0] == 0)
-	{
-		DEBUG(0,("cannot find smb passwd file\n"));
-		return False;
-	}
-
-	p = strrchr(sid_file, '/');
-	if (p != NULL)
-	{
-		*++p = '\0';
-	}
-
-	if (!directory_exist(sid_file, NULL))
-	{
-		if (mkdir(sid_file, 0700) != 0)
-		{
-			DEBUG(0,("can't create private directory %s : %s\n",
-				 sid_file, strerror(errno)));
-			return False;
-		}
-	}
-
-	slprintf(file_name, sizeof(file_name)-1, "%s.SID", sam_name);
-	strupper(file_name);
-	pstrcat(sid_file, file_name);
-    
-	if ((fd = sys_open(sid_file, O_RDWR | O_CREAT, 0644)) == -1) {
-		DEBUG(0,("unable to open or create file %s. Error was %s\n",
-			 sid_file, strerror(errno) ));
-		return False;
-	} 
-  
-	/*
-	 * Check if the file contains data.
-	 */
-	
-	if (sys_fstat(fd, &st) < 0) {
-		DEBUG(0,("unable to stat file %s. Error was %s\n",
-			 sid_file, strerror(errno) ));
-		close(fd);
-		return False;
-	} 
-  
-	if (st.st_size == 0)
-	{
-		close(fd);
-		return False;
-	}
-
-	/*
-	 * We have a valid SID - read it.
-	 */
-
-	if (!read_sid_from_file(fd, sid_file, sid))
-	{
-		DEBUG(0,("unable to read file %s. Error was %s\n",
-			 sid_file, strerror(errno) ));
-		close(fd);
-		return False;
-	}
-	close(fd);
-	return True;
-}   
-
-
-/****************************************************************************
- Generate the global machine sid. Look for the DOMAINNAME.SID file first, if
- not found then look in smb.conf and use it to create the DOMAINNAME.SID file.
-****************************************************************************/
-BOOL write_sid(char *sam_name, DOM_SID *sid)
-{
-	int fd;
-	char *p;
-	pstring sid_file;
-	fstring sid_string;
-	fstring file_name;
-	SMB_STRUCT_STAT st;
-
-	pstrcpy(sid_file, lp_smb_passwd_file());
-	sid_to_string(sid_string, sid);
-
-	DEBUG(10,("write_sid: Domain: %s SID: %s\n", sam_name, sid_string));
-	fstrcat(sid_string, "\n");
-
-	if (sid_file[0] == 0)
-	{
-		DEBUG(0,("cannot find smb passwd file\n"));
-		return False;
-	}
-
-	p = strrchr(sid_file, '/');
-	if (p != NULL)
-	{
-		*++p = '\0';
-	}
-
-	if (!directory_exist(sid_file, NULL)) {
-		if (mkdir(sid_file, 0700) != 0) {
-			DEBUG(0,("can't create private directory %s : %s\n",
-				 sid_file, strerror(errno)));
-			return False;
-		}
-	}
-
-	slprintf(file_name, sizeof(file_name)-1, "%s.SID", sam_name);
-	strupper(file_name);
-	pstrcat(sid_file, file_name);
-    
-	if ((fd = sys_open(sid_file, O_RDWR | O_CREAT, 0644)) == -1) {
-		DEBUG(0,("unable to open or create file %s. Error was %s\n",
-			 sid_file, strerror(errno) ));
-		return False;
-	} 
-  
-	/*
-	 * Check if the file contains data.
-	 */
-	
-	if (sys_fstat(fd, &st) < 0) {
-		DEBUG(0,("unable to stat file %s. Error was %s\n",
-			 sid_file, strerror(errno) ));
-		close(fd);
-		return False;
-	} 
-  
-	if (st.st_size > 0)
-	{
-		/*
-		 * We have a valid SID already.
-		 */
-		close(fd);
-		DEBUG(0,("SID file %s already exists\n", sid_file));
-		return False;
-	} 
-  
-	if (!do_file_lock(fd, 60, F_WRLCK))
-	{
-		DEBUG(0,("unable to lock file %s. Error was %s\n",
-			 sid_file, strerror(errno) ));
-		close(fd);
-		return False;
-	} 
-  
-	/*
-	 * At this point we have a blocking lock on the SID
-	 * file - check if in the meantime someone else wrote
-	 * SID data into the file. If so - they were here first,
-	 * use their data.
-	 */
-	
-	if (sys_fstat(fd, &st) < 0)
-	{
-		DEBUG(0,("unable to stat file %s. Error was %s\n",
-			 sid_file, strerror(errno) ));
-		close(fd);
-		return False;
-	} 
-  
-	if (st.st_size > 0)
-	{
-		/*
-		 * Unlock as soon as possible to reduce
-		 * contention on the exclusive lock.
-		 */ 
-		do_file_lock(fd, 60, F_UNLCK);
-		
-		/*
-		 * We have a valid SID already.
-		 */
-		
-		DEBUG(0,("SID file %s already exists\n", sid_file));
-		close(fd);
-		return False;
-	} 
-	
-	/*
-	 * The file is still empty and we have an exlusive lock on it.
-	 * Write out out SID data into the file.
-	 */
-	
-	if (fchmod(fd, 0644) < 0)
-	{
-		DEBUG(0,("unable to set correct permissions on file %s. \
-Error was %s\n", sid_file, strerror(errno) ));
-		close(fd);
-		return False;
-	} 
-	
-	if (write(fd, sid_string, strlen(sid_string)) != strlen(sid_string))
-	{
-		DEBUG(0,("unable to write file %s. Error was %s\n",
-			 sid_file, strerror(errno) ));
-		close(fd);
-		return False;
-	} 
-	
-	/*
-	 * Unlock & exit.
-	 */
-	
-	do_file_lock(fd, 60, F_UNLCK);
-	close(fd);
-	return True;
-}   
-
-/****************************************************************************
-create a random SID.
-****************************************************************************/
-BOOL create_new_sid(DOM_SID *sid)
-{
-	uchar raw_sid_data[12];
-	fstring sid_string;
-	int i;
-
-	/*
-	 * Generate the new sid data & turn it into a string.
-	 */
-	generate_random_buffer(raw_sid_data, 12, True);
-		
-	fstrcpy(sid_string, "S-1-5-21");
-	for(i = 0; i < 3; i++)
-	{
-		fstring tmp_string;
-		slprintf(tmp_string, sizeof(tmp_string) - 1, "-%u", IVAL(raw_sid_data, i*4));
-		fstrcat(sid_string, tmp_string);
-	}
-	
-	fstrcat(sid_string, "\n");
-	
-	/*
-	 * Ensure our new SID is valid.
-	 */
-	
-	if (!string_to_sid(sid, sid_string))
-	{
-		DEBUG(0,("unable to generate machine SID.\n"));
-		return False;
-	} 
-
-	return True;
-}
-  
diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index 272182a714..f520a11157 100644
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -797,34 +797,54 @@ BOOL pdb_name_to_rid(char *user_name, uint32 *u_rid, uint32 *g_rid)
 }
 
