| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
metze
|
|
The underlying problem
is that once SMBulogoff is called, all server_info contexts associated with the
vuid should become invalid, even if that's the context being currently used by
the connection struct (tid). When the SMBtdis comes in it doesn't need a valid
vuid value, but the code called inside vfs_full_audit always assumes that there
is one (and hence a valid conn->server_info pointer) available.
This is actually a bug inside the vfs_full_audit and other code inside Samba,
which should only indirect conn->server_info on calls which require AS_USER to
be set in our process table. I could fix all these issues, but there's no
guarentee that someone might not add more code that fails this assumption, as
it's a hard assumption to break (it's usually true).
So what I've done is to ensure that on SMBulogoff the previously used
conn->server_info struct is kept around to be used for print debugging purposes
(it won't be used to change to an invalid user context, as such calls need
AS_USER set). This isn't strictly correct, as there's no association with the
(now invalid) context being freed and the call that causes conn->server_info to
be indirected, but it's good enough for most cases.
The hard part was to ensure that once a valid context is used again (via new
sessionsetupX calls, or new calls on a still valid vuid on this tid) that we
don't leak memory by simply replacing the stored conn->server_info pointer. We
would never actually leak the memory (as all conn->server_info pointers are
talloc children of conn), but with the previous patch a malicious client could
cause many server_info structs to be talloced by the right combination of SMB
calls. This new patch introduces free_conn_server_info_if_unused(), which
protects against the above.
Jeremy.
|
|
smbd to
access a freed structure.
Jeremy.
|
|
We need to store the "force group" uid separately from the
conn->server_info token as we need to apply it separately also.
Volker PLEASE CHECK !
Jeremy.
|
|
The goal is to move all this variables into a big context structure.
metze
|
|
We always free the value at the end of the function,
so we don't need a static variable to hold just NULL
for the time the function isn't executed.
metze
|
|
A somewhat more elegant fix than I could use for 3.2.x or 3.0.x.
Turns out the only part of check_user_ok() that needs to change
for share level security is the VUID cache pieces, so I can just
always use check_user_ok() for all lp_security() cases.
Jeremy
|
|
|
|
Jeremy.
|
|
talloc_autofree_context() instead of NULL.
Remove the code in memcache that does a TALLOC_FREE on stored pointers. That's a disaster waiting
to happen. If you're storing talloc'ed pointers, you can't know their lifecycle and they should
be deleted when their parent context is deleted, so freeing them at some arbitrary point later
will be a double-free.
Jeremy.
|
|
No functional change, this is a preparation for more current_user ref removal
(This used to be commit dcaedf345e62ab74ea87f0a3fa1e3199c75c5445)
|
|
(This used to be commit 1025f687910ce40283c7344ed67ebd5bf31217b7)
|
|
(This used to be commit 68944ea1ea7a0a63b08cbfc703f5ee29d2627696)
|
|
(This used to be commit 45662b5e8b3c7bc39cb33c5d7deb7e9a91f30a8b)
|
|
Most already used it, these two still used SNUM(conn), where the only caller of
this routine (change_to_user) had set snum = SNUM(conn).
(This used to be commit b14e59bfdbfb62494002e22d0665c4d420484245)
|
|
(This used to be commit 5c916549f002d5e4e06f24d396a2bdca73d384c7)
|
|
This required to pass around the domain a bit
(This used to be commit 17b0db20d28d1b737c5e86b78106657e8ca5ce9c)
|
|
(This used to be commit 0f19bc3f65bfc132aea1de1e76fcb4ee625a050f)
|
|
(This used to be commit 2834dacc8d49f77fe55fb5d7e3eb2dda431d1d3d)
|
|
(This used to be commit a3738aef59e97d4533010b048534d937d36c0950)
|
|
(This used to be commit 1a406def02bf171b223467d6b76317586d6205fc)
|
|
(This used to be commit c4bed3a48b86d44ad641250add2fc189af7e72f5)
|
|
Jeremy, please check!
(This used to be commit a34f73521712e3820d417f0d9ed811723b7681d6)
|
|
(This used to be commit 87383a4605ab99d32fccae7793dc5292b8f3e25b)
|
|
(This used to be commit 420de035237bb08bc470c9eb820f3da2edaa6805)
|
|
(This used to be commit aa2299d42adf4d27e707ac755e07be70d0af1bb4)
|
|
(This used to be commit 51d5d512f28eadc74eced43e5e7f4e5bdff3ff69)
|
|
This reverts commit 50c891d3dfb75c9f607f7ad2a578aa3ba5d91988.
