summaryrefslogtreecommitdiff
path: root/source3/smbd/posix_acls.c
diff options
context:
space:
mode:
Diffstat (limited to 'source3/smbd/posix_acls.c')
-rw-r--r--source3/smbd/posix_acls.c66
1 files changed, 31 insertions, 35 deletions
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index c00b7bd757..2fb7b77c86 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -21,6 +21,7 @@
#include "includes.h"
+extern struct current_user current_user;
extern const struct generic_mapping file_generic_mapping;
#undef DBGC_CLASS
@@ -1167,9 +1168,7 @@ static mode_t map_nt_perms( uint32 *mask, int type)
Unpack a SEC_DESC into a UNIX owner and group.
****************************************************************************/
-NTSTATUS unpack_nt_owners(struct connection_struct *conn,
- uid_t *puser, gid_t *pgrp,
- uint32 security_info_sent, const SEC_DESC *psd)
+NTSTATUS unpack_nt_owners(int snum, uid_t *puser, gid_t *pgrp, uint32 security_info_sent, const SEC_DESC *psd)
{
DOM_SID owner_sid;
DOM_SID grp_sid;
@@ -1199,10 +1198,10 @@ NTSTATUS unpack_nt_owners(struct connection_struct *conn,
if (security_info_sent & OWNER_SECURITY_INFORMATION) {
sid_copy(&owner_sid, psd->owner_sid);
if (!sid_to_uid(&owner_sid, puser)) {
- if (lp_force_unknown_acl_user(SNUM(conn))) {
+ if (lp_force_unknown_acl_user(snum)) {
/* this allows take ownership to work
* reasonably */
- *puser = get_current_uid(conn);
+ *puser = current_user.ut.uid;
} else {
DEBUG(3,("unpack_nt_owners: unable to validate"
" owner sid for %s\n",
@@ -1222,10 +1221,10 @@ NTSTATUS unpack_nt_owners(struct connection_struct *conn,
if (security_info_sent & GROUP_SECURITY_INFORMATION) {
sid_copy(&grp_sid, psd->group_sid);
if (!sid_to_gid( &grp_sid, pgrp)) {
- if (lp_force_unknown_acl_user(SNUM(conn))) {
+ if (lp_force_unknown_acl_user(snum)) {
/* this allows take group ownership to work
* reasonably */
- *pgrp = get_current_gid(conn);
+ *pgrp = current_user.ut.gid;
} else {
DEBUG(3,("unpack_nt_owners: unable to validate"
" group sid.\n"));
@@ -1290,7 +1289,7 @@ static void apply_default_perms(const struct share_params *params,
expensive and will need optimisation. A *lot* of optimisation :-). JRA.
****************************************************************************/
-static bool uid_entry_in_group(connection_struct *conn, canon_ace *uid_ace, canon_ace *group_ace )
+static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
{
const char *u_name = NULL;
@@ -1303,17 +1302,15 @@ static bool uid_entry_in_group(connection_struct *conn, canon_ace *uid_ace, cano
* if it's the current user, we already have the unix token
* and don't need to do the complex user_in_group_sid() call
*/
- if (uid_ace->unix_ug.uid == get_current_uid(conn)) {
- const UNIX_USER_TOKEN *curr_utok = NULL;
+ if (uid_ace->unix_ug.uid == current_user.ut.uid) {
size_t i;
- if (group_ace->unix_ug.gid == get_current_gid(conn)) {
+ if (group_ace->unix_ug.gid == current_user.ut.gid) {
return True;
}
- curr_utok = get_current_utok(conn);
- for (i=0; i < curr_utok->ngroups; i++) {
- if (group_ace->unix_ug.gid == curr_utok->groups[i]) {
+ for (i=0; i < current_user.ut.ngroups; i++) {
+ if (group_ace->unix_ug.gid == current_user.ut.groups[i]) {
return True;
}
}
@@ -1344,7 +1341,7 @@ static bool uid_entry_in_group(connection_struct *conn, canon_ace *uid_ace, cano
type.
****************************************************************************/
-static bool ensure_canon_entry_valid(connection_struct *conn, canon_ace **pp_ace,
+static bool ensure_canon_entry_valid(canon_ace **pp_ace,
const struct share_params *params,
const bool is_directory,
const DOM_SID *pfile_owner_sid,
@@ -1410,7 +1407,7 @@ static bool ensure_canon_entry_valid(connection_struct *conn, canon_ace **pp_ace
for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
- if (uid_entry_in_group(conn, pace, pace_iter)) {
+ if (uid_entry_in_group(pace, pace_iter)) {
pace->perms |= pace_iter->perms;
group_matched = True;
}
@@ -2060,7 +2057,7 @@ static bool create_canon_ace_lists(files_struct *fsp,
allow entries.
