summaryrefslogtreecommitdiff
path: root/source3/auth/token_util.c
AgeCommit message (Collapse)AuthorFilesLines
2012-08-10s3-smbd: Create a shortcut for building the token of a user by SID for ↵Andrew Bartlett1-47/+142
posix_acls When a user owns a file, but does not have specific permissions on that file, we need to make up the user permissions. This change ensures that the first thing that we do is to look up the SID, and confirm it is a user. Then, we avoid the getpwnam() and directly create the token via the SID. Andrew Bartlett Signed-off-by: Jeremy Allison <jra@samba.org>
2012-07-12s3: rename sid_check_is_in_our_domain() to sid_check_is_in_our_sam()Michael Adam1-1/+1
This does not check whether the given sid is in our domain, but but whether it belongs to the local sam, which is a different thing on a domain member server. Autobuild-User(master): Michael Adam <obnox@samba.org> Autobuild-Date(master): Thu Jul 12 18:36:02 CEST 2012 on sn-devel-104
2012-03-24lib/util: Remove dummy wrapper for getpwuid().Jelmer Vernooij1-2/+2
2012-03-24lib/util: Remove dummy wrapper for getpwnam().Jelmer Vernooij1-2/+2
2011-10-14s3-auth: token_util needs system/passwd.h.Günther Deschner1-0/+1
Guenther
2011-07-20s3-auth Add const to indicate input elementsAndrew Bartlett1-2/+2
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-06-09s3-talloc Change TALLOC_ZERO_P() to talloc_zero()Andrew Bartlett1-1/+1
Using the standard macro makes it easier to move code into common, as TALLOC_ZERO_P isn't standard talloc.
2011-06-09s3-talloc Change TALLOC_ARRAY() to talloc_array()Andrew Bartlett1-4/+4
Using the standard macro makes it easier to move code into common, as TALLOC_ARRAY isn't standard talloc.
2011-05-05s3-auth: run minimal_includes.plGünther Deschner1-1/+0
Guenther
2011-03-30s3: only include lib/privileges.h where needed.Günther Deschner1-0/+1
This finally removes the global lsa.h inclusion. Guenther
2011-03-30s3-auth: use auth.h where needed.Günther Deschner1-0/+1
Guenther
2011-03-30s3-passdb: use passdb headers where needed.Günther Deschner1-0/+1
Guenther
2011-03-30s3: create_builtin_users/administrators belongs to passdb not auth.Günther Deschner1-130/+0
Guenther
2011-03-30s3-winbind: remove global inclusion of libwbclient.Günther Deschner1-0/+1
Guenther
2011-03-30lib/util/util_pw: share sys_get{pw,gr} group of calls.Günther Deschner1-0/+1
Guenther
2011-03-10Quite some callers of sid_split_rid do not care about the ridVolker Lendecke1-3/+1
2011-02-22s3:auth: change num_groups to from size_t to uint32_tStefan Metzmacher1-4/+4
This will help with the change from UNIX_USER_TOKEN to security_unix_token metze
2010-10-20Make getpwnam_alloc() static to lib/username.c, and ensure all username ↵Jeremy Allison1-3/+3
lookups go through Get_Pwnam_alloc(), which is the correct wrapper function. We were using it *some* of the time anyway, so this just makes us properly consistent. Jeremy. Autobuild-User: Jeremy Allison <jra@samba.org> Autobuild-Date: Wed Oct 20 16:02:12 UTC 2010 on sn-devel-104
2010-10-14s3-auth Use security_token_debug() from common codeAndrew Bartlett1-26/+0
This prints the security token including the privileges as strings instead of just a bitmap. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-10-14s3-auth use security_token_has_sid() from the common codeAndrew Bartlett1-9/+2
The wrapper call is left here to avoid changing semantics for the NULL parameter case. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-10-12libcli/security Provide a common, top level libcli/security/security.hAndrew Bartlett1-1/+1
This will reduce the noise from merges of the rest of the libcli/security code, without this commit changing what code is actually used. This includes (along with other security headers) dom_sid.h and security_token.h Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Tue Oct 12 05:54:10 UTC 2010 on sn-devel-104
2010-09-26s3: Remove talloc_autofree_context() from get_root_nt_token()Volker Lendecke1-1/+1
The memcache_add_talloc() later on steals it anyway
2010-09-25s3: Fix a typoVolker Lendecke1-1/+1
2010-09-20s3-util_sid: use shared dom_sid_compare_auth and dom_sid_equal_X functions.Günther Deschner1-2/+2
Guenther
2010-09-11s3-privs Call security_token_set_privilege() rather than manual assignmentAndrew Bartlett1-1/+1
This avoids as much direct modifiction of the bitmask as possible. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-09-11s3-privs Inline dump_se_priv into callers now that it's just a uint64_tAndrew Bartlett1-1/+1
The previous 128 bit structure needed this helper function. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-09-11s3:auth Remove NT_USER_TOKENAndrew Bartlett1-6/+6
The all UPPER case typedef is no longer the preferred Samba style and this makes it easier to see that this is the IDL-derivied structure Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-09-11s3-auth Change struct nt_user_token -> struct security_tokenAndrew Bartlett1-14/+14
This common structure is defined in security.idl Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-09-11s3-auth Change type of num_sids to uint32_tAndrew Bartlett1-5/+7
size_t is overkill here, and in struct security_token in the num_sids is uint32_t. This includes a change to the prototype of add_sid_to_array() and add_sid_to_array_unique(), which has had a number of consequnetial changes as I try to sort out all the callers using a pointer to the number of sids. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-08-31s3-auth Rename NT_USER_TOKEN privileges -> privilege_maskAndrew Bartlett1-3/+3
