Age | Commit message (Collapse) | Author | Files | Lines |
|
being done if any of the directory timestamps were changed.
Jeremy.
(This used to be commit 915152ed981e8e537d15fd4b80b3c3d10ee86bff)
|
|
scan - then call this from renames. This allows instantaneous update for
W2k renames.
Jeremy.
(This used to be commit 07dffc4ee931cbc61197e2da277df9c404a77469)
|
|
authorising logins. If a user connected to a share as guest, then
the snum was getting flagged as "force guest", meaning that all
subsequent connections to it, even under a different vuid, would
be bounced to guest.
This explains several very hard to reproduce access denied bugs,
and as the NT client also has bugs in that it will sometimes
erroneously use guest instead of the correct vuid on an IPC$
connection lead to a *very* hard problem to find.
This fix should be propagated into all branches (TNG/Applience
take note) and I'll also make a separate patch availalble on the
samba-technical list.
Jeremy.
(This used to be commit 0264fdafe909cf9e995df3ae7b64bedbe0b4e8a1)
|
|
reply_sesssetup_and_X(). The getpwnam() wrapper handles the case
munging operations later.
this fixes a problem with mixed case usernames.
(This used to be commit 2ebfdd21b3123d7daefeeed4dae6e8bc3a7a7653)
|
|
The motivation for this system is to replace the UDP message for
oplocks, but this commit only does the "set debug level" message.
(This used to be commit 2a34ee95f3929cff131db6c5a2b4820194c05b2d)
|
|
(This used to be commit 2f33ec41ac1d3243340455b6c3a6cea22d267f14)
|
|
with security=domain. Also fixed to dynamically allocate the SIDs and GIDs.
Jeremy.
(This used to be commit 2b1f66eb82f05fe0b85ac5b4916e32847b8de675)
|
|
- make proto
- addition of function to convert from errno values to NT status codes
(source/lib/error.c)
- purge queue done without full access permission will purge only the
jobs owned by that user, rather than failing.
- unlock job database tdb before sending job to printer
- in print_job_start(), ensure that we don't pick a jobid with an existing
temporary file that may be owned by another user, as it causes silent
failures.
- fixes for printer permission checking for NT5 clients
(source/include/rpc_spoolss.h, source/printing/nt_printing.c,
source/printing/printing.c, source/rpc_server/srv_spoolss_nt.c)
- change from uint8 to 'enum SID_NAME_USE' (source/rpc_server/srv_lsa.c)
- fixed memory leaks for win95 driver download process
(source/smbd/lanman.c)
- properly free prs_structs and dacl in testsuite/printing/psec.c
(This used to be commit 74af3e2caec7197e5d1ca389e2f78054a4197502)
|
|
(This used to be commit 155c7c37398f5f9457ea249ded74f425b90ac9a0)
|
|
(This used to be commit b69c5de6bad9fad3aed1280e7d12fbfed276a16f)
|
|
Jeremy.
(This used to be commit 38fc56c8434c427335cf264c4b27420c5ad47566)
|
|
possible printjobs from that printer (I think this is correct).
Added error code returns for print_queue_XXX() functions.
Jeremy.
(This used to be commit 6d081a9017f87f59b7189ba507e211db01c40af5)
|
|
Thought I had already committed this.
jerry
(This used to be commit 2ceb704c3d06a92b97ba67ac82c007a7ba084b75)
|
|
acl code over to POSIX acls.
Jeremy.
(This used to be commit a2829febe12513d26534c4977c2f41f480f4fa0e)
|
|
smbd/reply.c: Fixed lowercasing UNIX character set problem.
Jeremy.
(This used to be commit 2b6e3ed7a6447d40d9dd7e9b5c286b1aabe4730d)
|
|
(This used to be commit cb717b4a2bb55eb2ff008e59203ebfeac6c5ab9f)
|
|
(This used to be commit 5aed84b74981a4f4fcc4d466ef03178eff22ba85)
|
|
(This used to be commit 567b0095b1b8393b3b1e32533aa2860ab3dbfa47)
|
|
Jeremy.
(This used to be commit 85738b7ee1ea6d88999d6aedc51a2daf545cb8b8)
|
|
code....
Jeremy.
(This used to be commit 28586c1dee18d99e0e0999ab1a945a33ce33c371)
|
|
stored in the TDB. See the message I posted about
this on samba-technical
* If the admin does not desire the new NT print driver
support, nothing needs to be done. All existing
parameters work the same.
* If the admin wants to take advantage of NT printer
driver support but does not want to migrate the 9x drivers
to the new setup, the leave the existing printers.def
file. When smbd attempts to locate a 9x driver for the
printer in the TDB and fails it will drop down to
using the printers.def (and all associated parameters).
