summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--source3/include/proto.h5
-rw-r--r--source3/lib/util_sid.c288
-rw-r--r--source3/passdb/passdb.c258
-rw-r--r--source3/smbd/server.c15
4 files changed, 203 insertions, 363 deletions
diff --git a/source3/include/proto.h b/source3/include/proto.h
index b7cfb83501..215529f697 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -403,9 +403,6 @@ DOM_SID *sid_dup(DOM_SID *src);
BOOL sid_linearize(char *outbuf, size_t len, DOM_SID *sid);
BOOL sid_equal(DOM_SID *sid1, DOM_SID *sid2);
size_t sid_size(DOM_SID *sid);
-BOOL read_sid(char *sam_name, DOM_SID *sid);
-BOOL write_sid(char *sam_name, DOM_SID *sid);
-BOOL create_new_sid(DOM_SID *sid);
/*The following definitions come from lib/util_sock.c */
@@ -1486,7 +1483,7 @@ void pdb_set_last_set_time(char *p, int max_len, time_t t);
void pdb_sethexpwd(char *p, unsigned char *pwd, uint16 acct_ctrl);
BOOL pdb_gethexpwd(char *p, unsigned char *pwd);
BOOL pdb_name_to_rid(char *user_name, uint32 *u_rid, uint32 *g_rid);
-BOOL pdb_generate_sam_sid(char *domain_name, DOM_SID *sid);
+BOOL pdb_generate_sam_sid(void);
uid_t pdb_user_rid_to_uid(uint32 user_rid);
gid_t pdb_user_rid_to_gid(uint32 user_rid);
uint32 pdb_uid_to_user_rid(uid_t uid);
diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c
index f2f7b3c8ae..65bc2fe85d 100644
--- a/source3/lib/util_sid.c
+++ b/source3/lib/util_sid.c
@@ -424,291 +424,3 @@ size_t sid_size(DOM_SID *sid)
return sid->num_auths * sizeof(uint32) + 8;
}
-
-static BOOL read_sid_from_file(int fd, char *sid_file, DOM_SID *sid)
-{
- fstring fline;
- fstring sid_str;
-
- memset(fline, '\0', sizeof(fline));
-
- if (read(fd, fline, sizeof(fline) -1 ) < 0) {
- DEBUG(0,("unable to read file %s. Error was %s\n",
- sid_file, strerror(errno) ));
- return False;
- }
-
- /*
- * Convert to the machine SID.
- */
-
- fline[sizeof(fline)-1] = '\0';
- if (!string_to_sid(sid, fline)) {
- DEBUG(0,("unable to read sid.\n"));
- return False;
- }
-
- sid_to_string(sid_str, sid);
- DEBUG(5,("read_sid_from_file: sid %s\n", sid_str));
-
- return True;
-}
-
-/****************************************************************************
- Generate the global machine sid. Look for the DOMAINNAME.SID file first, if
- not found then look in smb.conf and use it to create the DOMAINNAME.SID file.
-****************************************************************************/
-BOOL read_sid(char *sam_name, DOM_SID *sid)
-{
- int fd;
- char *p;
- pstring sid_file;
- fstring file_name;
- SMB_STRUCT_STAT st;
-
- pstrcpy(sid_file, lp_smb_passwd_file());
-
- DEBUG(10,("read_sid: Domain: %s\n", sam_name));
-
- if (sid_file[0] == 0)
- {
- DEBUG(0,("cannot find smb passwd file\n"));
- return False;
- }
-
- p = strrchr(sid_file, '/');
- if (p != NULL)
- {
- *++p = '\0';
- }
-
- if (!directory_exist(sid_file, NULL))
- {
- if (mkdir(sid_file, 0700) != 0)
- {
- DEBUG(0,("can't create private directory %s : %s\n",
- sid_file, strerror(errno)));
- return False;
- }
- }
-
- slprintf(file_name, sizeof(file_name)-1, "%s.SID", sam_name);
- strupper(file_name);
- pstrcat(sid_file, file_name);
-
- if ((fd = sys_open(sid_file, O_RDWR | O_CREAT, 0644)) == -1) {
- DEBUG(0,("unable to open or create file %s. Error was %s\n",
- sid_file, strerror(errno) ));
- return False;
- }
-
- /*
- * Check if the file contains data.
