diff options
Diffstat (limited to 'source3')
-rw-r--r-- | source3/include/proto.h | 5 | ||||
-rw-r--r-- | source3/lib/util_sid.c | 288 | ||||
-rw-r--r-- | source3/passdb/passdb.c | 258 | ||||
-rw-r--r-- | source3/smbd/server.c | 15 |
4 files changed, 203 insertions, 363 deletions
diff --git a/source3/include/proto.h b/source3/include/proto.h index b7cfb83501..215529f697 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -403,9 +403,6 @@ DOM_SID *sid_dup(DOM_SID *src); BOOL sid_linearize(char *outbuf, size_t len, DOM_SID *sid); BOOL sid_equal(DOM_SID *sid1, DOM_SID *sid2); size_t sid_size(DOM_SID *sid); -BOOL read_sid(char *sam_name, DOM_SID *sid); -BOOL write_sid(char *sam_name, DOM_SID *sid); -BOOL create_new_sid(DOM_SID *sid); /*The following definitions come from lib/util_sock.c */ @@ -1486,7 +1483,7 @@ void pdb_set_last_set_time(char *p, int max_len, time_t t); void pdb_sethexpwd(char *p, unsigned char *pwd, uint16 acct_ctrl); BOOL pdb_gethexpwd(char *p, unsigned char *pwd); BOOL pdb_name_to_rid(char *user_name, uint32 *u_rid, uint32 *g_rid); -BOOL pdb_generate_sam_sid(char *domain_name, DOM_SID *sid); +BOOL pdb_generate_sam_sid(void); uid_t pdb_user_rid_to_uid(uint32 user_rid); gid_t pdb_user_rid_to_gid(uint32 user_rid); uint32 pdb_uid_to_user_rid(uid_t uid); diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c index f2f7b3c8ae..65bc2fe85d 100644 --- a/source3/lib/util_sid.c +++ b/source3/lib/util_sid.c @@ -424,291 +424,3 @@ size_t sid_size(DOM_SID *sid) return sid->num_auths * sizeof(uint32) + 8; } - -static BOOL read_sid_from_file(int fd, char *sid_file, DOM_SID *sid) -{ - fstring fline; - fstring sid_str; - - memset(fline, '\0', sizeof(fline)); - - if (read(fd, fline, sizeof(fline) -1 ) < 0) { - DEBUG(0,("unable to read file %s. Error was %s\n", - sid_file, strerror(errno) )); - return False; - } - - /* - * Convert to the machine SID. - */ - - fline[sizeof(fline)-1] = '\0'; - if (!string_to_sid(sid, fline)) { - DEBUG(0,("unable to read sid.\n")); - return False; - } - - sid_to_string(sid_str, sid); - DEBUG(5,("read_sid_from_file: sid %s\n", sid_str)); - - return True; -} - -/**************************************************************************** - Generate the global machine sid. Look for the DOMAINNAME.SID file first, if - not found then look in smb.conf and use it to create the DOMAINNAME.SID file. -****************************************************************************/ -BOOL read_sid(char *sam_name, DOM_SID *sid) -{ - int fd; - char *p; - pstring sid_file; - fstring file_name; - SMB_STRUCT_STAT st; - - pstrcpy(sid_file, lp_smb_passwd_file()); - - DEBUG(10,("read_sid: Domain: %s\n", sam_name)); - - if (sid_file[0] == 0) - { - DEBUG(0,("cannot find smb passwd file\n")); - return False; - } - - p = strrchr(sid_file, '/'); - if (p != NULL) - { - *++p = '\0'; - } - - if (!directory_exist(sid_file, NULL)) - { - if (mkdir(sid_file, 0700) != 0) - { - DEBUG(0,("can't create private directory %s : %s\n", - sid_file, strerror(errno))); - return False; - } - } - - slprintf(file_name, sizeof(file_name)-1, "%s.SID", sam_name); - strupper(file_name); - pstrcat(sid_file, file_name); - - if ((fd = sys_open(sid_file, O_RDWR | O_CREAT, 0644)) == -1) { - DEBUG(0,("unable to open or create file %s. Error was %s\n", - sid_file, strerror(errno) )); - return False; - } - - /* - * Check if the file contains data. - */ - - if (sys_fstat(fd, &st) < 0) { - DEBUG(0,("unable to stat file %s. Error was %s\n", - sid_file, strerror(errno) )); - close(fd); - return False; - } - - if (st.st_size == 0) - { - close(fd); - return False; - } - - /* - * We have a valid SID - read it. - */ - - if (!read_sid_from_file(fd, sid_file, sid)) - { - DEBUG(0,("unable to read file %s. Error was %s\n", - sid_file, strerror(errno) )); - close(fd); - return False; - } - close(fd); - return True; -} - - -/**************************************************************************** - Generate