summaryrefslogtreecommitdiff
path: root/source3/smbd/posix_acls.c
AgeCommit message (Collapse)AuthorFilesLines
2003-05-30Ensure 'blank' entries show up in both default and normal entries toJeremy Allison1-13/+7
allow them to be changed. Works well with W2K and above. Jeremy. (This used to be commit 685e4e518236079f201650f26152f6f9ad3c61ab)
2003-05-29Change get_nt_acl() to include security_info wanted. Only return this.Jeremy Allison1-138/+145
This gets us closer to W2k+ in what we return for file ACLs. Fix horribly broken make_sec_desc() that screwed up the size when given a SD with no owner or group (how did it get this bad... ?). Jeremy. (This used to be commit 183c9ed4052ab14e269ed1234ca557053f77e77a)
2003-05-28Fix bug brought up by Ken Cross that empty ACE's cause existing ACE's toJeremy Allison1-107/+14
be applied to new ACE set calls. This is incorrect. Don't think this has a bugzilla id. Jeremy. (This used to be commit cb70d8c9e87801c314d1b926d4e43ee451c04135)
2003-05-27Fix shadow parameter warning in free_empty_sys_acl()Tim Potter1-5/+5
(This used to be commit 1b2b7766c8fa89f46f4d1c881ee91c4b0b15773a)
2003-05-17Cope with cumulative permissions sets. This code is #ifdef'ed out at theJeremy Allison1-1/+49
moment as I don't think cumulative permission sets make sense in POSIX even though that's the way Windows works.... Jeremy. (This used to be commit 6ddd5b6ca7dde45ce866f852861e143434c84c7e)
2003-05-14Prefix VFS API macros with SMB_ for consistency and to avoid problems with ↵Alexander Bokovoy1-67/+67
VFS_ macros at system side. We currently have one clash with AIX and its VFS_LOCK. Compiled and tested -- no new functionality or code, just plain rename of macros for yet-unreleased VFS API version. Needs to be done before a24 is out (This used to be commit c2689ed118b490e49497a76ed6a2251262018769)
2003-05-12And finally IDMAP in 3_0Simo Sorce1-6/+4
We really need idmap_ldap to have a good solution with ldapsam, porting it from the prvious code is beeing made, the code is really simple to do so I am confident it is not a problem to commit this code in. Not committing it would have been worst. I really would have been able to finish also the group code, maybe we can put it into a followin release after 3.0.0 even if it may be an upgrade problem. The code has been tested and seem to work right, more testing is needed for corner cases. Currently winbind pdc (working only for users and not for groups) is disabled as I was not able to make a complete group code replacement that works somewhat in a week (I have a complete patch, but there are bugs) Simo. (This used to be commit 0e58085978f984436815114a2ec347cf7899a89d)
2003-05-11Fix VFS layer:Alexander Bokovoy1-67/+67
1. Finally work with cascaded modules with private data storage per module 2. Convert VFS API to macro calls to simplify cascading 3. Add quota support to VFS layer (prepare to NT quota support) Patch by Stefan (metze) Metzemacher, with review of Jelmer and me Tested in past few weeks. Documentation to new VFS API for third-party developers to follow (This used to be commit 91984ef5caa2d13c5d52e1f535bd3bbbae1ec978)
2003-04-19use gid_t for gids not uid_tSimo Sorce1-1/+1
(This used to be commit a369c2ff2637dc808035217eaada4cf923c5cf6d)
2003-04-01Doing janitor work for tridge.Jeremy Allison1-3/+3
"changed the order of checking whether a SID is a UID or a GID in posix acls. This is needed because sid_to_uid always claims that the sid is a user, due ot a change I made some months back. This change was suggested by Chere Zhou, but is really an interim measure. Chere is looking at a longer term solution." REMEMBER - 3.0 is the one we will SHIP ! Jeremy. (This used to be commit a4d7496994b740e074398d98c999a803afff4404)
2003-03-07Missed parentheses around complex logic.Jeremy Allison1-1/+2
Jeremy. (This used to be commit 7f8d3a49b2cebab4b94db3cda54b3923442378c8)