- */
-
- if (sys_fstat(fd, &st) < 0) {
- DEBUG(0,("unable to stat file %s. Error was %s\n",
- sid_file, strerror(errno) ));
- close(fd);
- return False;
- }
-
- if (st.st_size == 0)
- {
- close(fd);
- return False;
- }
-
- /*
- * We have a valid SID - read it.
- */
-
- if (!read_sid_from_file(fd, sid_file, sid))
- {
- DEBUG(0,("unable to read file %s. Error was %s\n",
- sid_file, strerror(errno) ));
- close(fd);
- return False;
- }
- close(fd);
- return True;
-}
-
-
-/****************************************************************************
- Generate the global machine sid. Look for the DOMAINNAME.SID file first, if
- not found then look in smb.conf and use it to create the DOMAINNAME.SID file.
-****************************************************************************/
-BOOL write_sid(char *sam_name, DOM_SID *sid)
-{
- int fd;
- char *p;
- pstring sid_file;
- fstring sid_string;
- fstring file_name;
- SMB_STRUCT_STAT st;
-
- pstrcpy(sid_file, lp_smb_passwd_file());
- sid_to_string(sid_string, sid);
-
- DEBUG(10,("write_sid: Domain: %s SID: %s\n", sam_name, sid_string));
- fstrcat(sid_string, "\n");
-
- if (sid_file[0] == 0)
- {
- DEBUG(0,("cannot find smb passwd file\n"));
- return False;
- }
-
- p = strrchr(sid_file, '/');
- if (p != NULL)
- {
- *++p = '\0';
- }
-
- if (!directory_exist(sid_file, NULL)) {
- if (mkdir(sid_file, 0700) != 0) {
- DEBUG(0,("can't create private directory %s : %s\n",
- sid_file, strerror(errno)));
- return False;
- }
- }
-
- slprintf(file_name, sizeof(file_name)-1, "%s.SID", sam_name);
- strupper(file_name);
- pstrcat(sid_file, file_name);
-
- if ((fd = sys_open(sid_file, O_RDWR | O_CREAT, 0644)) == -1) {
- DEBUG(0,("unable to open or create file %s. Error was %s\n",
- sid_file, strerror(errno) ));
- return False;
- }
-
- /*
- * Check if the file contains data.
- */
-
- if (sys_fstat(fd, &st) < 0) {
- DEBUG(0,("unable to stat file %s. Error was %s\n",
- sid_file, strerror(errno) ));
- close(fd);
- return False;
- }
-
- if (st.st_size > 0)
- {
- /*
- * We have a valid SID already.
- */
- close(fd);
- DEBUG(0,("SID file %s already exists\n", sid_file));
- return False;
- }
-
- if (!do_file_lock(fd, 60, F_WRLCK))
- {
- DEBUG(0,("unable to lock file %s. Error was %s\n",
- sid_file, strerror(errno) ));
- close(fd);
- return False;
- }
-
- /*
- * At this point we have a blocking lock on the SID
- * file - check if in the meantime someone else wrote
- * SID data into the file. If so - they were here first,
- * use their data.
- */
-
- if (sys_fstat(fd, &st) < 0)
- {
- DEBUG(0,("unable to stat file %s. Error was %s\n",
- sid_file, strerror(errno) ));
- close(fd);
- return False;
- }
-
- if (st.st_size > 0)
- {
- /*
- * Unlock as soon as possible to reduce
- * contention on the exclusive lock.
- */
- do_file_lock(fd, 60, F_UNLCK);
-
- /*
- * We have a valid SID already.
