summaryrefslogtreecommitdiff
path: root/source4/ntvfs/unixuid/vfs_unixuid.c
AgeCommit message (Collapse)AuthorFilesLines
2009-07-19Cosmetic correctionMatthias Dieter Wallnöfer1-1/+1
Changes the order of two commands. First set up the "priv" structure, then assign it to the "ntvfs" structure.
2009-05-20Have ntvfs_connect() accept union smb_tcon *tcon instead of char* sharenameSam Liddicott1-2/+2
This change brings ntvfs_connect into compliance with other ntvfs functions which take an ntvfs module, an ntvfs request and an smb io union. It now becomes the responsibility of ntvfs modules to examine tcon->generic.level themselves and derive the share name and any other options directly; e.g. const char *sharename; switch (tcon->generic.level) { case RAW_TCON_TCON: sharename = tcon->tcon.in.service; break; case RAW_TCON_TCONX: sharename = tcon->tconx.in.path; break; case RAW_TCON_SMB2: default: return NT_STATUS_INVALID_LEVEL; } if (strncmp(sharename, "\\\\", 2) == 0) { char *p = strchr(sharename+2, '\\'); if (p) { sharename = p + 1; } } service.c smbsrv_tcon_backend() is called before ntvfs_connect and fills in some of the tcon->..out values. For the case of RAW_TCON_TCONX, it filles out tcon->tconx.out.tid and tcon->tconx.out.options For the case of RAW_TCON_TCON it fills out tcon->tcon.out.tid and tcon->tcon.out.max_xmit Thus the ntvfs_connect function for vfs modules may override these values if desired, but are not required to. ntvfs_connect functions are required to fill in the tcon->tconx.out.*_type fields, for RAW_TCON_TCONX, perhaps something like: if (tcon->generic.level == RAW_TCON_TCONX) { tcon->tconx.out.fs_type = ntvfs->ctx->fs_type; tcon->tconx.out.dev_type = ntvfs->ctx->dev_type; } Signed-off-by: Sam Liddicott <sam@liddicott.com> (I fixed the ntvfs_connect() in the smb_server/smb2/ and the RAW_TCON_SMB2 switch case in the modules) Signed-off-by: Stefan Metzmacher <metze@samba.org>
2009-03-19use the tevent nesting code to avoid the uid problem in the VFSAndrew Tridgell1-0/+66
backend The vfs_unixuid module changes the uid of the process when executing operations on behalf of the user. Within the VFS backend we may rely on semi-async calls, such as winbind calls, which will call the event loop again. To cope with this we need to ensure that while inside those calls we revert the uid to root, then revert back to the connected user when we have finished with the semi-async calls.
2009-02-02s4:ntvfs/unixuid: s/private/privStefan Metzmacher1-23/+23
metze
2008-10-24Remove unused include param/param.h.Jelmer Vernooij1-1/+0
2008-04-02ntvfs: Use wbclient in vsf_unixuid, not sidmapKai Blin1-22/+50
(This used to be commit 2908a77fa5c32e92665775a5785345f704202f0a)
2007-12-21r26353: Remove use of global_loadparm.Jelmer Vernooij1-1/+1
(This used to be commit 17637e4490e42db6cdef619286c4d5a0982e9d1a)
2007-12-21r26228: Store loadparm context in auth context, move more loadparm_contexts ↵Jelmer Vernooij1-1/+2
up the call stack. (This used to be commit ba75f1613a9aac69dd5df94dd8a2b37820acd166)
2007-10-10r25554: Convert last instances of BOOL, True and False to the standard types.Jelmer Vernooij1-2/+2
(This used to be commit 566aa14139510788548a874e9213d91317f83ca9)
2007-10-10r23792: convert Samba4 to GPLv3Andrew Tridgell1-3/+2
There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-10-10r23067: use 'const union smb_search_data *file' also in the server code to ↵Stefan Metzmacher1-2/+2
get rid of compiler warnings in the cifs backend metze (This used to be commit 34ef07b1f5acdad27edd80de8de4c6de7f879f9b)
2007-10-10r21214: fixed a valgrind error that can be caused by a semi-async call insideAndrew Tridgell1-1/+4
a nested ntvfs call. The req structure can go away while processing a ntvfs request (This used to be commit f62b3c505f71f37a86a76d152d643926e19eb148)
2007-10-10r16980: - make struct smb_notify a union and add levels ↵Stefan Metzmacher1-1/+1