This is closer to the struct security_token from security.idl Andrew Bartlett
2010-08-31s3-auth Rename NT_USER_TOKEN user_sids -> sidsAndrew Bartlett1-24/+24
This is closer to the struct security_token from security.idl
2010-08-26s3-build: only include memcache.h where needed.Günther Deschner1-0/+1
Guenther
2010-08-06s3-netlogon: remove global include of netlogon.h.Günther Deschner1-0/+2
This reduces precompiled headers by another 4 MB and also slightly speeds up the build. Guenther
2010-08-05s3-secrets: only include secrets.h when needed.Günther Deschner1-0/+1
Guenther
2010-07-11s3: [ug]id_to_unix_... can not failVolker Lendecke1-5/+2
Remove some silly failure checks
2010-06-07s3:auth create nt token from info3 directlySimo Sorce1-26/+157
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-05-21s3:dom_sid Global replace of DOM_SID with struct dom_sidAndrew Bartlett1-24/+24
This matches the structure that new code is being written to, and removes one more of the old-style named structures, and the need to know that is is just an alias for struct dom_sid. Andrew Bartlett Signed-off-by: Günther Deschner <gd@samba.org>
2010-05-18security: merge builtin rid tables.Günther Deschner1-2/+2
Guenther
2010-05-18s3-rpc_misc: clean out include/rpc_misc.h.Günther Deschner1-4/+4
Well known rids don't really belong into an rpc header, just use the ones defined in security.idl. Guenther
2010-04-11s3: Move user_in_group() and create_token_from_username() to token_utils.cVolker Lendecke1-0/+315
Goal is to be able to call check_sam_security from winbind
2009-08-22Implement Metze's suggestion of trying getpwuid(0) then getpwnam(root).Jeremy Allison1-9/+5
Jeremy.
2009-08-21Try and fix the buildfarm by using getpwnam(root) insteadJeremy Allison1-0/+7
of getpwuid(0) if DEVELOPER is defined. I'm hoping the build farm defines DEVELOPER... Jeremy.
2009-08-19Fix bug #6647 - get_root_nt_token: getpwnam("root") failed!Jeremy Allison1-2/+2
Not all systems may have a "root" user, but all must have a passwd entry for a uid of zero. Jeremy.
2008-11-14Make memcache_add_talloc NULL out the source pointerVolker Lendecke1-2/+4
This is an orthogonality measure to make clear this pointer now belongs to the cache. (cherry picked from commit e6080c6e87d6fe3995b121a772bf3f6343fa666f)
2008-11-06Make us clean under valgrind --leak-check=full by using ↵Jeremy Allison1-1/+1
talloc_autofree_context() instead of NULL. Remove the code in memcache that does a TALLOC_FREE on stored pointers. That's a disaster waiting to happen. If you're storing talloc'ed pointers, you can't know their lifecycle and they should be deleted when their parent context is deleted, so freeing them at some arbitrary point later will be a double-free. Jeremy.
2008-10-13Add data_blob_string_const_null() function that includes the terminatingJelmer Vernooij1-2/+2
null byte and use it in Samba 3. This matches the behaviour prior to my data_blob changes.
2008-09-03Revert "Split lookup_name() and create a new functiong called"Simo Sorce1-3/+4
This reverts commit 8594edf666c29fd4ddf1780da842683dd81483b6. (This used to be commit ad462e2e2d025a7fc23e7dea32b2b442b528970b)
2008-08-17Split lookup_name() and create a new functiong calledSimo Sorce1-4/+3
lookup_domain_name(). This new function accept separated strings for domain and name. (This used to be commit 8594edf666c29fd4ddf1780da842683dd81483b6)
2008-07-30Removed redundant logging from create_builtin_users and ↵Tim Prouty1-16/+4
create_builtin_administrators The Debug messages in create_builtin_users and create_builtin_users have now been encapsulated in add_sid_to_builtin. (This used to be commit ca153139b1dced07c196aac93dbc9d9428d98124)
2008-07-30Enabled domain groups to be added to builtin groups at domain join timeTim Prouty1-2/+2
Previously this was done at token creation time if the Administrators and Users builtins hadn't been created yet. A major drawback to this approach is that if a customer is joined to a domain and decides they want to join a different domain, the domain groups from this new domain will not be added to the builtins. It would be ideal if these groups could be added exclusively at domain join time, but we can't rely solely on that because there are cases where winbindd must be running to allocate new gids for the builtins. In the future if there is a way to allocate gids for builtins without running winbindd, this code can be removed from create_local_nt_token. - Made create_builtin_users and create_builtin_administrators non-static so they can be called from libnet - Added a new function to libnet_join that will make a best effort to add domain administrators and domain users to BUILTIN\Administrators and BUILTIN\Users, respectively. If the builtins don't exist yet, winbindd must be running to allocate new gids, but if the builtins already exist, the domain groups will be added even if winbindd is not running. In the case of a failure the error will be logged, but the join will not be failed. - Plumbed libnet_join_add_dom_rids_to_builtins into the join post processing. (This used to be commit e92faf5996cadac480deb60a4f6232eea90b00f6)
generated by cgit (git 2.34.1) at 2024-10-30 09:28:09 +0000