 /****************************************************************************
- Generate the global machine sid. Look for the DOMAINNAME.SID file first, if
- not found then look in smb.conf and use it to create the DOMAINNAME.SID file.
+ Read the machine SID from a file.
 ****************************************************************************/
-BOOL pdb_generate_sam_sid(char *domain_name, DOM_SID *sid)
+
+static BOOL read_sid_from_file(int fd, char *sid_file)
 {
+  fstring fline;
+
+  memset(fline, '\0', sizeof(fline));
+
+  if(read(fd, fline, sizeof(fline) -1 ) < 0) {
+    DEBUG(0,("unable to read file %s. Error was %s\n",
+           sid_file, strerror(errno) ));
+    return False;
+  }
+
+  /*
+   * Convert to the machine SID.
+   */
+
+  fline[sizeof(fline)-1] = '\0';
+  if(!string_to_sid( &global_sam_sid, fline)) {
+    DEBUG(0,("unable to generate machine SID.\n"));
+    return False;
+  }
+
+  return True;
+}
+
+/****************************************************************************
+ Generate the global machine sid. Look for the MACHINE.SID file first, if
+ not found then look in smb.conf and use it to create the MACHINE.SID file.
+ Note this function will be replaced soon. JRA.
+****************************************************************************/
+
+BOOL pdb_generate_sam_sid(void)
+{
+	int fd;
 	char *p;
 	pstring sid_file;
-	pstring machine_sid_file;
-	fstring file_name;
+	fstring sid_string;
+	SMB_STRUCT_STAT st;
+	BOOL overwrite_bad_sid = False;
 
 	generate_wellknown_sids();
 
