summaryrefslogtreecommitdiff
path: root/source4/ntvfs/posix/pvfs_acl.c
AgeCommit message (Collapse)AuthorFilesLines
2011-10-28lib/util Split samba-modules library into public and private partsAndrew Bartlett1-1/+1
This will allow OpenChange to get at the symbols it needs, without exposing any more of this as a public API than we must. Andrew Bartlett
2011-10-28lib/util Rename load_samba_modules -> samba_modules_loadAndrew Bartlett1-1/+1
This is to provide a cleaner namespace in the public samba plugin functions. Andrew Bartlett
2011-10-28lib/util Rename run_init_functions -> samba_init_module_fns_runAndrew Bartlett1-2/+2
This is to provide a cleaner namespace in the public samba plugin functions. Andrew Bartlett
2011-10-28lib/util Rename init_module_fn to samba_init_module_fnAndrew Bartlett1-2/+2
This prepares for making the samba_module.h header public again, for OpenChange. I am keen to avoid too much API namespace pollution if we can.
2011-10-27Include uid_wrapper correctly.Andreas Schneider1-9/+1
2011-10-06lib/util: consolidate module loading into common codeAndrew Bartlett1-0/+1
This creates a samba-modules private libary that handles the details. Andrew Bartlett
2011-09-05s4:ntvfs: s/!= PROTOCOL_SMB2/< PROTOCOL_SMB2_02/Stefan Metzmacher1-4/+4
metze
2011-09-05s4:ntvfs: s/== PROTOCOL_SMB2/>= PROTOCOL_SMB2_02/Stefan Metzmacher1-1/+1
metze
2011-06-06s4-modules Remove lp_ctx from init functions that no longer need itAndrew Bartlett1-2/+2
Now that we don't allow the smb.conf to change the modules dir, many functions that simply load modules or initialise a subsytem that may load modules no longer need an lp_ctx. Andrew Bartlett
2011-03-22s4:ntvfs/posix: name->dos.attrib isn't initialized in pvfs_access_check_create()Stefan Metzmacher1-1/+1
That's why we have the 'container' parameter to indicate the caller wants to create a directory. metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Mar 22 17:39:11 CET 2011 on sn-devel-104
2011-03-21s4:ntvfs/posix: grant SEC_STD_DELETE if the parent grants SEC_DIR_DELETE_CHILDStefan Metzmacher1-10/+58
metze
2010-11-01s4-modules: get rid of the remaining static prototypes for modulesAndrew Tridgell1-2/+2
the waf build now generates the prototype declarations for us
2010-10-14s4-acl Merge sec_access_check() with se_access_check() from source3/Andrew Bartlett1-1/+1
Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-05-24s4:idmap Adjust code to new idmap structure names and layout.Andrew Bartlett1-25/+15
Andrew Bartlett
2010-03-03s4-posix: allow change ownership of files if the user has the right privilegesAndrew Tridgell1-2/+21
When a user has SEC_PRIV_TAKE_OWNERSHIP or SEC_PRIV_RESTORE they have permission to change the ownership of a file. This should fix bug 6987 Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-02-11s4: Switch to S3-style id mapping data types.Kai Blin1-9/+9
2010-02-05s4:UID wrapper - Fix includesMatthias Dieter Wallnöfer1-0/+8
The includes of the UID wrapper headers werent't really efficient according to metze's post on the technical mailing list (http://lists.samba.org/archive/samba-technical/2010-February/069165.html). To achieve this move the "uid_wrapper.h" includes into "lib/util/unix_privs.c", "lib/util/util.c", "ntvfs/posix/pvfs_acl.c" and "ntvfs/unixuid/vfs_unixuid.c".
2009-11-20s4:ntvfs/posix/pvfs_acl - Remove unused variable "token"Matthias Dieter Wallnöfer1-1/+0
2009-10-18s4-pvfs: more fixes for ACLs on file creationAndrew Tridgell1-11/+12
The passed in SD is not used to limit the access mask allowed on file create.
2009-10-18s4-pvfs: change the handling of access checking on createAndrew Tridgell1-46/+103
Previously when a file was created, we produces the resulting access mask based on an ACL check against the parent. This change means we now calculate the inherited ACL much earlier, and produce the resulting access mask from that ACL, or the user supplied ACL.
