| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Jeremy.
(This used to be commit f4c32a75e6e60eae6078449478d04ff22373d817)
|
|
Jeremy.
(This used to be commit cdbd2e99775642dc2e92004be9014bf38a92d80f)
|
|
Jeremy.
(This used to be commit b809a2d0c81c54e917ccc0c99b3e70ea8d7ceab1)
|
|
with PCL drivers. The problem was we were updating the changeid on every
SETPRINTERDATA/DELETEPRINTERDATA call. We should not do this, we should
just update the 'setprinter' called count. We update the changeid on calls
to SETPRINTER/ADDPRINTER/ADDPRINTEREX etc. Also fixed the correct returning
of the create time on printers.
Jeremy.
(This used to be commit 521f09829fd329f87b3d19e8871e2b989c98a58e)
|
|
(This used to be commit cae5eeb16e81b6aa95c68223268513c32aed7056)
|
|
(This used to be commit 2817b6cc8af3edbaa63b5db67689ab94cb240d4f)
|
|
(This used to be commit 5aed84b74981a4f4fcc4d466ef03178eff22ba85)
|
|
Added debug messages to se_access_check().
Added FULL_ACCESS acl to default acl on printers.
Jeremy.
(This used to be commit 7507f6f408cf8b0f8d7e2b3da54ce5fb5ef5343b)
|
|
with the current user. This will allow se_access_check() to quickly do
a SD check without having to translate uid/gid's to SIDs.
Still needs work on pipe calls.
Jeremy.
(This used to be commit e28d01b744b3dbd33e0e54af4e7f426fa8c082b8)
|
|
get ready and fix se_access_check().
Added cannonical lookup_name(), lookup_sid(), uid_to_sid(), gid_to_sid()
functions that look via winbind first the fall back on local lookup.
All Samba should use these rather than trying to call winbindd code
directly.
Added NT_USER_TOKEN struct in user_struct, contains list of NT sids
associated with this user.
se_access_check() should use this (cached) value rather than attempting
to do the same thing itself when given a uid/gid pair.
More work needs to be done to preserve these things accross security
context changes (especially with the tricky pipe problem) but I'm
beginning to see how this will be done..... probably by registering
a new vuid for an authenticated RPC pipe and not treating the
pipe calls specially.
More thoughts needed - but we're almost there...
Jeremy.
(This used to be commit 5e5cc6efe2e4687be59085f562caea1e2e05d0a8)
|
|
Jeremy.
(This used to be commit 2aa21db960666736331b18956422b7c13aad0f0f)
|
|
jreilly@hp.com.
Memory leak fix for new sec_ctx code (sorry Tim :-).
Jeremy.
(This used to be commit edaf49c66d5a5ccf6689b358c301e208599a468f)
|
|
code. This code is now implemented as a stack of security contexts, where
a security context is defined as a set of effective user, group and
supplementary group ids.
The following functions are implemented:
BOOL push_sec_ctx(void);
Create a new security context on the stack which is the same as the
current security context.
void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups);
Set the current security context to a given set of user and group
ids.
void set_root_sec_ctx(void);
Set to uid = gid = 0. No supplementary groups are set.
BOOL pop_sec_ctx(void);
Pop a security context from the stack and restore the user and group
permissions of the previous context.
void init_sec_ctx(void);
Initialise the security context stack. This must be called before any
of the other operations are used or weird things may happen.
The idea is that there is a base security context which is either root or
some authenticated unix user. Other security contexts can be pushed and
popped as needed for things like changing passwords, or rpc pipe operations
where the rpc pipe user is different from the smb user.
(This used to be commit 87c78d6d5a6bf8d0907d6f8ef5ee0d642946cad3)
|
