Age | Commit message (Collapse) | Author | Files | Lines |
|
This patch add privilege support for samba
Currently it is implemented only for tdbsam backend but estending it to
other sam backends is straightforward.
I must make a big thank to JFM for his teachings on the matter and the
functions at the base of this work.
At thye moment only samr_create_user honours SeAddUsersPrivilege and
SeMachineAccountPrivilege to permit any user to add machines and/or users to
the server.
The command "net priv" has been provided to manipulate the privileges
database.
There are still many things to do (like support in "net rpc vampire") but
the working core is here.
Feel free to comment/extend on this work.
Of course I will deny that any bug may affect this code :-)
Simo.
This patch adds also my patch about add share command enhancements.
(This used to be commit 7a78c3605e203bd8e0d7ae244605f076a5d0b0bc)
|
|
Jeremy.
(This used to be commit a7d4a6d1167f7657113148cdf68ea3c491b51b14)
|
|
postexec script
(This used to be commit bbc403ec6ee119f1bbb636deb40563dfdf258a74)
|
|
>Ensure %S gets expanded in read/write lists.
>Jeremy.
(This used to be commit 424acd6ee92c46c565886c3305c3492737538d3d)
|
|
* set version string to "CVS 3.1.0alpha1"
(This used to be commit c6a61ffcbd0c95afd94bd33fd832b24bc8209de5)
|
|
(This used to be commit c17a7dc9a190156a069da3e861c18fd3f81224ad)
|
|
(This used to be commit 3101c236b8241dc0183995ffceed551876427de4)
|
|
prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE
(This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad)
|
|
(This used to be commit 249a6974702d050644d6d61f33f0034ce2a689ee)
|
|
Andrew Bartlett
(This used to be commit e8aa615591dc44de4de85322d455a47b3122b9eb)
|
|
(This used to be commit beedde03fcdd37b567661d96d97efaac640601bd)
|
|
Jeremy.
(This used to be commit 186d53cbc1642ee5dd1daf0277dc08de621eede2)
|
|
client requested on tconx. We now return the same error
code like NT4SP6 and W2kSP3 return.
TCONDEV is a little test for this.
Volker
(This used to be commit 6ab88f31d6773f16baff8421ec9e530461cc8f93)
|
|
Jeremy.
(This used to be commit e8155fade61e9dc308a82f442453803160c36806)
|
|
Andrew Bartlett
(This used to be commit a0208a4f74f9c61eb1e346d9cb62dbe00ef4c24a)
|
|
in the function prototype, and change callers to respect this.
Andrew Bartlett
(This used to be commit 9f3d3c380120f16d76d68f346799282d61eec892)
|
|
(This used to be commit 53b8f8a44141a9f6d36ed1b237ff65c67119edd0)
|
|
When we look see if a user is in a list, and we try to 'expand' an @group, we
should lookup the user's own list of groups, rather than looking for all the
members of a group.
I'm sure this will fix some nasty performance issues, particularly on large
domains etc. In particular, this avoids contacting winbind at all, if the
group is not a winbind group.
(This caused a deadlock on my winbind-on-PDC setup).
The groups list always includes the user's primary group, as per the
getgrouplist manpage, and my recent changes to our implementation.
Andrew Bartlett
(This used to be commit 9be21976f7662ebe6eb92fff7cecbdb352eca334)
|
|
the commit to reply.c just matches a pstrcpy for the pstring. (harmless, fixes
it for the automated test).
Andrew Bartlett
(This used to be commit ef9c7586ac152304cacaf2c16115adc2bccefc22)
|
|
the loaded list on error). Also change some of the error returns, becouse
NT_STATUS_UNSUCCESSFUL gives a most useless error message on the client.
As for which error, my logic is that a share without a valid VFS module is
not a valid share, and therefore should return the same error as a non-existant
share.