the global machine sid. Look for the DOMAINNAME.SID file first, if - not found then look in smb.conf and use it to create the DOMAINNAME.SID file. -****************************************************************************/ -BOOL write_sid(char *sam_name, DOM_SID *sid) -{ - int fd; - char *p; - pstring sid_file; - fstring sid_string; - fstring file_name; - SMB_STRUCT_STAT st; - - pstrcpy(sid_file, lp_smb_passwd_file()); - sid_to_string(sid_string, sid); - - DEBUG(10,("write_sid: Domain: %s SID: %s\n", sam_name, sid_string)); - fstrcat(sid_string, "\n"); - - if (sid_file[0] == 0) - { - DEBUG(0,("cannot find smb passwd file\n")); - return False; - } - - p = strrchr(sid_file, '/'); - if (p != NULL) - { - *++p = '\0'; - } - - if (!directory_exist(sid_file, NULL)) { - if (mkdir(sid_file, 0700) != 0) { - DEBUG(0,("can't create private directory %s : %s\n", - sid_file, strerror(errno))); - return False; - } - } - - slprintf(file_name, sizeof(file_name)-1, "%s.SID", sam_name); - strupper(file_name); - pstrcat(sid_file, file_name); - - if ((fd = sys_open(sid_file, O_RDWR | O_CREAT, 0644)) == -1) { - DEBUG(0,("unable to open or create file %s. Error was %s\n", - sid_file, strerror(errno) )); - return False; - } - - /* - * Check if the file contains data. - */ - - if (sys_fstat(fd, &st) < 0) { - DEBUG(0,("unable to stat file %s. Error was %s\n", - sid_file, strerror(errno) )); - close(fd); - return False; - } - - if (st.st_size > 0) - { - /* - * We have a valid SID already. - */ - close(fd); - DEBUG(0,("SID file %s already exists\n", sid_file)); - return False; - } - - if (!do_file_lock(fd, 60, F_WRLCK)) - { - DEBUG(0,("unable to lock file %s. Error was %s\n", - sid_file, strerror(errno) )); - close(fd); - return False; - } - - /* - * At this point we have a blocking lock on the SID - * file - check if in the meantime someone else wrote - * SID data into the file. If so - they were here first, - * use their data. - */ - - if (sys_fstat(fd, &st) < 0) - { - DEBUG(0,("unable to stat file %s. Error was %s\n", - sid_file, strerror(errno) )); - close(fd); - return False; - } - - if (st.st_size > 0) - { - /* - * Unlock as soon as possible to reduce - * contention on the exclusive lock. - */ - do_file_lock(fd, 60, F_UNLCK); - - /* - * We have a valid SID already. - */ - - DEBUG(0,("SID file %s already exists\n", sid_file)); - close(fd); - return False; - } - - /* - * The file is still empty and we have an exlusive lock on it. - * Write out out SID data into the file. - */ - - if (fchmod(fd, 0644) < 0) - { - DEBUG(0,("unable to set correct permissions on file %s. \ -Error was %s\n", sid_file, strerror(errno) )); - close(fd); - return False; - } - - if (write(fd, sid_string, strlen(sid_string)) != strlen(sid_string)) - { - DEBUG(0,("unable to write file %s. Error was %s\n", - sid_file, strerror(errno) )); - close(fd); - return False; - } - - /* - * Unlock & exit. - */ - - do_file_lock(fd, 60, F_UNLCK); - close(fd); - return True; -} - -/**************************************************************************** -create a random SID. -****************************************************************************/ -BOOL create_new_sid(DOM_SID *sid) -{ - uchar raw_sid_data[12]; - fstring sid_string; - int i; - - /* - * Generate the new sid data & turn it into a string. - */ - generate_random_buffer(raw_sid_data, 12, True); - - fstrcpy(sid_string, "S-1-5-21"); - for(i = 0; i < 3; i++) - { - fstring tmp_string; - slprintf(tmp_string, sizeof(tmp_string) - 1, "-%u", IVAL(raw_sid_data, i*4)); - fstrcat(sid_string, tmp_string); - } - - fstrcat(sid_string, "\n"); - - /* - * Ensure our new SID is valid. - */ - - if (!string_to_sid(sid, sid_string)) - { - DEBUG(0,("unable to generate machine SID.