-	if (sid == NULL)
-	{
-		sid = &global_sam_sid;
-	}
-
 	pstrcpy(sid_file, lp_smb_passwd_file());
-
-	if (sid_file[0] == 0)
-	{
-		DEBUG(0,("cannot find smb passwd file\n"));
-		return False;
-	}
-
 	p = strrchr(sid_file, '/');
-	if (p != NULL)
-	{
+	if(p != NULL) {
 		*++p = '\0';
 	}
 
@@ -836,53 +856,177 @@ BOOL pdb_generate_sam_sid(char *domain_name, DOM_SID *sid)
 		}
 	}
 
-	pstrcpy(machine_sid_file, sid_file);
-	pstrcat(machine_sid_file, "MACHINE.SID");
-
-	slprintf(file_name, sizeof(file_name)-1, "%s.SID", domain_name);
-	strupper(file_name);
-	pstrcat(sid_file, file_name);
+	pstrcat(sid_file, "MACHINE.SID");
     
-	if (file_exist(machine_sid_file, NULL))
-	{
-		if (file_exist(sid_file, NULL))
-		{
-			DEBUG(0,("both %s and %s exist when only one should, unable to continue\n",
-			          machine_sid_file, sid_file));
+	if((fd = sys_open(sid_file, O_RDWR | O_CREAT, 0644)) == -1) {
+		DEBUG(0,("unable to open or create file %s. Error was %s\n",
+			 sid_file, strerror(errno) ));
+		return False;
+	} 
+  
+	/*
+	 * Check if the file contains data.
+	 */
+	
+	if(sys_fstat( fd, &st) < 0) {
+		DEBUG(0,("unable to stat file %s. Error was %s\n",
+			 sid_file, strerror(errno) ));
+		close(fd);
+		return False;
+	} 
+  
+	if(st.st_size > 0) {
+		/*
+		 * We have a valid SID - read it.
+		 */
+		if(!read_sid_from_file( fd, sid_file)) {
+			DEBUG(0,("unable to read file %s. Error was %s\n",
+				 sid_file, strerror(errno) ));
+			close(fd);
 			return False;
 		}
-		if (file_rename(machine_sid_file, sid_file))
-		{
-			DEBUG(0,("could not rename %s to %s.  Error was %s\n",
-			          machine_sid_file, sid_file, strerror(errno)));
-			return False;
+
+		/*
+		 * JRA. Reversed the sense of this test now that I have
+		 * actually done this test *personally*. One more reason
+		 * to never trust third party information you have not
+		 * independently verified.... sigh. JRA.
+		 */
+
+		if(global_sam_sid.num_auths > 0 && global_sam_sid.sub_auths[0] == 0x21) {
+			/*
+			 * Fix and re-write...
+			 */
+			overwrite_bad_sid = True;
+			global_sam_sid.sub_auths[0] = 21;
+			DEBUG(5,("pdb_generate_sam_sid: Old (incorrect) sid id_auth of hex 21 \
+detected - re-writing to be decimal 21 instead.\n" ));
+			sid_to_string(sid_string, &global_sam_sid);
+			if(sys_lseek(fd, (SMB_OFF_T)0, SEEK_SET) != 0) {
+				DEBUG(0,("unable to seek file file %s. Error was %s\n",
+					 sid_file, strerror(errno) ));
+				close(fd);
+				return False;
+			}
+		} else {
+			close(fd);
+			return True;
 		}
-	}
+	} else {
+		/*
+		 * The file contains no data - we need to generate our
+		 * own sid.
+		 * Generate the new sid data & turn it into a string.
+		 */
+		int i;
+		uchar raw_sid_data[12];
+		DOM_SID mysid;
+
+		memset((char *)&mysid, '\0', sizeof(DOM_SID));
+		mysid.sid_rev_num = 1;
+		mysid.id_auth[5] = 5;
+		mysid.num_auths = 0;
+		mysid.sub_auths[mysid.num_auths++] = 21;
+
+		generate_random_buffer( raw_sid_data, 12, True);
+		for( i = 0; i < 3; i++)
+			mysid.sub_auths[mysid.num_auths++] = IVAL(raw_sid_data, i*4);
+
+		sid_to_string(sid_string, &mysid);
+	} 
 	
