Age | Commit message (Collapse) | Author | Files | Lines |
|
plus internal fixes
1st stage
(This used to be commit 6d036761e565bc93964bb3c939d5b7d78d5778a3)
|
|
SAM_ACCOUNT does not have anymore uid and gid fields
all the code that used them has been fixed to use the proper idmap calls
fix to idmap_tdb for first time idmap.tdb initialization.
auth_serversupplied_info structure has now an uid and gid field
few other fixes to make the system behave correctly with idmap
tested only with tdbsam, but smbpasswd and nisplus should be ok
have not tested ldap !
(This used to be commit 6a6f6032467e55aa9b76390e035623976477ba42)
|
|
(This used to be commit dd8009bf599a6111440cd807dcc022039f19de15)
|
|
acls. This is needed because sid_to_uid always claims that the sid is
a user, due ot a change I made some months back.
This change was suggested by Chere Zhou, but is really an interim
measure. Chere is looking at a longer term solution.
(This used to be commit b3edfa91964d2edfd1692fa58f98de00405e14c4)
|
|
Jeremy.
(This used to be commit e81427c2d69be166afad94bc083e750e8f48fba7)
|
|
-------------------------------------------------------------------------
I think there are basically two problem:
1. Windows clients do not always send ACEs for SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ,
and SMB_ACL_OTHER.
The function ensure_canon_entry_valid() is prepared for that, but tries
to "guess" values from group or other permissions, respectively, otherwise
falling back to minimum r-- for the owner. Even if the owner had full
permissions before setting ACL. This is the problem with W2k clients.
2. Function set_nt_acl() always chowns *before* attempting to set POSIX ACLs.
This is ok in a take-ownership situation, but must fail if the file is
to be given away. This is the problem with XP clients, trying to transfer
ownership of the original file to the temp file.
The problem with NT4 clients (no ACEs are transferred to the temp file, thus
are lost after moving the temp file to the original name) is a client problem.
It simply doesn't attempt to.
I have played around with that using posic_acls.c from 3.0 merged into 2.2.
As a result I can now present two patches, one for each branch. They
basically modify:
1. Interpret missing SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, or SMB_ACL_OTHER
as "preserve current value" instead of attempting to build one ourself.
The original code is still in, but only as fallback in case current values
can't be retrieved.
2. Rearrange set_nt_acl() such that chown is only done before setting
ACLs if there is either no change of owning user, or change of owning
user is towards the current user. Otherwise chown is done after setting
ACLs.
It now seems to produce reasonable results. (Well, as far as it can. If
NT4 doesn't even try to transfer ACEs, only deliberate use of named default
ACEs and/or "force group" or the crystal ball can help :)
-------------------------------------------------------------------------
Jeremy.
(This used to be commit 8ec20cbae7ca7e685b1a4186d8482c7405915dc3)
|
|
must not be freed afterwards.
Jeremy.
(This used to be commit 80bad908c0235a57446c70b9632d3415c9d2fcf5)
|
|
perms.
Jeremy.
(This used to be commit ac96fa173cc3bd1c3226634154d6f99e4034179f)
|
|
When we look see if a user is in a list, and we try to 'expand' an @group, we
should lookup the user's own list of groups, rather than looking for all the
members of a group.
I'm sure this will fix some nasty performance issues, particularly on large
domains etc. In particular, this avoids contacting winbind at all, if the
group is not a winbind group.
(This caused a deadlock on my winbind-on-PDC setup).
The groups list always includes the user's primary group, as per the
getgrouplist manpage, and my recent changes to our implementation.
Andrew Bartlett
(This used to be commit 9be21976f7662ebe6eb92fff7cecbdb352eca334)
|
|
Apparently acl_type is #defined to acl_common.entry_type in their acl.h....
Andrew Bartlett
(This used to be commit 3dfdaa0208ee538631378aa921300d95c596b70c)
|
|
This is not 100% the same as what SuSE shipped in their Samba, there is
a crash bug fix, a race condition fix, and a few logic changes I'd like to
discuss with Andreas. Added Andreas to (C) notices for posix_acls.c
Jeremy.
(This used to be commit a81d700ae9c82d4b7ea631ab7862162a2ed3d512)
|
|
Jeremy.
(This used to be commit a6b3acfc7b98066de6f4b0b6044772a4d56795cd)
|
|
share.
Jeremy.
(This used to be commit 80d30dbfec03d1d1e82c9e177ff66aa44b4ea993)
|
|
Jeremy.
(This used to be commit cfd1bf250b417f3ba3ad21ff681ab282311bb7eb)
|
|
Jeremy.
(This used to be commit 2b06fd305be10fa8a8629adb4a99ccd3960786da)
|
|
(This used to be commit 1de04ec4735c19ec21cdef6e679cea17c734c5f6)
|
|
we leave the gid alone.
Jeremy.
(This used to be commit 3f72910cf954b127c0cc06d6616ca2b8cd0d41ad)
|
|
Jeremy.
(This used to be commit 174df5d914b149e52bf260e6502f2436c2720958)
|
|
that only contains an "everyone" DACL doesn't apply this to user and group
entries also.
Jeremy.
(This used to be commit 2f67f39d219bbe110d52ed2680fd8ac57946756f)
|
|
what we do is map to the authenticated user when the sid is unmappable
and dos filemodes are enabled
(This used to be commit b6c2ef4f54e7b42125f8c89ee5a62b0ba6b52f59)
|
|
Jeremy.
(This used to be commit 7d59445b6962547a8938928a9371651a09e26516)
|
|
Based on code donated by Olaf Frączyk <olaf@cbk.poznan.pl>. Further commit
will change to sending via vfs interface.
