From 714cdd47cb3e0e1f683c0a22396f9167a85e7df3 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Sat, 26 Jan 2002 06:24:53 +0000 Subject: Fix up a security issue with the way we handle domain groups retuned on the info3. These are RIDs, and it only makes sense to combine them with the domain SID returned with them. This is important for trusted domains, where that sid might be other than the one we currently reterive from the secrets.tdb. Also remove the become_root()/unbecome_root() wrapper from around both remaining TDB users: Both are now initialised at smbd startup. Andrew Bartlett (This used to be commit 554842e0a55155193f25aefca6480b89d5c512ca) --- source3/libsmb/netlogon_unigrp.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) (limited to 'source3/libsmb/netlogon_unigrp.c') diff --git a/source3/libsmb/netlogon_unigrp.c b/source3/libsmb/netlogon_unigrp.c index 317a5bc3d0..d4063242f6 100644 --- a/source3/libsmb/netlogon_unigrp.c +++ b/source3/libsmb/netlogon_unigrp.c @@ -37,18 +37,24 @@ static TDB_CONTEXT *netlogon_unigrp_tdb = NULL; array of uint32 where array[0] is number of elements and elements are array[1] ... array[array[0]] */ + +BOOL uni_group_cache_init(void) +{ + if (!netlogon_unigrp_tdb) { + netlogon_unigrp_tdb = tdb_open_log(lock_path("netlogon_unigrp.tdb"), 0, + TDB_NOLOCK, O_RDWR | O_CREAT, 0644); + } + + return (netlogon_unigrp_tdb != NULL); +} + void uni_group_cache_store_netlogon(TALLOC_CTX *mem_ctx, NET_USER_INFO_3 *user) { TDB_DATA key,data; fstring keystr; int i; - - if (!netlogon_unigrp_tdb) { - netlogon_unigrp_tdb = tdb_open_log(lock_path("netlogon_unigrp.tdb"), 0, - TDB_NOLOCK, O_RDWR | O_CREAT, 0644); - } - if (!netlogon_unigrp_tdb) { + if (!uni_group_cache_init()) { DEBUG(0,("uni_group_cache_store_netlogon: cannot open netlogon_unigrp.tdb for write!\n")); return; } @@ -145,8 +151,8 @@ uint32* uni_group_cache_fetch(DOM_SID *domain, uint32 user_rid, /* Shutdown netlogon_unigrp database */ void uni_group_cache_shutdown(void) { - if(netlogon_unigrp_tdb) { - tdb_close(netlogon_unigrp_tdb); - } + if(netlogon_unigrp_tdb) { + tdb_close(netlogon_unigrp_tdb); + } } -- cgit