-	/* attempt to read the SID from the file */
-	if (read_sid(domain_name, sid))
-	{
-		return True;
-	}
+	fstrcat(sid_string, "\n");
+	
+	/*
+	 * Ensure our new SID is valid.
+	 */
+	
+	if(!string_to_sid( &global_sam_sid, sid_string)) {
+		DEBUG(0,("unable to generate machine SID.\n"));
+		return False;
+	} 
   
-	if (!create_new_sid(sid))
-	{
+	/*
+	 * Do an exclusive blocking lock on the file.
+	 */
+	
+	if(!do_file_lock( fd, 60, F_WRLCK)) {
+		DEBUG(0,("unable to lock file %s. Error was %s\n",
+			 sid_file, strerror(errno) ));
+		close(fd);
 		return False;
-	}
-	/* attempt to read the SID from the file */
-	if (!write_sid(domain_name, sid))
-	{
-		return True;
-	}
+	} 
+ 
+	if(!overwrite_bad_sid) {
+		/*
+		 * At this point we have a blocking lock on the SID
+		 * file - check if in the meantime someone else wrote
+		 * SID data into the file. If so - they were here first,
+		 * use their data.
+		 */
+	
+		if(sys_fstat( fd, &st) < 0) {
+			DEBUG(0,("unable to stat file %s. Error was %s\n",
+				 sid_file, strerror(errno) ));
+			close(fd);
+			return False;
+		} 
   
-	/* during the attempt to write, someone else wrote? */
-
-	/* attempt to read the SID from the file */
-	if (read_sid(domain_name, sid))
-	{
-		return True;
+		if(st.st_size > 0) {
+			/*
+			 * Unlock as soon as possible to reduce
+			 * contention on the exclusive lock.
+			 */ 
+			do_file_lock( fd, 60, F_UNLCK);
+		
+			/*
+			 * We have a valid SID - read it.
+			 */
+		
+			if(!read_sid_from_file( fd, sid_file)) {
+				DEBUG(0,("unable to read file %s. Error was %s\n",
+					 sid_file, strerror(errno) ));
+				close(fd);
+				return False;
+			}
+			close(fd);
+			return True;
+		} 
 	}
-  
+	
+	/*
+	 * The file is still empty and we have an exlusive lock on it,
+	 * or we're fixing an earlier mistake.
+	 * Write out out SID data into the file.
+	 */
+
+	/*
+	 * Use chmod here as some (strange) UNIX's don't
+	 * have fchmod. JRA.
+	 */	
+
+	if(chmod(sid_file, 0644) < 0) {
+		DEBUG(0,("unable to set correct permissions on file %s. \
+Error was %s\n", sid_file, strerror(errno) ));
+		do_file_lock( fd, 60, F_UNLCK);
+		close(fd);
+		return False;
+	} 
+	
+	if(write( fd, sid_string, strlen(sid_string)) != strlen(sid_string)) {
+		DEBUG(0,("unable to write file %s. Error was %s\n",
+			 sid_file, strerror(errno) ));
+		do_file_lock( fd, 60, F_UNLCK);
+		close(fd);
+		return False;
+	} 
+	
+	/*
+	 * Unlock & exit.
+	 */
+	
+	do_file_lock( fd, 60, F_UNLCK);
+	close(fd);
 	return True;
 }   
 /*******************************************************************
diff --git a/source3/smbd/server.c b/source3/smbd/server.c
index 576f6d14d2..00ea801cca 100644
--- a/source3/smbd/server.c
+++ b/source3/smbd/server.c
@@ -530,8 +530,6 @@ static void usage(char *pname)
 ****************************************************************************/
  int main(int argc,char *argv[])
 {
-	fstring sam_name;
-
 	extern BOOL append_log;
 	/* shall I run as a daemon */
 	BOOL is_daemon = False;
@@ -766,18 +764,7 @@ static void usage(char *pname)
 	/* possibly reload the services file. */
 	reload_services(True);
 
-	/* obtain or create a SAM SID */
-	if (lp_domain_logons())
-	{
-		fstrcpy(sam_name, global_myworkgroup);
-	}
-	else
-	{
-		fstrcpy(sam_name, global_myname);
-	}
-
-	if(!pdb_generate_sam_sid(sam_name, NULL))
-	{
+	if(!pdb_generate_sam_sid()) {
 		DEBUG(0,("ERROR: Samba cannot create a SAM SID.\n"));
 		exit(1);
 	}