\n")); - return False; - } - - return True; -} - diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index 272182a714..f520a11157 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -797,34 +797,54 @@ BOOL pdb_name_to_rid(char *user_name, uint32 *u_rid, uint32 *g_rid) } /**************************************************************************** - Generate the global machine sid. Look for the DOMAINNAME.SID file first, if - not found then look in smb.conf and use it to create the DOMAINNAME.SID file. + Read the machine SID from a file. ****************************************************************************/ -BOOL pdb_generate_sam_sid(char *domain_name, DOM_SID *sid) + +static BOOL read_sid_from_file(int fd, char *sid_file) { + fstring fline; + + memset(fline, '\0', sizeof(fline)); + + if(read(fd, fline, sizeof(fline) -1 ) < 0) { + DEBUG(0,("unable to read file %s. Error was %s\n", + sid_file, strerror(errno) )); + return False; + } + + /* + * Convert to the machine SID. + */ + + fline[sizeof(fline)-1] = '\0'; + if(!string_to_sid( &global_sam_sid, fline)) { + DEBUG(0,("unable to generate machine SID.\n")); + return False; + } + + return True; +} + +/**************************************************************************** + Generate the global machine sid. Look for the MACHINE.SID file first, if + not found then look in smb.conf and use it to create the MACHINE.SID file. + Note this function will be replaced soon. JRA. +****************************************************************************/ + +BOOL pdb_generate_sam_sid(void) +{ + int fd; char *p; pstring sid_file; - pstring machine_sid_file; - fstring file_name; + fstring sid_string; + SMB_STRUCT_STAT st; + BOOL overwrite_bad_sid = False; generate_wellknown_sids(); - if (sid == NULL) - { - sid = &global_sam_sid; - } - pstrcpy(sid_file, lp_smb_passwd_file()); - - if (sid_file[0] == 0) - { - DEBUG(0,("cannot find smb passwd file\n")); - return False; - } - p = strrchr(sid_file, '/'); - if (p != NULL) - { + if(p != NULL) { *++p = '\0'; } @@ -836,53 +856,177 @@ BOOL pdb_generate_sam_sid(char *domain_name, DOM_SID *sid) } } - pstrcpy(machine_sid_file, sid_file); - pstrcat(machine_sid_file, "MACHINE.SID"); - - slprintf(file_name, sizeof(file_name)-1, "%s.SID", domain_name); - strupper(file_name); - pstrcat(sid_file, file_name); + pstrcat(sid_file, "MACHINE.SID"); - if (file_exist(machine_sid_file, NULL)) - { - if (file_exist(sid_file, NULL)) - { - DEBUG(0,("both %s and %s exist when only one should, unable to continue\n", - machine_sid_file, sid_file)); + if((fd = sys_open(sid_file, O_RDWR | O_CREAT, 0644)) == -1) { + DEBUG(0,("unable to open or create file %s. Error was %s\n", + sid_file, strerror(errno) )); + return False; + } + + /* + * Check if the file contains data. + */ + + if(sys_fstat( fd, &st) < 0) { + DEBUG(0,("unable to stat file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); + return False; + } + + if(st.st_size > 0) { + /* + * We have a valid SID - read it. + */ + if(!read_sid_from_file( fd, sid_file)) { + DEBUG(0,("unable to read file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); return False; } - if (file_rename(machine_sid_file, sid_file)) - { - DEBUG(0,("could not rename %s to %s. Error was %s\n", - machine_sid_file, sid_file, strerror(errno))); - return False; + + /* + * JRA. Reversed the sense of this test now that I have + * actually done this test *personally*. One more reason + * to never trust third party information you have not + * independently verified.... sigh. JRA. + */ + + if(global_sam_sid.num_auths > 0 && global_sam_sid.sub_auths[0] == 0x21) { + /* + * Fix and re-write... + */ + overwrite_bad_sid = True; + global_sam_sid.sub_auths[0] = 21; + DEBUG(5,("pdb_generate_sam_sid: Old (incorrect) sid id_auth of hex 21 \ +detected - re-writing to be decimal 21 instead.