There's more to this code -- sorry for the spam
(This used to be commit 6e0e0cb8dd6f57de36c041e2ba4b82feeb357ce8)
|
|
With the old code, if more than VUID_CACHE_SIZE elements were used all new
entries ended up in slot 0. With this checkin we do cycle.
Jeremy, please revert if the old behaviour was intentional
(This used to be commit 50c891d3dfb75c9f607f7ad2a578aa3ba5d91988)
|
|
(This used to be commit b59b436997fba47afd02ffb6f1194dfaef229d44)
|
|
(This used to be commit 3fc85d22590550f0539215d020e4411bf5b14363)
|
|
bugs in various places whilst doing this (places that assumed
BOOL == int). I also need to fix the Samba4 pidl generation
(next checkin).
Jeremy.
(This used to be commit f35a266b3cbb3e5fa6a86be60f34fe340a3ca71f)
|
|
(This used to be commit b0132e94fc5fef936aa766fb99a306b3628e9f07)
|
|
Jeremy.
(This used to be commit 407e6e695b8366369b7c76af1ff76869b45347b3)
|
|
since any SID/uid/gid translation calls will reset the struct when
popping the security ctx. This should fix the standalone server
configuration issues reported by David Rankin (thanks for the logs).
(This used to be commit 63cb25bad19d9600399a6ee2221497d71e805320)
|
|
acls code. I'm pretty sure this was safe, but become_root()
does other things to the token stack that become_root_uid_only()
does not, and as we're going into a vfs redirectred function
I decided it wasn't safe for now.
Jeremy.
(This used to be commit b3e0f45488595aa96c852dab8e1349631a85dded)
|
|
the snum,
and the decision which token to use (conn or vuser) does not really belong
here, it is better done in the two places where this is called.
Volker
(This used to be commit 0a138888adf7a0f04a38cd911e797e1a379e908b)
|
|
to do the upper layer directories but this is what
everyone is waiting for....
Jeremy.
(This used to be commit 9dafb7f48ca3e7af956b0a7d1720c2546fc4cfb8)
|
|
macro which sets the freed pointer to NULL.
(This used to be commit b65be8874a2efe5a4b167448960a4fcf6bd995e2)
|
|
Sync with trunk as off r13315
(This used to be commit 17e63ac4ed8325c0d44fe62b2442449f3298559f)
|
|
by saving the UNIX token used to set a delete on close flag,
and using it when doing the delete. libsmbsharemodes.so still
needs updating to cope with this change.
Samba4 torture tests to follow.
Jeremy.
(This used to be commit 23f16cbc2e8cde97c486831e26bcafd4ab4a9654)
|
|
names
(This used to be commit c08bc30698eac2f3f5dd8257b4fd7c3e23e6de39)
|
|
conn->service, so there's no point in passing down the whole conn struct.
Volker
(This used to be commit 39041297c771795efaa4292bc6e8020c1a047f32)
|
|
iterator functions so it can be used easily in a for loop.
Drops duplicated code from posix_acls.c
Jeremy.
(This used to be commit 81f30bf5985f5c6dc8399c4695dfa6f14140fde1)
|
|
Guenther
(This used to be commit bc64bb0d206c54487e372824a14c38a4ba8f3c5a)
|
|
security descriptor, allow read access. The code failed in this case.
Jeremy, could you please cross-check this? The way I understood your code it
could only work if smb.conf and secdesc said the same. This made the use of
srvmgr a bit difficult.... What was your intention on how to use the
share_info.tdb?
The current code might check the secdesc twice, but I don't see any decent way
around it that does not completely clutter the code.
Volker
(This used to be commit 7c673bd910e1fcbbf07198f38ceddd81e9064c11)
|
|
Jeremy.
(This used to be commit 9fe2240d6b68a2f8a495df585d69ae20c9825d77)
|
|
Jeremy.
(This used to be commit f0f7a48327ba1808088bc8c4e5d48b5cbeaeb4e3)
|
|
add static
smbd/uid.c:
remove unused function
Andrew Bartlett
(This used to be commit ab25af0e18d883757775a85f005775a79a86dcc8)
|
|
auth subsystem.
Andrew Bartlett
(This used to be commit 5693730594b1a861c7916cac7d156cf6a9d913cd)
|