The make_printerdef tool will also remain for backwards
compatibility but will be moved to the "this tool is the
old way of doing it" pile.
* If the admin installs a 9x driver for a printer on
a Samba host (in the printing TDB), this information will
take precedence and the three old printing parameters
will be ignored (including print driver location).
* If an admin wants to migrate the printers.def file into
the new setup, I can write a script to do this using
rpcclient. The main problem is the driver namespace
(we need the NT driver name first in order to
be consistent).
jerry
(This used to be commit ac049f8bf348810dc068382fdbc6635a2015d36a)
|
|
Added debug messages to se_access_check().
Added FULL_ACCESS acl to default acl on printers.
Jeremy.
(This used to be commit 7507f6f408cf8b0f8d7e2b3da54ce5fb5ef5343b)
|
|
unbecome_root() - typo.
Jeremy.
(This used to be commit ebb160663ed55e44e44f1c3d17eb077a32c2ffb9)
|
|
Added a become_root()/unbecome_root() (push/pop security context)
around the initgroups() call to ensure it would succeed. Hmmm - I
wonder if this call being done as non-root might explain any "group access"
bugs we've had in the past....
Jeremy.
(This used to be commit 06a65972e872f37d88b84f22ea714feebd38f6c0)
|
|
with the current user. This will allow se_access_check() to quickly do
a SD check without having to translate uid/gid's to SIDs.
Still needs work on pipe calls.
Jeremy.
(This used to be commit e28d01b744b3dbd33e0e54af4e7f426fa8c082b8)
|
|
get ready and fix se_access_check().
Added cannonical lookup_name(), lookup_sid(), uid_to_sid(), gid_to_sid()
functions that look via winbind first the fall back on local lookup.
All Samba should use these rather than trying to call winbindd code
directly.
Added NT_USER_TOKEN struct in user_struct, contains list of NT sids
associated with this user.
se_access_check() should use this (cached) value rather than attempting
to do the same thing itself when given a uid/gid pair.
More work needs to be done to preserve these things accross security
context changes (especially with the tricky pipe problem) but I'm
beginning to see how this will be done..... probably by registering
a new vuid for an authenticated RPC pipe and not treating the
pipe calls specially.
More thoughts needed - but we're almost there...
Jeremy.
(This used to be commit 5e5cc6efe2e4687be59085f562caea1e2e05d0a8)
|
|
NT_STATUS_XXX).
Removed IS_BITS_xxx macros as they were just reproducing "C" syntax in a more
obscure way.
Jeremy.
(This used to be commit c55bcec817f47d6162466b193d533c877194124a)
|
|
from the NT printer tdb.
Also added checks for time restrictions before allowing a job to print.
Jeremy.
(This used to be commit 8cfb55e81abebf0354e6d470ed68bbac1d6560ad)
|
|
fix for the Win9x printer drivers.
Changed command names to add "command" string on the end for some consistancy
with the other scripting commands.
Added '%P' option to tdbpack/unpack to store long comment string.
Made port name be "Samba Printer Port" if no enum port script given.
Fixed prs_uint32_pre code to cope with null args.
Jeremy.
(This used to be commit 902ada63799cf27924c72e24e7593a8c9fb5eba9)
|
|
in the RPC code. This change was prompted by trying to save a long (>256)
character comment in the printer properties page.
The new system associates a TALLOC_CTX with the pipe struct, and frees
the pool on return of a complete PDU.
A global TALLOC_CTX is used for the odd buffer allocated in the BUFFERxx
code, and is freed in the main loop.
This code works with insure, and seems to be free of memory leaks and
crashes (so far) but there are probably the occasional problem with
code that uses UNISTRxx structs on the stack and expects them to contain
storage without doing a init_unistrXX().
This means that rpcclient will probably be horribly broken.
A TALLOC_CTX also needed associating with the struct cli_state also,
to make the prs_xx code there work.
The main interface change is the addition of a TALLOC_CTX to the
prs_init calls - used for dynamic allocation in the prs_XXX calls.
Now this is in place it should make dynamic allocation of all RPC
memory on unmarshall *much* easier to fix.
Jeremy.
(This used to be commit 0ff2ce543ee54f7364e6d839db6d06e7ef1edcf4)
|
|
Jeremy.
(This used to be commit 5130dd0f8b80aed5fb3c0df290b627057cc9b825)
|
|
Jeremy.