Andrew Bartlett
(This used to be commit 41178afdbd2b3de94cf272ce32764a1947e73ea8)
|
|
(This used to be commit 9df93b1ffc9ce98302540cc3d2cbd66787abc4fd)
|
|
this follows the method used for remote_machine and also fixes the
problem of anonymous connections clobbering the string
(This used to be commit 9ead4fc3c3f8b83f03c762a4dab77a64aabccbf9)
|
|
some basic usages like 'include = smb.conf.%U'
This changes fixes things again, by checking for reload after we setup
current_user in tconx.
(This used to be commit d664e6b4d20d545b31910666d9cea7384fd40a73)
|
|
dashes of const. This is a rather large check-in, some things may break.
It does compile though :-).
Jeremy.
(This used to be commit 82b8f749a36b42e22186297482aad2abb04fab8a)
|
|
sending broadcast messages. Also initial cut-down of printing notify
messages (not yet finished).
Jeremy.
(This used to be commit aca333719695b278843c59e1c6eb07d6655fd59c)
|
|
- Don't print an uninitialised buffer in service.c
- Change some charcnv.c functions to take smb_ucs2_t ** instead of void **
- Update NTLMv2 code to use dynamic buffers
- Update experimental SMB signing code - still more work to do
- Move sys_getgrouplist() to SAFE_FREE() and do a DEBUG() on initgroups()
failure.
Andrew Bartlett
(This used to be commit de1964f7fa855022258a84556b266100b917444b)
|
|
our authenticaion code - removing some of the duplication from the current
code.
This also gets us *much* closer to supporting a real SAM backend, becouse the
SAM can give us the right info then.
This also changes our service.c code, so that we do a VUID (rather than uid)
cache on the connection struct, and do full NT ACL/NT_TOKEN checks (or cached
equivilant) on every packet, for the same r or rw mode the whole share was open
for.
Andrew Bartlett
(This used to be commit d8122cee059fc7098bfa7e42e638a9958b3ac902)
|
|
(This used to be commit fb28abd120310a591bdf5fa1afc5521443c3d34c)
|
|
the new accessor functions.
Andrew Bartlett
(This used to be commit f393de2310e997d05674eb7f1268655373e03647)
|
|
session setup, it would not correctly pick up the [homes] share on a subsequent
session setup.
The new rules are: If you want to connect to [homes], then it must have been
available at session setup time, or you must be in security=share. At each
session setup, the user's copy of [homes] is updated to ensure it has the right
path etc.
Andrew Bartlett
(This used to be commit 5d2c7816a3ea02a67c5b501626d91d43557e9dd9)
|
|
Andrew Bartlett
(This used to be commit 2febc7ce1aa6b01ec68bd007ce0286813dff301d)
|
|
(This used to be commit 0229f610a8cf9e82618cc6850a431ac89ffc7630)
|
|
Jeremy.
(This used to be commit 44410af397c386f58067679012856150b07b47e8)
|
|
(This used to be commit 61c524e8102d4f5cdcf7c949b55b5dc67a320c74)
|
|
* DeletePrinterDriverEx() now has the ability to delete
driver files. I need to do some more testing
tro veriofy that we are in fact not deleting a file out from
under another driver, but it looks ok so far.
* DeletePrinterDriver() noiw deletes all versions of the
specified driver (cversion == 0, 1, 2, 3)
(This used to be commit 17bb780e1327663fa2fcd6a3cb25dd461a29c537)
|
|
Jeremy.
(This used to be commit aad40894404d000b925024e2f63977f87ecb5a6b)
|
|
(This used to be commit 06529c0433bf75790aad27dd3cecf7005612c694)
|
|
Went through and checked all string_subs I could to ensure they're being
used correctly.
Jeremy.
(This used to be commit 17cae0d683be404be69554cd0e84117bdcc56c87)
|
|
to a Samba print server running HEAD in a while. This has been broken
since tridge's changes to make_connection() to not do the chdir()
to the connect_path. Sorry it took me so long to get around to fixing it.
The problem occured with our internal use of make_connection().
jerry
(This used to be commit b5bc8aa0f68ceebfb5c0ec15ff93b0172cec36d8)
|
|
and we seem to have eliminated the segfault.