- */
-
- DEBUG(0,("SID file %s already exists\n", sid_file));
- close(fd);
- return False;
- }
-
- /*
- * The file is still empty and we have an exlusive lock on it.
- * Write out out SID data into the file.
- */
-
- if (fchmod(fd, 0644) < 0)
- {
- DEBUG(0,("unable to set correct permissions on file %s. \
-Error was %s\n", sid_file, strerror(errno) ));
- close(fd);
- return False;
- }
-
- if (write(fd, sid_string, strlen(sid_string)) != strlen(sid_string))
- {
- DEBUG(0,("unable to write file %s. Error was %s\n",
- sid_file, strerror(errno) ));
- close(fd);
- return False;
- }
-
- /*
- * Unlock & exit.
- */
-
- do_file_lock(fd, 60, F_UNLCK);
- close(fd);
- return True;
-}
-
-/****************************************************************************
-create a random SID.
-****************************************************************************/
-BOOL create_new_sid(DOM_SID *sid)
-{
- uchar raw_sid_data[12];
- fstring sid_string;
- int i;
-
- /*
- * Generate the new sid data & turn it into a string.
- */
- generate_random_buffer(raw_sid_data, 12, True);
-
- fstrcpy(sid_string, "S-1-5-21");
- for(i = 0; i < 3; i++)
- {
- fstring tmp_string;
- slprintf(tmp_string, sizeof(tmp_string) - 1, "-%u", IVAL(raw_sid_data, i*4));
- fstrcat(sid_string, tmp_string);
- }
-
- fstrcat(sid_string, "\n");
-
- /*
- * Ensure our new SID is valid.
- */
-
- if (!string_to_sid(sid, sid_string))
- {
- DEBUG(0,("unable to generate machine SID.\n"));
- return False;
- }
-
- return True;
-}
-
diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index 272182a714..f520a11157 100644
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -797,34 +797,54 @@ BOOL pdb_name_to_rid(char *user_name, uint32 *u_rid, uint32 *g_rid)
}
/****************************************************************************
- Generate the global machine sid. Look for the DOMAINNAME.SID file first, if
- not found then look in smb.conf and use it to create the DOMAINNAME.SID file.
+ Read the machine SID from a file.
****************************************************************************/
-BOOL pdb_generate_sam_sid(char *domain_name, DOM_SID *sid)
+
+static BOOL read_sid_from_file(int fd, char *sid_file)
{
+ fstring fline;
+
+ memset(fline, '\0', sizeof(fline));
+
+ if(read(fd, fline, sizeof(fline) -1 ) < 0) {
+ DEBUG(0,("unable to read file %s. Error was %s\n",
+ sid_file, strerror(errno) ));
+ return False;
+ }
+
+ /*
+ * Convert to the machine SID.
+ */
+
+ fline[sizeof(fline)-1] = '\0';
+ if(!string_to_sid( &global_sam_sid, fline)) {
+ DEBUG(0,("unable to generate machine SID.\n"));
+ return False;
+ }
+
+ return True;
+}
+
+/****************************************************************************
+ Generate the global machine sid. Look for the MACHINE.SID file first, if
+ not found then look in smb.conf and use it to create the MACHINE.SID file.
+ Note this function will be replaced soon. JRA.
