summaryrefslogtreecommitdiff
path: root/source4/ntvfs/posix/pvfs_acl.c
AgeCommit message (Collapse)AuthorFilesLines
2012-11-13ntvfs: Fill in sd->type based on the new ACL being addedAndrew Bartlett1-0/+21
Previously we would not change the type field, and just relied on what was in the original ACL based on the default SD. This is required to ensure the SEC_DESC_DACL_PROTECTED is set which is in turn required for GPOs to be set correctly to match what windows does. Andrew Bartlett Reviewed by: Jeremy Allison <jra@samba.org>
2011-12-03Revert making public of the samba-module library.Jelmer Vernooij1-6/+6
This library was tiny - containing just two public functions than were themselves trivial. The amount of overhead this causes isn't really worth the benefits of sharing the code with other projects like OpenChange. In addition, this code isn't really generically useful anyway, as it can only load from the module path set for Samba at configure time. Adding a new library was breaking the API/ABI anyway, so OpenChange had to be updated to cope with the new situation one way or another. I've added a simpler (compatible) routine for loading modules to OpenChange, which is less than 100 lines of code. Autobuild-User: Jelmer Vernooij <jelmer@samba.org> Autobuild-Date: Sat Dec 3 08:36:33 CET 2011 on sn-devel-104
2011-12-01s4-ntvfs: added allow_override check based on use of NT ACLAndrew Tridgell1-1/+13
This disables the posix permission override if the calculated permissions did not come from a NT ACL. Autobuild-User: Andrew Tridgell <tridge@samba.org> Autobuild-Date: Thu Dec 1 05:14:49 CET 2011 on sn-devel-104
2011-12-01s4-ntvfs: fixed a unix ACL mapping bugAndrew Tridgell1-21/+25
the ACL mapping code was incorrectly allowing creation of directories in some situations where it should be denied by the unix permissions
2011-10-28lib/util Rename samba_modules_load -> samba_module_init_fns_for_subsystemAndrew Bartlett1-1/+1
This is to provide a cleaner namespace in the public samba plugin functions. Andrew Bartlett
2011-10-28lib/util Rename samba_init_module_fns_run -> samba_module_init_fns_runAndrew Bartlett1-2/+2
This is to provide a cleaner namespace in the public samba plugin functions. Andrew Bartlett
2011-10-28lib/util Rename samba_init_module_fn -> samba_module_init_fnAndrew Bartlett1-2/+2
This is to provide a cleaner namespace in the public samba plugin functions. Andrew Bartlett
2011-10-28lib/util Split samba-modules library into public and private partsAndrew Bartlett1-1/+1
This will allow OpenChange to get at the symbols it needs, without exposing any more of this as a public API than we must. Andrew Bartlett
2011-10-28lib/util Rename load_samba_modules -> samba_modules_loadAndrew Bartlett1-1/+1
This is to provide a cleaner namespace in the public samba plugin functions. Andrew Bartlett
2011-10-28lib/util Rename run_init_functions -> samba_init_module_fns_runAndrew Bartlett1-2/+2
This is to provide a cleaner namespace in the public samba plugin functions. Andrew Bartlett
2011-10-28lib/util Rename init_module_fn to samba_init_module_fnAndrew Bartlett1-2/+2
This prepares for making the samba_module.h header public again, for OpenChange. I am keen to avoid too much API namespace pollution if we can.