RAW_NOTIFY_NTTRANS,RAW_NOTIFY_SMB2 - parse SMB2 Notify reponse metze (This used to be commit de50e0ccddfad16ad7b254770f4c52c1abe707b9)
2007-10-10r15826: ensure we don't dereference sec when NULLAndrew Tridgell1-1/+2
(This used to be commit b6bf6b17cd92a3869c49209bc8ea8ef8c6c25cdd)
2007-10-10r15188: Restore svn rev. 15183, 15184 and 15185, which I inadvertantly clobberedJames Peach1-3/+4
in r15186. I don't think I should be allowed to use quilt and svn at the same time any more :( (This used to be commit e0ca5ead27743c84f5d9310a05d6d718862ead1d)
2007-10-10r15186: Introduce ISDOT and ISDOTDOT macros for testing whether a filename isJames Peach1-4/+3
"." for "..". These express the intention better that strcmp or strequal and improve searchability via cscope/ctags. (This used to be commit 7e4ad7e8e5ec266b969e3075c4ad7f021571f24e)
2007-10-10r15185: Force all NTVFS modules to provide a critical sizes structure soJames Peach1-3/+4
the version information can be checked when modules are registered. (This used to be commit 95eb55806339fc5409c0adf137ebd5bffd7098ac)
2007-10-10r14964: - move sidmap code from ntvfs_common to SAMDBStefan Metzmacher1-1/+1
- make ntvfs_common a library - create sys_notify library metze (This used to be commit a3e1d56cf7b688c515f5d6d4d43e0b24c2261d15)
2007-10-10r14838: fix the build. Looks like I still haven't quite got the hang of theAndrew Tridgell1-0/+1
new dependency/proto system :-) (This used to be commit 63ae3f21e3471895ba83df1c2fdc4147090f7fdb)
2007-10-10r14736: - the ntvfs subsystem should not know about smb_server.hStefan Metzmacher1-1/+0
- the process module subsystem should not know about smb_server.h - the smb_server module should not know about process models metze (This used to be commit bac95bb8f4ad35a31ee666f5916ff9b2f292d964)
2007-10-10r14615: add notify to unixuid ntvfs moduleAndrew Tridgell1-0/+14
(This used to be commit 79af976d189798bb92f5909237202ca18db1789f)
2007-10-10r14487: split smbsrv_request into two parts, one will be moved to ntvfs_requestStefan Metzmacher1-4/+4
but I don't to get the commit to large, to I'll do this tomorrow... metze (This used to be commit 10e627032d7d04f1ebf6efed248c426614f5aa6f)
2007-10-10r14173: change smb interface structures to always useStefan Metzmacher1-4/+8
a union smb_file, to abtract - const char *path fot qpathinfo and setpathinfo - uint16_t fnum for SMB - smb2_handle handle for SMB2 the idea is to later add a struct ntvfs_handle *ntvfs so that the ntvfs subsystem don't need to know the difference between SMB and SMB2 metze (This used to be commit 2ef3f5970901b5accdb50f0d0115b5d46b0c788f)
2007-10-10r14157: - pass a struct ntvfs_request to the ntvfs layerStefan Metzmacher1-37/+36
(for now we just do #define ntvfs_request smbsrv_request, but it's the first step...) - rename ntvfs_openfile() -> ntvfs_open() - fix the talloc hierachie in some places in the ntvfs_map_*() code metze (This used to be commit ed9ed1f48f602354810937c0b0de850b44322191)
2007-10-10r13129: fix the memory hierachieStefan Metzmacher1-1/+2
metze (This used to be commit 19205b8d89d3d7e99a65938f59412e0c4e8ac5fe)
2007-10-10r12608: Remove some unused #include lines.Jelmer Vernooij1-1/+0
(This used to be commit 70e7449318aa0e9d2639c76730a7d1683b2f4981)
2007-10-10r12528: Add seperate proto headers for ntvfs, tdr, smb_server and nbt_server.Jelmer Vernooij1-0/+1
(This used to be commit 87f665a1d5ba74289974bf9d8f9441c162e6f1b1)
2007-10-10r9320: Fix premature dereference bug found by Coverty and also get rid of ↵Alexander Bokovoy1-6/+3
non-used memory context (This used to be commit 127e06492a545940443c93e9aec66eebefa26dc2)
2007-10-10r9240: - move struct security_token to the idl file, with this we canStefan Metzmacher1-1/+1
the ndr_pull/push/print functions for it in the ntacl-lsm module - fix compiler warnings in the ldap_encode_ndr_* code metze (This used to be commit 83d65d0d7ed9c240ad44aa2c881c1f07212bfda4)