Unfortunetly I'm still at a bit of a loss as to why it did segfault, but
the patch is correct in any case.
Andrew Bartlett
(This used to be commit 70c16188c7a267f9f3f8de0b6830f66c9e68a2c7)
|
|
The aim of this execise is to give the 'security>=user' code a straight paper
path. Security=share will sill call authorise_login(), but otherwise we avoid
that mess.
This allow *much* more accurate error code reporting, beocuse we don't start
pretending that we can use the (nonexistant) password etc.
Also in this patch is code to create the 'homes' share at session setup time
(as we have done in the past - been broken recently) and to record this on
the user's vuser struct for later reference. The changes here should also
allow for much better use of %H (some more changes to come here).
The service.c changes move a lot of code around, but are not as drastric
as they look...
(Also included is a fix to srv_srvsvc_nt.c where 'total_entries' not
'*total_entries' was compared).
This code is needs testing, but passes my basic tests.
I expect we have lost some functionality, but the stuff I had expected
to loose was already broken before I started. In particular, we don't 'fall
back' to guest if the user cannot access a share (for security=user). If you
want this kind of stuff then you really want security=share anyway.
Andrew Bartlett
(This used to be commit 4c0cbcaed95231f8cf11edb43f6adbec9a0d0b5c)
|
|
and renamed to str_list_* as it is a better name.
Elrond should be satisfied now :)
(This used to be commit 4ae260adb9505384fcccfb4c9929cb60a45f2e84)
|
|
cleanup some of the code in net_rpc_join re const warnings and
fstrings.
Passdb:
Make the %u and %U substituions in passdb work.
This is done by declaring these paramters to be 'const' and doing
the substitution manually. I'm told this is us going full circle,
but I can't really see a better way.
Finally these things actually seem to work properly...
Make the lanman code use the pdb's recorded values for homedir etc
rather than the values from lp_*()
Add code to set the plaintext password in the passdb, where it can
decide how to store/set it. For use with a future 'ldap password
change' option, or somthing like that...
Add pdb_unix, so as to remove the 'not in passdb' special cases from the
local_lookup_*() code. Quite small, as it uses the new 'struct passwd ->
SAM_ACCOUNT' code that is now in just one place. (also used by pdb_smbpasswd)
Other:
Fix up the adding of [homes] at session setup time to actually pass
the right string, that is the unix homedir, not the UNC path.
Fix up [homes] so that for winbind users is picks the correct name.
(bad interactions with the default domain code previously)
Change the rpc_server/srv_lsa_nt.c code to match NT when for the
SATUS_NONE_MAPPED reply: This was only being triggered on
no queries, now it is on the 'no mappings' (ie all mappings failed).
Checked against Win2k.
Policy Question: Should SID -> unix_user.234/unix_group.364 be
considered a mapping or not? Currently it isn't.
Andrew Bartlett
(This used to be commit c28668068b5a3b3cf3c4317e5fb32ec9957f3e34)
|
|
(This used to be commit e75e4ad7d3af5beee48b3001fd904eede8df033f)
|
|
tconx, so win2000 clients don't expect a permissions error in
tconx. We now match this behaviour, by only checking that the
directory exists during tconx and relying on the permissions on other
calls to protect directories
(This used to be commit 4fc476686476da31cc2b45badb05cb0765259f98)
|
|
Changed "SMB/Netbios" to "SMB/CIFS" in file header.
(This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
|
|
<a.bokovoy@sam-solutions.net>.
This patch is designed to remove the 'special cases' required for this support.
In particular this now kills off winbind_initgroups, as it appears no longer to
be required.
Andrew Bartlett
(This used to be commit f1d8d509766e9169d39332559162cfec249bfc70)
|
|
Andrew Bartlett
(This used to be commit 8cac618174365825e8b1824f70cb42afbce5e500)
|
|
Jeremy.
(This used to be commit c1b97226db63daf64359e79083a4754e7c7f8054)
|
|
and constness changes.
(This used to be commit cee0ec72746122c962e6c5278a736266a7f2c424)
|