2011-10-27Include uid_wrapper correctly.Andreas Schneider1-9/+1
2011-10-06lib/util: consolidate module loading into common codeAndrew Bartlett1-0/+1
This creates a samba-modules private libary that handles the details. Andrew Bartlett
2011-09-05s4:ntvfs: s/!= PROTOCOL_SMB2/< PROTOCOL_SMB2_02/Stefan Metzmacher1-4/+4
metze
2011-09-05s4:ntvfs: s/== PROTOCOL_SMB2/>= PROTOCOL_SMB2_02/Stefan Metzmacher1-1/+1
metze
2011-06-06s4-modules Remove lp_ctx from init functions that no longer need itAndrew Bartlett1-2/+2
Now that we don't allow the smb.conf to change the modules dir, many functions that simply load modules or initialise a subsytem that may load modules no longer need an lp_ctx. Andrew Bartlett
2011-03-22s4:ntvfs/posix: name->dos.attrib isn't initialized in pvfs_access_check_create()Stefan Metzmacher1-1/+1
That's why we have the 'container' parameter to indicate the caller wants to create a directory. metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Mar 22 17:39:11 CET 2011 on sn-devel-104
2011-03-21s4:ntvfs/posix: grant SEC_STD_DELETE if the parent grants SEC_DIR_DELETE_CHILDStefan Metzmacher1-10/+58
metze
2010-11-01s4-modules: get rid of the remaining static prototypes for modulesAndrew Tridgell1-2/+2
the waf build now generates the prototype declarations for us
2010-10-14s4-acl Merge sec_access_check() with se_access_check() from source3/Andrew Bartlett1-1/+1
Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-05-24s4:idmap Adjust code to new idmap structure names and layout.Andrew Bartlett1-25/+15
Andrew Bartlett
2010-03-03s4-posix: allow change ownership of files if the user has the right privilegesAndrew Tridgell1-2/+21
When a user has SEC_PRIV_TAKE_OWNERSHIP or SEC_PRIV_RESTORE they have permission to change the ownership of a file. This should fix bug 6987 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-02-11s4: Switch to S3-style id mapping data types.Kai Blin1-9/+9
2010-02-05s4:UID wrapper - Fix includesMatthias Dieter Wallnöfer1-0/+8
The includes of the UID wrapper headers werent't really efficient according to metze's post on the technical mailing list (http://lists.samba.org/archive/samba-technical/2010-February/069165.html). To achieve this move the "uid_wrapper.h" includes into "lib/util/unix_privs.c", "lib/util/util.c", "ntvfs/posix/pvfs_acl.c" and "ntvfs/unixuid/vfs_unixuid.c".
2009-11-20s4:ntvfs/posix/pvfs_acl - Remove unused variable "token"Matthias Dieter Wallnöfer1-1/+0
2009-10-18s4-pvfs: more fixes for ACLs on file creationAndrew Tridgell1-11/+12
The passed in SD is not used to limit the access mask allowed on file create.
2009-10-18s4-pvfs: change the handling of access checking on createAndrew Tridgell1-46/+103
Previously when a file was created, we produces the resulting access mask based on an ACL check against the parent. This change means we now calculate the inherited ACL much earlier, and produce the resulting access mask from that ACL, or the user supplied ACL.
2009-10-17s4-pvfs: when uwrap is enabled, ignore chown errorsAndrew Tridgell1-0/+3
chown is expected to fail under uwrap
2009-10-17s4-pvfs: don't auto-apply privilege bits in unix acl handling eitherAndrew Tridgell1-7/+11
2009-10-17s4-pvfs: use privileges rather than "uid == 0" in unix access checkAndrew Tridgell1-6/+12
This makes the unix access check much closer to the full ACL check
2009-10-16s4-pvfs: fixed mask handling for SEC_FLAG_MAXIMUM_ALLOWEDAndrew Tridgell1-2/+2
This matches the sec_access_check() code
2009-10-15s4-pvfs: fixed handling of SEC_FLAG_MAXIMUM_ALLOWEDAndrew Tridgell1-1/+1
The CREATEX_ACCESS test shows that this is used as a bit test, not a equality test
2009-08-05fixed a problem with group policy writes causing policy corruptionAndrew Tridgell1-0/+37