2003-03-07Patch from Michael Steffens. In his own words :Jeremy Allison1-78/+199
------------------------------------------------------------------------- I think there are basically two problem: 1. Windows clients do not always send ACEs for SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, and SMB_ACL_OTHER. The function ensure_canon_entry_valid() is prepared for that, but tries to "guess" values from group or other permissions, respectively, otherwise falling back to minimum r-- for the owner. Even if the owner had full permissions before setting ACL. This is the problem with W2k clients. 2. Function set_nt_acl() always chowns *before* attempting to set POSIX ACLs. This is ok in a take-ownership situation, but must fail if the file is to be given away. This is the problem with XP clients, trying to transfer ownership of the original file to the temp file. The problem with NT4 clients (no ACEs are transferred to the temp file, thus are lost after moving the temp file to the original name) is a client problem. It simply doesn't attempt to. I have played around with that using posic_acls.c from 3.0 merged into 2.2. As a result I can now present two patches, one for each branch. They basically modify: 1. Interpret missing SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, or SMB_ACL_OTHER as "preserve current value" instead of attempting to build one ourself. The original code is still in, but only as fallback in case current values can't be retrieved. 2. Rearrange set_nt_acl() such that chown is only done before setting ACLs if there is either no change of owning user, or change of owning user is towards the current user. Otherwise chown is done after setting ACLs. It now seems to produce reasonable results. (Well, as far as it can. If NT4 doesn't even try to transfer ACEs, only deliberate use of named default ACEs and/or "force group" or the crystal ball can help :) ------------------------------------------------------------------------- Jeremy. (This used to be commit 1d3b8c528bebfa1971d1affe454a03453335786e)
2003-02-24Merge of server-side authentication changes to 3.0:Andrew Bartlett1-1/+1
- user_ok() and user_in_group() now take a list of groups, instead of looking for the user in the members of all groups. - The 'server_info' returned from the authentication is now kept around - in future we won't copy the sesion key, username etc, we will just referece them directly. - rhosts upgraded to use the SAM if possible, otherwise fake up based on getpwnam(). - auth_util code to deal with groups upgraded to deal with non-winbind domain members again. Andrew Bartlett (This used to be commit 74b5436c75114170ce7c780c19226103d0df9060)
2003-02-21Added comments to make it clearer when we're assigning a pointer that itJeremy Allison1-0/+12
must not be freed afterwards. Jeremy. (This used to be commit 4015e39d3666dbe240808c9007a8b8faca012a3d)
2003-02-19Fix from Corny.Bondad@hp.com for missing if (setting_acls) on defaultJeremy Allison1-3/+3
perms. Jeremy. (This used to be commit 793609cbc2f657b91a59aec4a3f403bf826c7156)
2003-02-04Merge from HEAD: avoid braindead #define on Tru64.Andrew Bartlett1-2/+2
(This used to be commit 299233fbf2328d08546b3b03dceca67083b68493)
2002-10-23First cut of new ACL mapping code from Andreas Gruenbacher <agruen@suse.de>.Jeremy Allison1-106/+419
This is not 100% the same as what SuSE shipped in their Samba, there is a crash bug fix, a race condition fix, and a few logic changes I'd like to discuss with Andreas. Added Andreas to (C) notices for posix_acls.c Jeremy. (This used to be commit 40eafb9dde113af9f7f1808fda22908953f7e8c3)
2002-10-08Fix based on Jim McDonough's code for ACL inheritance problem.Jeremy Allison1-9/+60
Jeremy. (This used to be commit 3343efaaa8b80d5bc549afebbc06e02e125a6af9)
2002-10-07Fix from Andreas Gruenbacher <agruen@suse.de> to prevent ACL set on read-onlyJeremy Allison1-0/+5