2007-10-10r5298: - got rid of pstring.h from includes.h. This at least makes it a bitAndrew Tridgell1-0/+2
less likely that anyone will use pstring for new code - got rid of winbind_client.h from includes.h. This one triggered a huge change, as winbind_client.h was including system/filesys.h and defining the old uint32 and uint16 types, as well as its own pstring and fstring. (This used to be commit 9db6c79e902ec538108d6b7d3324039aabe1704f)
2007-10-10r5037: got rid of all of the TALLOC_DEPRECATED stuff. My apologies for theAndrew Tridgell1-5/+5
large commit. I thought this was worthwhile to get done for consistency. (This used to be commit ec32b22ed5ec224f6324f5e069d15e92e38e15c0)
2007-10-10r4547: - added talloc_new(ctx) macro that is a neater form of the common ↵Andrew Tridgell1-1/+1
talloc(ctx, 0) call. - cleaned up some talloc usage in various files I'd like to get to the point that we have no calls to talloc(), at which point we will rename talloc_p() to talloc(), to encourage everyone to use the typesafe functions. (This used to be commit e6c81d7c9f8a6938947d3c1c8a971a0d6d50b67a)
2007-10-10r4419: move security_token stuff to the libcli/security/Stefan Metzmacher1-0/+1
and debug privileges metze (This used to be commit c981808ed4cfa63c7ba7c4f9190b6b14f74bab40)
2007-10-10r4147: converted from NT_USER_TOKEN to struct security_tokenAndrew Tridgell1-9/+9
this is mostly just a tidyup, but also adds the privilege_mask, which I will be using shortly in ACL checking. note that I had to move the definition of struct security_token out of security.idl as pidl doesn't yet handle arrays of pointers, and the usual workaround (to use a intermediate structure) would make things too cumbersome for this structure, especially given we never encode it to NDR. (This used to be commit 7b446af09b8050746bfc2c50e9d56aa94397cc1a)
2007-10-10r3982: split out the sid -> uid/gid mapping routines into a ntvfs_sidmapAndrew Tridgell1-156/+10
subsystem. This is in preparation for adding better default ACL generation in pvfs, which will require uid/gid -> sid mapping. (This used to be commit b31108e49247495d98cf7c12ee303b12a9e44e92)
2007-10-10r3832: added NT ACL query/set to the posix NTVFS backend. The default ACL isAndrew Tridgell1-0/+4
based on the current nttoken, which is completely wrong, but works as a start. The ACL is stored in the xattr system.DosAcl, using a NDR encoded IDL union with a version number to allow for future expansion. pvfs does not yet check the ACL for file access. At the moment the ACL is just query/set. We also need to do some RPC work to allow the windows ACL editor to be used. At the moment is queries the ACL fine, but displays an error when it fails to map the SIDs via rpc. (This used to be commit 3a1f20d874ab2d8b2a2f2485b7a705847abf1263)
2007-10-10r3737: - Get rid of the register_subsystem() and register_backend() functions.Jelmer Vernooij1-3/+3
- Re-disable tdbtool (it was building fine on my Debian box but other machines were having problems) (This used to be commit 0d7bb2c40b7a9ed59df3f8944133ea562697e814)
2007-10-10r3528: added support for the SMBntcancel() operation, which cancels anyAndrew Tridgell1-0/+14
outstanding async operation (triggering an immediate timeout). pvfs now passes the RAW-MUX test (This used to be commit 3423e2f41461d054067ef168b9b986f62cc8f77c)
2007-10-10r3466: split out request.h, signing.h, and smb_server.hAndrew Tridgell1-0/+1
(This used to be commit 7c4e6ebf05790dd6e29896dd316db0fff613aa4e)
2007-10-10r3461: another place where "open" was used as a structure elementAndrew Tridgell1-4/+4
(This used to be commit 1087ea830e7aead86d54a1836512e88554afc919)
2007-10-10r3453: - split out the auth and popt includesAndrew Tridgell1-0/+1
- tidied up some of the system includes - moved a few more structures back from misc.idl to netlogon.idl and samr.idl now that pidl knows about inter-IDL dependencies (This used to be commit 7b7477ac42d96faac1b0ff361525d2c63cedfc64)