+****************************************************************************/
+
+BOOL pdb_generate_sam_sid(void)
+{
+ int fd;
char *p;
pstring sid_file;
- pstring machine_sid_file;
- fstring file_name;
+ fstring sid_string;
+ SMB_STRUCT_STAT st;
+ BOOL overwrite_bad_sid = False;
generate_wellknown_sids();
- if (sid == NULL)
- {
- sid = &global_sam_sid;
- }
-
pstrcpy(sid_file, lp_smb_passwd_file());
-
- if (sid_file[0] == 0)
- {
- DEBUG(0,("cannot find smb passwd file\n"));
- return False;
- }
-
p = strrchr(sid_file, '/');
- if (p != NULL)
- {
+ if(p != NULL) {
*++p = '\0';
}
@@ -836,53 +856,177 @@ BOOL pdb_generate_sam_sid(char *domain_name, DOM_SID *sid)
}
}
- pstrcpy(machine_sid_file, sid_file);
- pstrcat(machine_sid_file, "MACHINE.SID");
-
- slprintf(file_name, sizeof(file_name)-1, "%s.SID", domain_name);
- strupper(file_name);
- pstrcat(sid_file, file_name);
+ pstrcat(sid_file, "MACHINE.SID");
- if (file_exist(machine_sid_file, NULL))
- {
- if (file_exist(sid_file, NULL))
- {
- DEBUG(0,("both %s and %s exist when only one should, unable to continue\n",
- machine_sid_file, sid_file));
+ if((fd = sys_open(sid_file, O_RDWR | O_CREAT, 0644)) == -1) {
+ DEBUG(0,("unable to open or create file %s. Error was %s\n",
+ sid_file, strerror(errno) ));
+ return False;
+ }
+
+ /*
+ * Check if the file contains data.
+ */
+
+ if(sys_fstat( fd, &st) < 0) {
+ DEBUG(0,("unable to stat file %s. Error was %s\n",
+ sid_file, strerror(errno) ));
+ close(fd);
+ return False;
+ }
+
+ if(st.st_size > 0) {
+ /*
+ * We have a valid SID - read it.
+ */
+ if(!read_sid_from_file( fd, sid_file)) {
+ DEBUG(0,("unable to read file %s. Error was %s\n",
+ sid_file, strerror(errno) ));
+ close(fd);
return False;
}
- if (file_rename(machine_sid_file, sid_file))
- {
- DEBUG(0,("could not rename %s to %s. Error was %s\n",
- machine_sid_file, sid_file, strerror(errno)));
- return False;
+
+ /*
+ * JRA. Reversed the sense of this test now that I have
+ * actually done this test *personally*. One more reason
+ * to never trust third party information you have not
+ * independently verified.... sigh. JRA.
+ */
+
+ if(global_sam_sid.num_auths > 0 && global_sam_sid.sub_auths[0] == 0x21) {
+ /*
+ * Fix and re-write...
+ */
+ overwrite_bad_sid = True;
+ global_sam_sid.sub_auths[0] = 21;
+ DEBUG(5,("pdb_generate_sam_sid: Old (incorrect) sid id_auth of hex 21 \
+detected - re-writing to be decimal 21 instead.\n" ));
+ sid_to_string(sid_string, &global_sam_sid);
+ if(sys_lseek(fd, (SMB_OFF_T)0, SEEK_SET) != 0) {
+ DEBUG(0,("unable to seek file file %s. Error was %s\n",
+ sid_file, strerror(errno) ));
+ close(fd);
+ return False;
+ }
+ } else {
+ close(fd);
+ return True;
}
- }
+ } else {
+ /*
+ * The file contains no data - we need to generate our
+ * own sid.
+ * Generate the new sid data & turn it into a string.
+ */
+ int i;
+ uchar raw_sid_data[12];
+ DOM_SID mysid;
+
+ memset((char *)&mysid, '\0', sizeof(DOM_SID));
+ mysid.sid_rev_num = 1;
+ mysid.id_auth[5] = 5;
+ mysid.num_auths = 0;
+ mysid.sub_auths[mysid.num_auths++] = 21;
+
+ generate_random_buffer( raw_sid_data, 12, True);
+ for( i = 0; i < 3; i++)
+ mysid.sub_auths[mysid.num_auths++] = IVAL(raw_sid_data, i*4);
+
+ sid_to_string(sid_string, &mysid);
+ }
- /* attempt to read the SID from the file */
- if (read_sid(domain_name, sid))
- {
- return True;
- }
+ fstrcat(sid_string, "\n");
+
+ /*
+ * Ensure our new SID is valid.