Jeremy.
(This used to be commit d85133e2697eb22f1573c78447b57791ae63dd6b)
|
|
(This used to be commit c55737fb25dfed4697b93a600e3bd770f84bf464)
|
|
Changed "SMB/Netbios" to "SMB/CIFS" in file header.
(This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
|
|
(This used to be commit 7dc1c34145d66f4bbc5c6ce0bca4b224088366af)
|
|
when we free curr_ace_outer we need to not try to use it again :)
(This used to be commit 1c5e19a418136c0ae524e62a4907501212ebac3d)
|
|
Jeremy.
(This used to be commit 2d7b81e692ac2bcfd6e31223d3f8545c255cb47c)
|
|
a group name.
Jeremy.
(This used to be commit b926660e73d4c94c30ec5a365027770acdafe25e)
|
|
definitions.
(This used to be commit 9712d3f15a47155f558d0034ef71fd06afb11301)
|
|
Jeremy.
(This used to be commit 4a54a633c59a18b387427e89266e294bdddf8574)
|
|
Jeremy.
(This used to be commit bc7963bd643422cce081b6284e3bdd49ae3a02ab)
|
|
(This used to be commit a95943fde0ad89ae3f2deca2f7ba9cb5ab612b74)
|
|
Jeremy.
(This used to be commit 9961c4c1a3b2dbf8d1062bc1fa103488c0d0ba79)
|
|
on files that do not have an ACL
(This used to be commit 65ea13420c78cf0a8c01f14c08815e4b44ca4abc)
|
|
Digital UNIX).
Jeremy.
(This used to be commit 324ba0512ec84bb173c72be3dfd2447e0dc30e26)
|
|
This commit gets rid of all our old codepage handling and replaces it with
iconv. All internal strings in Samba are now in "unix" charset, which may
be multi-byte. See internals.doc and my posting to samba-technical for
a more complete explanation.
(This used to be commit debb471267960e56005a741817ebd227ecfc512a)
|
|
smbd/posix_acls.c: Attempt to fix the "lose default acl" problem in Solaris.
Needs testing.
lib/sysacls.c: Typo fix.
Jeremy.
(This used to be commit d989f8bd3e1524183a24fb67be1af05b3289f648)
|
|
cleaned on clients abending connections. Thanks Andrew !
Jeremy.
(This used to be commit 1b3977c5367a0b713b194f369abd9872ae01ac2a)
|
|
bits before checking if we should change them on non-acl systems.
Jeremy.
(This used to be commit aba243ca0867a0787f9f7c7b2cda6143bcc53087)
|
|
Removed "restrict acl with mask" - redundent.
Jeremy.
(This used to be commit 0db8a61d71f25ffa0e5c585e02e2fce973867156)
|
|
Jeremy.
(This used to be commit f100e091abc57a9ba983e7c3cf84bfda2dbc2e18)
|
|
and using autoconf tests.
Added "restrict acl with mask" parameter.
Jeremy.
(This used to be commit 7792e32ba7fd734cc68b354f31c382ac11521fe8)
|
|
Jeremy.
(This used to be commit a60ecb4e53a6c8a3a6a37a89042ae943202263fe)
|
|
Jeremy.
(This used to be commit f02e67a096b3bcf84615c4a6949c5e6283e07af0)
|
|
return a malloced area so added sys_acl_free_qualifier() calls to all supported
ACL interfaces to code with this (only Linux needs actual free call).
Jeremy.
(This used to be commit 5870e6019b82d2088b99acdc0f84e9e4847a1fa5)
|
|
Jeremy.
(This used to be commit fe38692643ad7c163c30d9c031a8bd3dec81ffee)
|
|
when copying to a full disk problem, I discovered that we were not allowing
the delete on close flag to be set properly, this led to other things, and
after investigation of the proper delete on close semantics and their relationship
to the file_share_delete flag I discovered there were some cases where we
weren't doing the deny modes properly. And this after only 5 years working
on them..... :-) :-).
So here's the latest attempt. I realised the delete on close flag needs to
be set across all smbds with a dev/ino pair open - in addition, the delete
on close flag, allow share delete and delete access requested all need to
be stored in the share mode tdb.
The "delete_on_close" entry in the fsp struct is now redundant and should
really be removed. This may also mean we can get rid of the "iterate_fsp"
calls that I didn't like adding in the first place. Whilst doing this patch,
I also discovered we needed to do the se_map_generic() call for file opens
and POSIX ACL mapping, so I added that also.
This code, although ugly, now passes the deny mode torture tests plus the
delete on close tests I added. I do need to add one more multiple connection
delete on close test to make sure I got the semantics exactly right, plus we
should also (as Andrew suggested) move to random testing here.
The good news is that NT should now correctly delete the file on disk
full error when copying to a disk :-).
Jeremy.
(This used to be commit 51987684bd231c744da2e5f3705fd236d5616173)
|
|
reporting imaginary "default" inheritable ACLs on directories, otherwise,
when you add an entry and click on apply without noticing there's no
default entry associated with it, it applies a null acl on the files
within the directory (hey, that's what you told NT you wanted, right ! :-).
Also ensure that minimum permissions for a directory are r-x for owner,
not just r--.
Jeremy.
(This used to be commit 4fa8cf68c3921f93a27d290d6dd1ed4423dfcf1c)
|
|
to the places where [f]chmod_acl is called instead.
Jeremy.
(This used to be commit 641ada44ae6429761c1fd0dbcafabc69f897fac7)
|
|
smbd/vfs.c: Don't call [f]chmod_acl if no acl support.
Jeremy.
(This used to be commit 83f52394e688b4be3ac4cef67d8980a5b8ed3192)
|