2007-10-10r3290: allow SID_ANONYMOUS ( "S-1-5-7" ) to be the users sidStefan Metzmacher1-1/+1
metze (This used to be commit 177afd4855c66f46c82899b46f030803be63d52a)
2007-10-10r3185: Machines can login with krb5, so we need to allow them to map to a ↵Andrew Bartlett1-2/+2
unix account. Andrew Bartlett (This used to be commit fbe932ddd4282c3d8af8a28fdd0cee83d0c8f4f3)
2007-10-10r3039: This solves the problem of async handlers in ntvfs backends not beingAndrew Tridgell1-0/+15
in the right state when called. For example, when we use the unixuid handler in the chain of handlers, and a backend decides to continue a call asynchronously then we need to ensure that the continuation happens with the right security context. The solution is to add a new ntvfs operation ntvfs_async_setup(), which calls all the way down through the layers, setting up anything that is required, and takes a private pointer. The backend wanting to make a async calls can use ntvfs_async_setup() to ensure that the modules above it are called when doing async processing. (This used to be commit a256e71029727fa1659ade6257085df537308c7d)
2007-10-10r3024: run the *_connect() NTVFS initialisation operation as root, to allowAndrew Tridgell1-1/+4
backends to open databases and perform any other privileged operations that might be needed. (This used to be commit 54fd395025656d9b264ba1c1fab6e3ce8ca3d357)
2007-10-10r2934: - changed the unixuid module to use the nt_user_token instead of the ↵Andrew Tridgell1-14/+19
server supplied info structure. - added SID_WORLD and SID_NETWORK to the foreign sids in the provisioning, as these are auto-added to the nt_user_token (why is that done? Andrew?) (This used to be commit 1dff12fba88827660a2647457867bf4ff6bc8d3d)
2007-10-10r2930: added a security context cache to the unixuid module. The moduleAndrew Tridgell1-4/+22
doesn't actually leave us in the requested sec context between requests yet, but it does prevent us from doing the samdb lookup on every packet. This change speeds up the BASE-MANGLE test against Samba4 with 5000 operations from 61 seconds to 16 seconds. For reference, Samba3 takes 27 seconds for the same test (the string and filename handling in Samba4 is much more efficient than Samba3) (This used to be commit da0481ac75a01270897da5aa24dbb2b431928b30)
2007-10-10r2803: allow unixuid module to work with foreign security principlesAndrew Tridgell1-4/+8
(This used to be commit f522728728fa523ce7d9e73c93b27e71f3757d50)
2007-10-10r2796: - changed ldap attributes "UnixID" to "unixID" and "UnixName" to ↵Andrew Tridgell1-18/+23
"unixName" to be more ldap traditional - register the unixuid module as all 3 ntvfs backend types, as it doesn't care what type of backend it filters (This used to be commit cd43def6ce280442306f14ca61508b4f7eb92cb6)
2007-10-10r2794: a very simple version of the unixuid NTVFS pass-thru module. InAndrew Tridgell1-0/+753
conjunction with the posix backend this gives us a way to correctly setup the unix security context in Samba4. I chose the following method to determine the unix uid's and gid's to use given the list of SIDs from the login process - look for a "UnixID" field in the sam record. If present, then use it (check if the record is of the right type as well) - if UnixID is not present, then look for the "UnixName" sam field. If it is present then use getpwnam() or getgrnam() to find the unix id. - if UnixID and UnixName are not present, then look for a unix account of the right type called by the same name as the sAMAccountName field. - if none of the above work then fail the operation with NT_STATUS_ACCESS_DENIED obviously these steps only work well with a local SAM. It will need to be more sophisticated in future. I did not put any cache in place at all. That will need to be added for decent performance. (This used to be commit 78b67d19b9766131f0270e451089ee5bb1aa8bd9)
generated by cgit (git 2.34.1) at 2024-11-08 14:57:53 +0000