Age | Commit message (Collapse) | Author | Files | Lines |
|
(This used to be commit 977dbdeaf363c8905ed9fd0570eba4be80582833)
|
|
Rather than killing off the nasty 'kludge ACLs' stuff, this patch
extends it, to ensure that LSA secrets and the registry are also
protected.
Andrew Bartlett
(This used to be commit 2f2b110fb870132099bad1d4c16ed8962affb3ce)
|
|
metze
(This used to be commit 08b41e10699c7bb8058ab0ab61f17a1bbfcc1ce4)
|
|
(This used to be commit 99e61dade2bd9ae2a5dfe17f766528012c09e46c)
|
|
(This used to be commit a7e6d2a1832db388fdafa1279f84c9a8bbfc87d6)
|
|
Also rename the corresponding wrap_ functions.
(This used to be commit e59c2eaf681f076d175b9779d1c27b5f74a57c96)
|
|
(This used to be commit 15038d9586d0b58f301ca8c39c21ef10c4283f28)
|
|
bunch of {}'s.
- Start working on Python equivalents for various EJS tests.
- Fix regression in argument order for reg_diff_apply() in EJS bindings.
(This used to be commit c550c03372cb260b78f6a6c132e70571bc4cb852)
|
|
(This used to be commit 2b7cfa5d9ab94e1ff2d60719cd3749810463ab15)
|
|
(This used to be commit 760fcc8bfa2a7cd7641465cb3bae889e9e0fbc75)
|
|
(This used to be commit 3378b6a559272cb702b52966692bf423f67a2b41)
|
|
(This used to be commit 08501fbef38f81ce5ff4885a1696f9cb392fd631)
|
|
(This used to be commit 87472e35c04fdf0c61c9133bab3c05bda11eba00)
|
|
(This used to be commit 8625cd403ba3a7d2b1b1fccfeb5efd7e21de0135)
|
|
(This used to be commit f734df3144cdd9ff280ee1cac2c3a7f972716f5d)
|
|
so that we
can add and delete ACEs for SACLs as well as for DACLs.
Guenther
(This used to be commit 947fff994181f0ae50ac76d09621ddd684873112)
|
|
Guenther
(This used to be commit 0306e0183d4db0da331449b411814e7a93b6db2d)
|
|
Guenther
(This used to be commit 2e028503a36acd12009a4d2f0d217b2d940c9c30)
|
|
Guenther
(This used to be commit 99408cf20c6feb745cd2dd56c37015cfa11e9b3d)
|
|
Guenther
(This used to be commit 1ebcceb922bdb566e6a548aa1ad816eb8e9e26e9)
|
|
security_descriptor_create().
Guenther
(This used to be commit 7dd0d28d254f78891b0807492baafa188b42df16)
|
|
Guenther
(This used to be commit 7d8f53b1c73dc4025821d96d8f675b6866407acb)
|
|
(This used to be commit 566aa14139510788548a874e9213d91317f83ca9)
|
|
Jeremy.
(This used to be commit 0844dbf597191b3e4d35a696695b229e986daec4)
|
|
(This used to be commit 5085c53fcfade614e83d21fc2c1a5bc43bb2a729)
|
|
(This used to be commit 08bb1ef643ab906f1645cf6f32763dc73b1884e4)
|
|
There are still a few tidyups of old FSF addresses to come (in both s3
and s4). More commits soon.
(This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
|
|
if someone isn't interessted in one of it
metze
(This used to be commit 1fdc71918a430c35af91fa7788e191d381f76d56)
|
|
an ace
metze
(This used to be commit 18cc56be6a7c21e5b19d0826aca6ae2416c116b8)
|
|
metze
(This used to be commit 6ce994720cdd8b7dd0b789460b5ae7da19261696)
|
|
to be SECURITY_ACL_REVISION_ADS (4)
metze
(This used to be commit a67bb4365958f4bfadbf47b2231992e2aadd26a1)
|
|
the SDDL string has the sid strings embedded, so we need to create
a null terminated string...
metze
(This used to be commit 532395a18db84affa8a743b995e9fae2e3c312f2)
|
|
(This used to be commit bb393603707ada3d4b917f8374b7738f16c78f46)
|
|
snprintf seems
to be broken. The %lu modifies apparently can not cope with the high
bit==1. In dom_sid_string I added some printfs and got:
auth: 21
auth: 2666793276
auth: 679821296
auth: 2310223117
auth: 1206
sid=S-1-5-21-8446744072081377596-679821296-8446744071724807437-1206
The "auth:" values are direct printfs, the sid= is the resulting code from
dom_sid_string.