2009-10-17s4-pvfs: when uwrap is enabled, ignore chown errorsAndrew Tridgell1-0/+3
chown is expected to fail under uwrap
2009-10-17s4-pvfs: don't auto-apply privilege bits in unix acl handling eitherAndrew Tridgell1-7/+11
2009-10-17s4-pvfs: use privileges rather than "uid == 0" in unix access checkAndrew Tridgell1-6/+12
This makes the unix access check much closer to the full ACL check
2009-10-16s4-pvfs: fixed mask handling for SEC_FLAG_MAXIMUM_ALLOWEDAndrew Tridgell1-2/+2
This matches the sec_access_check() code
2009-10-15s4-pvfs: fixed handling of SEC_FLAG_MAXIMUM_ALLOWEDAndrew Tridgell1-1/+1
The CREATEX_ACCESS test shows that this is used as a bit test, not a equality test
2009-08-05fixed a problem with group policy writes causing policy corruptionAndrew Tridgell1-0/+37
This bug was caused by two things: 1) in the unix ACL mapping, we were not taking into account group write permssions for the SEC_STD_DELETE flag 2) when a file is created using OVERWRITE mode, a fchmod() would fail if the user is not the file owner. We resolve that by only doing the fchmod() if the mapped file attribute does not match the desired file attribute
2009-08-05fixed the sense of the pvfs_acl uwrap checkAndrew Tridgell1-1/+1
2009-08-05make the UID_WRAPPER skip checks at runtimeAndrew Tridgell1-7/+7
This fixes two issues pointed out by Andrew. It adds a runtime uwrap_enabled() call that wraps the skips needed for uid emulation. It also makes the skip in the directory_create_or_exist() function only change the uid checking code, not the permissions code
2009-08-05added a uid_wrapper libraryAndrew Tridgell1-0/+8
This library intercepts seteuid and related calls, and simulates them in a manner similar to the nss_wrapper and socket_wrapper libraries. This allows us to enable the vfs_unixuid NTVFS module in the build farm, which means we are more likely to catch errors in the token manipulation. The simulation is not complete, but it is enough for Samba4 for now. The major areas of incompleteness are: - no emulation of setreuid, setresuid or saved uids. These would be needed for use in Samba3 - no emulation of ruid changing. That would also be needed for Samba3 - no attempt to emulate file ownership changing, so code that (for example) tests whether st.st_uid matches geteuid() needs special handling
2009-02-05s4:pvfs: fix some talloc related compiler warningsStefan Metzmacher1-1/+1
metze
2008-09-24empty access mask is only denied on SMB2Andrew Tridgell1-1/+3
2008-09-24zero access mask should give ACCESS_DENIEDAndrew Tridgell1-0/+4
2008-06-28pvfs: create a pvfs_acl subsystemStefan Metzmacher1-0/+22
That means that the pvfs_acl implementations no longer register as ntvfs modules (which was wrong) metze (This used to be commit 89e90556ec57fce24faf0ed3d6fe262edd974b28)
2008-05-29don't mask out SEC_FILE_READ_ATTRIBUTE on SMB2Andrew Tridgell1-1/+3
(This used to be commit 1dfa50a48040bdc1166be2dbe1063fd8a79166f8)
2008-05-29added support for returning the maximal access MXAC tag in SMB2 createAndrew Tridgell1-0/+12
(This used to be commit 4eb49335d5f0319f9aa47ded5215a2977d3336bf)
2008-05-29SEC_FILE_READ_ATTRIBUTE is only automatically granted on SMB, not SMB2Andrew Tridgell1-3/+10
(This used to be commit 7bff0691428ed3f75c1a9cbaae692bc9830640e6)
2008-05-27Vista returns ACCESS_DENIED hereAndrew Tridgell1-1/+1
(This used to be commit f5068c6e50215f6ea7108d58d783394a315ff14f)
2008-04-14fixed a valgrind error in id mappingAndrew Tridgell1-1/+1
the status field is sent on both call and reply, but was only being initialised on reply (This used to be commit 2ebd7b80998775168959d511fbc987f8b5b7bd34)
2008-04-02ntvfs: Use wbclient for pvfs_acl and pvfs_acl_nfs4Kai Blin1-18/+82
(This used to be commit ac5e5fee1db2999053dee82d1fcf97ca8799c9b5)
2008-04-02Install public header files again and include required prototypes.Jelmer Vernooij1-2/+2
(This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2007-10-10r25554: Convert last instances of BOOL, True and False to the standard types.Jelmer Vernooij1-11/+11
(This used to be commit 566aa14139510788548a874e9213d91317f83ca9)
2007-10-10r23792: convert Samba4 to GPLv3Andrew Tridgell1-3/+2
There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-10-10r19199: split out the xattr NTACL code into a separate part of the posixAndrew Tridgell1-40/+68
backend, allowing other ACL backends to be added. The xattr backend is still the default backend (This used to be commit 90f044e63b12d32228310c7529382198bd7e6dfe)
2007-10-10r18581: also check for SEC_STD_DELETE, and split out the check into a separateAndrew Tridgell1-8/+21
static function (This used to be commit 024ca6a91cdf2c0f8999c220b4459a72c45bfd32)
2007-10-10r18580: map the PVFS_FLAG_READONLY bit in the posix backend ontoAndrew Tridgell1-0/+14
NT_STATUS_ACCESS_DENIED in the access mask checks (This used to be commit ceffc34f3e9f47a8a44dad52054688f9855eeb37)
2007-10-10r15774: take care of the SYSTEM_SECURITY flagStefan Metzmacher1-1/+7
metze (This used to be commit 98f58d710a4fe1cd3581b1fb25c4f0c0236b5092)
2007-10-10r15118: - do access checks also when the owner and group are not changedStefan Metzmacher1-19/+28
- only call chown/fchown when we want to change something metze (This used to be commit 46b3096d938331a2339a876649bc6cbfec883cb2)
2007-10-10r15071: fix typoStefan Metzmacher1-1/+1
metze (This used to be commit fde8922947551f5f7d50607c5c83feba062138c8)
2007-10-10r15069: - don't crash on a NULL aclStefan Metzmacher1-1/+9
- add the correct access checks for changing sd->group and sd->dacl metze (This used to be commit 2a61f65cd4084bf690caccf87efaf46551a13aee)
2007-10-10r14860: create libcli/security/security.hStefan Metzmacher1-1/+1
metze (This used to be commit 9ec706238c173992dc938d537bdf1103bf519dbf)
generated by cgit (git 2.34.1) at 2024-06-28 16:28:28 +0000