\n" )); + sid_to_string(sid_string, &global_sam_sid); + if(sys_lseek(fd, (SMB_OFF_T)0, SEEK_SET) != 0) { + DEBUG(0,("unable to seek file file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); + return False; + } + } else { + close(fd); + return True; } - } + } else { + /* + * The file contains no data - we need to generate our + * own sid. + * Generate the new sid data & turn it into a string. + */ + int i; + uchar raw_sid_data[12]; + DOM_SID mysid; + + memset((char *)&mysid, '\0', sizeof(DOM_SID)); + mysid.sid_rev_num = 1; + mysid.id_auth[5] = 5; + mysid.num_auths = 0; + mysid.sub_auths[mysid.num_auths++] = 21; + + generate_random_buffer( raw_sid_data, 12, True); + for( i = 0; i < 3; i++) + mysid.sub_auths[mysid.num_auths++] = IVAL(raw_sid_data, i*4); + + sid_to_string(sid_string, &mysid); + } - /* attempt to read the SID from the file */ - if (read_sid(domain_name, sid)) - { - return True; - } + fstrcat(sid_string, "\n"); + + /* + * Ensure our new SID is valid. + */ + + if(!string_to_sid( &global_sam_sid, sid_string)) { + DEBUG(0,("unable to generate machine SID.\n")); + return False; + } - if (!create_new_sid(sid)) - { + /* + * Do an exclusive blocking lock on the file. + */ + + if(!do_file_lock( fd, 60, F_WRLCK)) { + DEBUG(0,("unable to lock file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); return False; - } - /* attempt to read the SID from the file */ - if (!write_sid(domain_name, sid)) - { - return True; - } + } + + if(!overwrite_bad_sid) { + /* + * At this point we have a blocking lock on the SID + * file - check if in the meantime someone else wrote + * SID data into the file. If so - they were here first, + * use their data. + */ + + if(sys_fstat( fd, &st) < 0) { + DEBUG(0,("unable to stat file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); + return False; + } - /* during the attempt to write, someone else wrote? */ - - /* attempt to read the SID from the file */ - if (read_sid(domain_name, sid)) - { - return True; + if(st.st_size > 0) { + /* + * Unlock as soon as possible to reduce + * contention on the exclusive lock. + */ + do_file_lock( fd, 60, F_UNLCK); + + /* + * We have a valid SID - read it. + */ + + if(!read_sid_from_file( fd, sid_file)) { + DEBUG(0,("unable to read file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); + return False; + } + close(fd); + return True; + } } - + + /* + * The file is still empty and we have an exlusive lock on it, + * or we're fixing an earlier mistake. + * Write out out SID data into the file. + */ + + /* + * Use chmod here as some (strange) UNIX's don't + * have fchmod. JRA. + */ + + if(chmod(sid_file, 0644) < 0) { + DEBUG(0,("unable to set correct permissions on file %s. \ +Error was %s\n", sid_file, strerror(errno) )); + do_file_lock( fd, 60, F_UNLCK); + close(fd); + return False; + } + + if(write( fd, sid_string, strlen(sid_string)) != strlen(sid_string)) { + DEBUG(0,("unable to write file %s. Error was %s\n", + sid_file, strerror(errno) )); + do_file_lock( fd, 60, F_UNLCK); + close(fd); + return False; + } + + /* + * Unlock & exit. + */ + + do_file_lock( fd, 60, F_UNLCK); + close(fd); return True; } /******************************************************************* diff --git a/source3/smbd/server.c b/source3/smbd/server.c index 576f6d14d2..00ea801cca 100644 --- a/source3/smbd/server.c +++ b/source3/smbd/server.c @@ -530,8 +530,6 @@ static void usage(char *pname) ****************************************************************************/ int main(int argc,char *argv[]) { - fstring sam_name; - extern BOOL append_log; /* shall I run as a daemon */ BOOL is_daemon = False; @@ -766,18 +764,7 @@ static void usage(char *pname) /* possibly reload the services file. */ reload_services(True); - /* obtain or create a SAM SID */ - if (lp_domain_logons()) - { - fstrcpy(sam_name, global_myworkgroup); - } - else - { - fstrcpy(sam_name, global_myname); - } - - if(!pdb_generate_sam_sid(sam_name, NULL)) - { + if(!pdb_generate_sam_sid()) { DEBUG(0,("ERROR: Samba cannot create a SAM SID.\n")); exit(1); } |