I could not reproduce it with a simple test program, and #ifdef'ing out
HAVE_SNPRINTF in config.h manually does not help either, probably because the
dynamic linker overwrites the symbol in lib/replace.
Checking it in because it fixes the RPC-SAMBA3-SHARESEC test directly on host
"sunx", I would like to see whether it also fixes IRIX and AIX.
Volker
(This used to be commit 1a9401738f652a87d377a32086342f5f98525fc2)
|
|
security
descriptor. This is something that W2k3 does _not_ pass and probably is not
expected to, it seems the don't check access at tconX time.
Thanks to metze for the hint how in the srvsvc_NetShareInfo1501 struct the
length of the sd can be encoded in idl.
As metze says, there's probably more to the share secdesc, this needs more
testing. This one is here to walk the samba3 code.
Volker
(This used to be commit 67185508229a8d7f144c22cb194f573c932d6de5)
|
|
Split of system/locale.h header from system/iconv.h
Previously, iconv wasn't being used on these systems
(This used to be commit aa6d66fda69779d1c2948a1aca85dbd5208f1cba)
|
|
(This used to be commit 849818dcdeb8eaf2eb22fea3896a4f7c777d8c5f)
|
|
Remove some autogenerated headers (which had prototypes now autogenerated by pidl)
Remove ndr_security.h from a few places - it's no longer necessary
(This used to be commit c19c2b51d3e1ad347120b06a22bda5ec586c22e8)
|
|
rest of LIBSECURITY doesn't)
Make the ldb password_hash module only depend on some keys manipulation code, not full heimdal
Some other dependency fixes
(This used to be commit 5b3ab728edfc9cdd9eee16ad0fe6dfd4b5ced630)
|
|
for REQUIRED_SUBSYSTEMS.
(This used to be commit adc8a019b6da256f104abed1b82bfde6998a2ac9)
|
|
desired but SeSecurityPrivilege isn't granted
metze
(This used to be commit be7285bdebd58e7a86fcc64f7b22b9f533bcc4f5)
|
|
- remove sid_active_in_token() was the same as security_token_has_sid()
- rename some functions
metze
(This used to be commit 81390dcda50f53d61e70059fb33014de0d283dc5)
|
|
the problem was that we shift with <<= (privilege-1)
and we called the function with privilege=0
add some checks to catch invalid privilege values
and hide the mask representation in privilege.c
metze
(This used to be commit a69f000324764bcd4cf420f2ecba1aca788258e4)
|
|
metze
(This used to be commit 9ec706238c173992dc938d537bdf1103bf519dbf)
|
|
- stack specific functions on top of generic ones
metze
(This used to be commit e391f3c98aae600c5f64d5975dd55567a09c3100)
|
|
metze
(This used to be commit 0ad464f686dddc5befdf1ec8d20101ee0ad83585)
|
|
(This used to be commit 51b4270513752d2eafbe77f9de598de16ef84a1f)
|
|
try to include just the BASENAME.h files (containing only structs)
(This used to be commit 3dd477ca5147f28a962b8437e2611a8222d706bd)
|
|
file dependencies
(This used to be commit 122835876748a3eaf5e8d31ad1abddab9acb8781)
|
|
the remote server's name, or in the absence of a local nbt_server to
communicate with (or without root access), a node status request.
The result is that we are in a better position to use kerberos, as well
as to remove the 'password server' mandatory parameter for the samsync
and samdump commands. (I need this to put these into SWAT).
The only problem I have is that I must create a messaging context, which
requires a server ID. As a client process, I don't expect to get
messages, but it is currently required for replies, so I generate a
random() number. We probably need the servers to accept connections on
streamed sockets too, for client-only tasks that want IRPC.
Because I wanted to test this code, I have put the NET-API-* tests into
our test scripts, to ensure they pass and keep passing. They are good
frontends onto the libnet system, and I see no reason not to test them.
In doing so the NET-API-RPCCONNECT test was simplified to take a
binding string on the command line, removing duplicate code, and
testing the combinations in the scripts instead.
(I have done a bit of work on the list shares code in libnet_share.c
to make it pass 'make test')
In the future, I would like to extend the libcli/findds.c code (based
off volker's winbind/wb_async_helpers.c, which is why it shows up a bit
odd in the patch) to handle getting multiple name replies, sending a
getdc request to each in turn.
(posted to samba-technical for review, and I'll happily update with
any comments)
Andrew Bartlett
(This used to be commit 7ccddfd3515fc2c0d6f447c768ccbf7a220c3380)
|