share. Jeremy. (This used to be commit 9b8f362abc5abf25f02718774a8aa1f4574f19ff)
2002-09-25sync'ing up for 3.0alpha20 releaseGerald Carter1-2/+28
(This used to be commit 65e7b5273bb58802bf0c389b77f7fcae0a1f6139)
2002-08-17Sync 3.0 branch with headJelmer Vernooij1-1/+1
(This used to be commit 42615b945e2e48e53a21ea47f2e45407913a6a1e)
2002-07-15updated the 3.0 branch from the head branch - ready for alpha18Andrew Tridgell1-50/+130
(This used to be commit 03ac082dcb375b6f3ca3d810a6a6367542bc23ce)
2002-03-12Added POSIX ACL layer into the vfs.Jeremy Allison1-60/+64
Jeremy. (This used to be commit 7d59445b6962547a8938928a9371651a09e26516)
2002-03-11Implemented default ACL patch (set inherit acls = true on a per share basis).Jeremy Allison1-0/+13
Based on code donated by Olaf Fr±czyk <olaf@cbk.poznan.pl>. Further commit will change to sending via vfs interface. Jeremy. (This used to be commit d85133e2697eb22f1573c78447b57791ae63dd6b)
2002-03-09a more informitive debug message when a SID can't be validatedAndrew Tridgell1-1/+2
(This used to be commit c55737fb25dfed4697b93a600e3bd770f84bf464)
2002-01-30Removed version number from file header.Tim Potter1-2/+1
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2002-01-25merge from 2.2Gerald Carter1-1/+1
(This used to be commit 7dc1c34145d66f4bbc5c6ce0bca4b224088366af)
2002-01-11fixed a crash in merge_aces()Andrew Tridgell1-0/+1
when we free curr_ace_outer we need to not try to use it again :) (This used to be commit 1c5e19a418136c0ae524e62a4907501212ebac3d)
2001-12-19Allow ACL set to fail gracefully on HP HFS filesystems.Jeremy Allison1-0/+12
Jeremy. (This used to be commit 2d7b81e692ac2bcfd6e31223d3f8545c255cb47c)
2001-12-04Stop using getgrgid() - a very expensive call with winbindd, to look upJeremy Allison1-13/+10
a group name. Jeremy. (This used to be commit b926660e73d4c94c30ec5a365027770acdafe25e)
2001-11-30Renamed sid field in SEC_ACE to trustee to be more in line with MS'sTim Potter1-23/+23
definitions. (This used to be commit 9712d3f15a47155f558d0034ef71fd06afb11301)
2001-09-25Log sys_acl_set_XX at level 2 not zero.Jeremy Allison1-2/+2
Jeremy. (This used to be commit 4a54a633c59a18b387427e89266e294bdddf8574)
2001-09-22Ignore unmappable (NT Authority, BUILTIN etc.) SIDs in an ACL set.Jeremy Allison1-0/+11
Jeremy. (This used to be commit bc7963bd643422cce081b6284e3bdd49ae3a02ab)
2001-09-17move to SAFE_FREE()Simo Sorce1-11/+9
(This used to be commit a95943fde0ad89ae3f2deca2f7ba9cb5ab612b74)
2001-09-07Don't fail if no owner/group owner set. Use existing owners.Jeremy Allison1-3/+7
Jeremy. (This used to be commit 9961c4c1a3b2dbf8d1062bc1fa103488c0d0ba79)
2001-08-30if no ACL elements then use chmod - fixes ability to set read-only bitHerb Lewis1-2/+2
on files that do not have an ACL (This used to be commit 65ea13420c78cf0a8c01f14c08815e4b44ca4abc)
2001-07-26Fix from Michael Davidson <md@caldera.com> for DEC OSF/1 ACLs (ie.Jeremy Allison1-2/+2
Digital UNIX). Jeremy. (This used to be commit 324ba0512ec84bb173c72be3dfd2447e0dc30e26)
2001-07-04The big character set handling changeover!Andrew Tridgell1-6/+6
This commit gets rid of all our old codepage handling and replaces it with iconv. All internal strings in Samba are now in "unix" charset, which may be multi-byte. See internals.doc and my posting to samba-technical for a more complete explanation. (This used to be commit debb471267960e56005a741817ebd227ecfc512a)
2001-06-12lib/util_getent.c: removed debug code.Jeremy Allison1-4/+49
smbd/posix_acls.c: Attempt to fix the "lose default acl" problem in Solaris. Needs testing. lib/sysacls.c: Typo fix. Jeremy. (This used to be commit d989f8bd3e1524183a24fb67be1af05b3289f648)
2001-06-09*Wonderful* patch from Andrew Bartlett that will help ensure tdb's areJeremy Allison1-6/+19
cleaned on clients abending connections. Thanks Andrew ! Jeremy. (This used to be commit 1b3977c5367a0b713b194f369abd9872ae01ac2a)