+ */
+
+ if(!string_to_sid( &global_sam_sid, sid_string)) {
+ DEBUG(0,("unable to generate machine SID.\n"));
+ return False;
+ }
- if (!create_new_sid(sid))
- {
+ /*
+ * Do an exclusive blocking lock on the file.
+ */
+
+ if(!do_file_lock( fd, 60, F_WRLCK)) {
+ DEBUG(0,("unable to lock file %s. Error was %s\n",
+ sid_file, strerror(errno) ));
+ close(fd);
return False;
- }
- /* attempt to read the SID from the file */
- if (!write_sid(domain_name, sid))
- {
- return True;
- }
+ }
+
+ if(!overwrite_bad_sid) {
+ /*
+ * At this point we have a blocking lock on the SID
+ * file - check if in the meantime someone else wrote
+ * SID data into the file. If so - they were here first,
+ * use their data.
+ */
+
+ if(sys_fstat( fd, &st) < 0) {
+ DEBUG(0,("unable to stat file %s. Error was %s\n",
+ sid_file, strerror(errno) ));
+ close(fd);
+ return False;
+ }
- /* during the attempt to write, someone else wrote? */
-
- /* attempt to read the SID from the file */
- if (read_sid(domain_name, sid))
- {
- return True;
+ if(st.st_size > 0) {
+ /*
+ * Unlock as soon as possible to reduce
+ * contention on the exclusive lock.
+ */
+ do_file_lock( fd, 60, F_UNLCK);
+
+ /*
+ * We have a valid SID - read it.
+ */
+
+ if(!read_sid_from_file( fd, sid_file)) {
+ DEBUG(0,("unable to read file %s. Error was %s\n",
+ sid_file, strerror(errno) ));
+ close(fd);
+ return False;
+ }
+ close(fd);
+ return True;
+ }
}
-
+
+ /*
+ * The file is still empty and we have an exlusive lock on it,
+ * or we're fixing an earlier mistake.
+ * Write out out SID data into the file.
+ */
+
+ /*
+ * Use chmod here as some (strange) UNIX's don't
+ * have fchmod. JRA.
+ */
+
+ if(chmod(sid_file, 0644) < 0) {
+ DEBUG(0,("unable to set correct permissions on file %s. \
+Error was %s\n", sid_file, strerror(errno) ));
+ do_file_lock( fd, 60, F_UNLCK);
+ close(fd);
+ return False;
+ }
+
+ if(write( fd, sid_string, strlen(sid_string)) != strlen(sid_string)) {
+ DEBUG(0,("unable to write file %s. Error was %s\n",
+ sid_file, strerror(errno) ));
+ do_file_lock( fd, 60, F_UNLCK);
+ close(fd);
+ return False;
+ }
+
+ /*
+ * Unlock & exit.
+ */
+
+ do_file_lock( fd, 60, F_UNLCK);
+ close(fd);
return True;
}
/*******************************************************************
diff --git a/source3/smbd/server.c b/source3/smbd/server.c
index 576f6d14d2..00ea801cca 100644
--- a/source3/smbd/server.c
+++ b/source3/smbd/server.c
@@ -530,8 +530,6 @@ static void usage(char *pname)
****************************************************************************/
int main(int argc,char *argv[])
{
- fstring sam_name;
-
extern BOOL append_log;
/* shall I run as a daemon */
BOOL is_daemon = False;
@@ -766,18 +764,7 @@ static void usage(char *pname)
/* possibly reload the services file. */
reload_services(True);
- /* obtain or create a SAM SID */
- if (lp_domain_logons())
- {
- fstrcpy(sam_name, global_myworkgroup);
- }
- else
- {
- fstrcpy(sam_name, global_myname);
- }
-
- if(!pdb_generate_sam_sid(sam_name, NULL))
- {
+ if(!pdb_generate_sam_sid()) {
DEBUG(0,("ERROR: Samba cannot create a SAM SID.\n"));
exit(1);
}
generated by cgit (git 2.34.1) at 2024-11-06 14:14:53 +0000