****************************************************************************/
-static void process_deny_list(connection_struct *conn, canon_ace **pp_ace_list )
+static void process_deny_list( canon_ace **pp_ace_list )
{
canon_ace *ace_list = *pp_ace_list;
canon_ace *curr_ace = NULL;
@@ -2165,7 +2162,7 @@ static void process_deny_list(connection_struct *conn, canon_ace **pp_ace_list )
if (allow_ace_p->owner_type == UID_ACE)
continue;
- if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
+ if (uid_entry_in_group( curr_ace, allow_ace_p))
new_perms |= allow_ace_p->perms;
}
@@ -2209,7 +2206,7 @@ static void process_deny_list(connection_struct *conn, canon_ace **pp_ace_list )
/* Mask off the deny group perms. */
- if (uid_entry_in_group(conn, allow_ace_p, curr_ace))
+ if (uid_entry_in_group( allow_ace_p, curr_ace))
allow_ace_p->perms &= ~curr_ace->perms;
}
@@ -2259,7 +2256,7 @@ static void process_deny_list(connection_struct *conn, canon_ace **pp_ace_list )
/* OR in the group perms. */
- if (uid_entry_in_group(conn, curr_ace, allow_ace_p))
+ if (uid_entry_in_group( curr_ace, allow_ace_p))
curr_ace->perms |= allow_ace_p->perms;
}
}
@@ -2371,10 +2368,10 @@ static bool unpack_canon_ace(files_struct *fsp,
*/
print_canon_ace_list( "file ace - before deny", file_ace);
- process_deny_list(fsp->conn, &file_ace);
+ process_deny_list( &file_ace);
print_canon_ace_list( "dir ace - before deny", dir_ace);
- process_deny_list(fsp->conn, &dir_ace);
+ process_deny_list( &dir_ace);
/*
* A well formed POSIX file or default ACL has at least 3 entries, a
@@ -2393,7 +2390,7 @@ static bool unpack_canon_ace(files_struct *fsp,
st.st_ex_mode = create_default_mode(fsp, False);
- if (!ensure_canon_entry_valid(fsp->conn, &file_ace, fsp->conn->params,
+ if (!ensure_canon_entry_valid(&file_ace, fsp->conn->params,
fsp->is_directory, pfile_owner_sid, pfile_grp_sid, &st, True)) {
free_canon_ace_list(file_ace);
free_canon_ace_list(dir_ace);
@@ -2410,7 +2407,7 @@ static bool unpack_canon_ace(files_struct *fsp,
st.st_ex_mode = create_default_mode(fsp, True);
- if (dir_ace && !ensure_canon_entry_valid(fsp->conn, &dir_ace, fsp->conn->params,
+ if (dir_ace && !ensure_canon_entry_valid(&dir_ace, fsp->conn->params,
fsp->is_directory, pfile_owner_sid, pfile_grp_sid, &st, True)) {
free_canon_ace_list(file_ace);
free_canon_ace_list(dir_ace);
@@ -2595,7 +2592,7 @@ static canon_ace *canonicalise_acl(struct connection_struct *conn,
* This next call will ensure we have at least a user/group/world set.
*/
- if (!ensure_canon_entry_valid(conn, &l_head, conn->params,
+ if (!ensure_canon_entry_valid(&l_head, conn->params,
S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
psbuf, False))
goto fail;
@@ -2639,13 +2636,12 @@ static canon_ace *canonicalise_acl(struct connection_struct *conn,
Check if the current user group list contains a given group.
****************************************************************************/
-static bool current_user_in_group(connection_struct *conn, gid_t gid)
+static bool current_user_in_group(gid_t gid)
{
int i;
- const UNIX_USER_TOKEN *utok = get_current_utok(conn);
- for (i = 0; i < utok->ngroups; i++) {
- if (utok->groups[i] == gid) {
+ for (i = 0; i < current_user.ut.ngroups; i++) {
+ if (current_user.ut.groups[i] == gid) {
return True;
}
}
@@ -2666,7 +2662,7 @@ static bool acl_group_override(connection_struct *conn,
/* file primary group == user primary or supplementary group */
if (lp_acl_group_control(SNUM(conn)) &&
- current_user_in_group(conn, smb_fname->st.st_ex_gid)) {
+ current_user_in_group(smb_fname->st.st_ex_gid)) {
return true;
}
@@ -3544,13 +3540,13 @@ int try_chown(connection_struct *conn, struct smb_filename *smb_fname,
/* Case (2) / (3) */
if (lp_enable_privileges()) {
- bool has_take_ownership_priv = user_has_privileges(get_current_nttok(conn),
+ bool has_take_ownership_priv = user_has_privileges(current_user.nt_user_token,
&se_take_ownership);
- bool has_restore_priv = user_has_privileges(get_current_nttok(conn),
+ bool has_restore_priv = user_has_privileges(current_user.nt_user_token,
&se_restore);
/* Case (2) */
- if ( ( has_take_ownership_priv && ( uid == get_current_uid(conn) ) ) ||
+ if ( ( has_take_ownership_priv && ( uid == current_user.ut.uid ) ) ||
/* Case (3) */
( has_restore_priv ) ) {
@@ -3578,7 +3574,7 @@ int try_chown(connection_struct *conn, struct smb_filename *smb_fname,
and also copes with the case where the SID in a take ownership ACL is
a local SID on the users workstation
*/
- if (uid != get_current_uid(conn)) {
+ if (uid != current_user.ut.uid) {
errno = EPERM;
return -1;
}
@@ -3864,7 +3860,7 @@ NTSTATUS set_nt_acl(files_struct *fsp, uint32 security_info_sent, const SEC_DESC
* Unpack the user/group/world id's.
*/
- status = unpack_nt_owners( conn, &user, &grp, security_info_sent, psd);
+ status = unpack_nt_owners( SNUM(conn), &user, &grp, security_info_sent, psd);
if (!NT_STATUS_IS_OK(status)) {
return status;
}