2001-05-10Fixed nasty little bug found by Gerald where we were corrupting the modeJeremy Allison1-2/+15
bits before checking if we should change them on non-acl systems. Jeremy. (This used to be commit aba243ca0867a0787f9f7c7b2cda6143bcc53087)
2001-05-10Made "security XXX" masks apply to ACL set. By default they have no effect.Jeremy Allison1-29/+19
Removed "restrict acl with mask" - redundent. Jeremy. (This used to be commit 0db8a61d71f25ffa0e5c585e02e2fce973867156)
2001-05-07Fix for bad profile perms. Ensure r on files and rwx on directories.Jeremy Allison1-8/+28
Jeremy. (This used to be commit f100e091abc57a9ba983e7c3cf84bfda2dbc2e18)
2001-05-03Fixed SHM_R/SHM_W warnings by moving sys/ipc.h and sys/shm.h into includes.hJeremy Allison1-0/+6
and using autoconf tests. Added "restrict acl with mask" parameter. Jeremy. (This used to be commit 7792e32ba7fd734cc68b354f31c382ac11521fe8)
2001-04-27Tidy up args to DEBUG Statements - found by gcc on Solaris.Jeremy Allison1-1/+1
Jeremy. (This used to be commit a60ecb4e53a6c8a3a6a37a89042ae943202263fe)
2001-04-25Sync with default perm changes in 2.2.Jeremy Allison1-27/+122
Jeremy. (This used to be commit f02e67a096b3bcf84615c4a6949c5e6283e07af0)
2001-04-13Michael Davidson <md@sco.COM> pointed out that acl_get_qualifier can potentiallyJeremy Allison1-0/+2
return a malloced area so added sys_acl_free_qualifier() calls to all supported ACL interfaces to code with this (only Linux needs actual free call). Jeremy. (This used to be commit 5870e6019b82d2088b99acdc0f84e9e4847a1fa5)
2001-03-30Fixed extern ref typo for file generic perms. 2am coding strikes again :-).Jeremy Allison1-1/+1
Jeremy. (This used to be commit fe38692643ad7c163c30d9c031a8bd3dec81ffee)
2001-03-30This is a big, rather ugly patch. Whilst investigating the files not truncatedJeremy Allison1-2/+8
when copying to a full disk problem, I discovered that we were not allowing the delete on close flag to be set properly, this led to other things, and after investigation of the proper delete on close semantics and their relationship to the file_share_delete flag I discovered there were some cases where we weren't doing the deny modes properly. And this after only 5 years working on them..... :-) :-). So here's the latest attempt. I realised the delete on close flag needs to be set across all smbds with a dev/ino pair open - in addition, the delete on close flag, allow share delete and delete access requested all need to be stored in the share mode tdb. The "delete_on_close" entry in the fsp struct is now redundant and should really be removed. This may also mean we can get rid of the "iterate_fsp" calls that I didn't like adding in the first place. Whilst doing this patch, I also discovered we needed to do the se_map_generic() call for file opens and POSIX ACL mapping, so I added that also. This code, although ugly, now passes the deny mode torture tests plus the delete on close tests I added. I do need to add one more multiple connection delete on close test to make sure I got the semantics exactly right, plus we should also (as Andrew suggested) move to random testing here. The good news is that NT should now correctly delete the file on disk full error when copying to a disk :-). Jeremy. (This used to be commit 51987684bd231c744da2e5f3705fd236d5616173)
2001-03-28Fixed the problem Gerald reported. Unfortunately we need to go back toJeremy Allison1-194/+110
reporting imaginary "default" inheritable ACLs on directories, otherwise, when you add an entry and click on apply without noticing there's no default entry associated with it, it applies a null acl on the files within the directory (hey, that's what you told NT you wanted, right ! :-). Also ensure that minimum permissions for a directory are r-x for owner, not just r--. Jeremy. (This used to be commit 4fa8cf68c3921f93a27d290d6dd1ed4423dfcf1c)
generated by cgit (git 2.34.1) at 2024-12-25 11:30:04 +0000