This bug was caused by two things: 1) in the unix ACL mapping, we were not taking into account group write permssions for the SEC_STD_DELETE flag 2) when a file is created using OVERWRITE mode, a fchmod() would fail if the user is not the file owner. We resolve that by only doing the fchmod() if the mapped file attribute does not match the desired file attribute
2009-08-05fixed the sense of the pvfs_acl uwrap checkAndrew Tridgell1-1/+1
2009-08-05make the UID_WRAPPER skip checks at runtimeAndrew Tridgell1-7/+7
This fixes two issues pointed out by Andrew. It adds a runtime uwrap_enabled() call that wraps the skips needed for uid emulation. It also makes the skip in the directory_create_or_exist() function only change the uid checking code, not the permissions code
2009-08-05added a uid_wrapper libraryAndrew Tridgell1-0/+8
This library intercepts seteuid and related calls, and simulates them in a manner similar to the nss_wrapper and socket_wrapper libraries. This allows us to enable the vfs_unixuid NTVFS module in the build farm, which means we are more likely to catch errors in the token manipulation. The simulation is not complete, but it is enough for Samba4 for now. The major areas of incompleteness are: - no emulation of setreuid, setresuid or saved uids. These would be needed for use in Samba3 - no emulation of ruid changing. That would also be needed for Samba3 - no attempt to emulate file ownership changing, so code that (for example) tests whether st.st_uid matches geteuid() needs special handling
2009-02-05s4:pvfs: fix some talloc related compiler warningsStefan Metzmacher1-1/+1
metze
2008-09-24empty access mask is only denied on SMB2Andrew Tridgell1-1/+3
2008-09-24zero access mask should give ACCESS_DENIEDAndrew Tridgell1-0/+4
2008-06-28pvfs: create a pvfs_acl subsystemStefan Metzmacher1-0/+22
That means that the pvfs_acl implementations no longer register as ntvfs modules (which was wrong) metze (This used to be commit 89e90556ec57fce24faf0ed3d6fe262edd974b28)
2008-05-29don't mask out SEC_FILE_READ_ATTRIBUTE on SMB2Andrew Tridgell1-1/+3
(This used to be commit 1dfa50a48040bdc1166be2dbe1063fd8a79166f8)
2008-05-29added support for returning the maximal access MXAC tag in SMB2 createAndrew Tridgell1-0/+12
(This used to be commit 4eb49335d5f0319f9aa47ded5215a2977d3336bf)
2008-05-29SEC_FILE_READ_ATTRIBUTE is only automatically granted on SMB, not SMB2Andrew Tridgell1-3/+10
(This used to be commit 7bff0691428ed3f75c1a9cbaae692bc9830640e6)
2008-05-27Vista returns ACCESS_DENIED hereAndrew Tridgell1-1/+1
(This used to be commit f5068c6e50215f6ea7108d58d783394a315ff14f)
2008-04-14fixed a valgrind error in id mappingAndrew Tridgell1-1/+1
the status field is sent on both call and reply, but was only being initialised on reply (This used to be commit 2ebd7b80998775168959d511fbc987f8b5b7bd34)
2008-04-02ntvfs: Use wbclient for pvfs_acl and pvfs_acl_nfs4Kai Blin1-18/+82
(This used to be commit ac5e5fee1db2999053dee82d1fcf97ca8799c9b5)
2008-04-02Install public header files again and include required prototypes.Jelmer Vernooij1-2/+2
(This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2007-10-10r25554: Convert last instances of BOOL, True and False to the standard types.Jelmer Vernooij1-11/+11
(This used to be commit 566aa14139510788548a874e9213d91317f83ca9)
2007-10-10r23792: convert Samba4 to GPLv3Andrew Tridgell1-3/+2
There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-10-10r19199: split out the xattr NTACL code into a separate part of the posixAndrew Tridgell1-40/+68
backend, allowing other ACL backends to be added. The xattr backend is still the default backend (This used to be commit 90f044e63b12d32228310c7529382198bd7e6dfe)
generated by cgit (git 2.34.1) at 2024-11-14 17:14:09 +0000