(This used to be commit 0bd88d304cd773e0bbf3e6f7fedcb3b544d41cbe)
|
|
- changed the default forms flag to 2
- all short architecture name are uppercased
- get_short_archi() is now case unsensitive
- the drivers TDB is indexed by archi/version/name
- implemented code to move drivers from the upload area to the download
area. Someone else need to look at that code.
- don't return anymore a default driver if it doesn't exist in the TDB.
Instead return an error.
- cleaned prs_unistr.
- #ifdef out jeremy's new SD parsing in printer_info_2
- removed the unused MANGLE_CODE
- #ifdef out the security checking in update_printer() as it doesn't work
for me.
Zap your ntdrivers.tdb, it won't work anymore.
J.F.
(This used to be commit ac0a145acc0953a6f362497abbf4dfe70aa522a6)
|
|
specifically wrong with this, but Samba is fooled by the client into
thinking the printer is a file share. Files copied to the share gather
dust in the spool directory and aren't printed.
This patch has the effect of not allowing printers to be mounted as file
shares. Not sure whether this is the correct solution or not.
{Jeremy,JF,Tridge} please check!
(This used to be commit dcf3249bb9fef2a05b376e9c8c1a0a7d602d8a2e)
|
|
main daemon was not catching sighup and reloading the service file.
(This used to be commit f026a897e9296a71fb5c4d5f6e1b4d3287689bde)
|
|
filed to be ignored when an upload is done.
Modified to code to goto err on problems, simplifies it.
Jeremy.
(This used to be commit 9157a6ab2646c035a731d53aa3be010488ccf51a)
|
|
printer driver download if looking for the default driver files fail.
Jeremy.
(This used to be commit 1192d867c4e863471f9bc12afceb68a23ba2142e)
|
|
(This used to be commit 898a483cdab1ed7d8ff902c0dc0e0620440ae4cd)
|
|
A user can now pause, resume or delete their own job even if they don't
have the Manage Documents privilege.
Added call to se_access_check() for changing printer properties. The Full
Access privilege is required for the user to perform this.
Several uninitialised variables and memory leaks plugged.
Modified default ACL created on new printers to be Everyone / Print instead
of Everyone / Full Access. This required some random stuffing around with
the value of the revision field to correspond with the ACL that NT produces
when setting the same permission on the printer.
Fixed dodgy function call in printing/printfsp.c
(This used to be commit 2abce4dcfa351051df6e5f789b34fa99c9b81c22)
|
|
(This used to be commit c1d242f1dd5b6addbe5d2df22e4759f6682fd9ef)
|
|
(This used to be commit e84607eedf3be454f8f709c70cafc5ded4ea951d)
|
|
(This used to be commit 3c4a5f624bfa69eb81d998530d9227e158edd109)
|
|
structure so authenticated pipe users can have their unix groups set when
become_authenticated_pipe_user() is called.
(This used to be commit 55c9bf124dc661df43bfe582ef14b1297aeaf0fa)
|
|
Jeremy.
(This used to be commit 2aa21db960666736331b18956422b7c13aad0f0f)
|
|
jreilly@hp.com.
Memory leak fix for new sec_ctx code (sorry Tim :-).
Jeremy.
(This used to be commit edaf49c66d5a5ccf6689b358c301e208599a468f)
|
|
(This used to be commit d0f55e04c9400481e4a981431715e167a8246e45)
|
|
(This used to be commit 3d0f1845c8cefccfabcfd35694264c1e5f52c3af)
|
|
Implemented become_root() and friends in terms of push/pop/set security
contexts.
(This used to be commit 0bcdcd0606fc2b6aba35b03255aad5bb2bd8e848)
|
|
Delete OriginalDir stuff.
(This used to be commit db5e6ad3a69a6fd744d8a22066587908470e3815)
|
|
code. This code is now implemented as a stack of security contexts, where
a security context is defined as a set of effective user, group and
supplementary group ids.
The following functions are implemented:
BOOL push_sec_ctx(void);
Create a new security context on the stack which is the same as the
current security context.
void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups);
Set the current security context to a given set of user and group
ids.
void set_root_sec_ctx(void);
Set to uid = gid = 0. No supplementary groups are set.
BOOL pop_sec_ctx(void);
Pop a security context from the stack and restore the user and group
permissions of the previous context.
void init_sec_ctx(void);
Initialise the security context stack. This must be called before any
of the other operations are used or weird things may happen.
The idea is that there is a base security context which is either root or
some authenticated unix user. Other security contexts can be pushed and
popped as needed for things like changing passwords, or rpc pipe operations
where the rpc pipe user is different from the smb user.
(This used to be commit 87c78d6d5a6bf8d0907d6f8ef5ee0d642946cad3)
|