From e0066d2dd4d9a657d1fbcb474e66a304a64e2a31 Mon Sep 17 00:00:00 2001 From: Jean-François Micouleau Date: Thu, 6 Dec 2001 13:09:15 +0000 Subject: again an intrusive patch: - removed the ugly as hell sam_logon_in_ssb variable, I changed a bit the definition of standard_sub_basic() to cope with that. - removed the smb.conf: 'domain admin group' and 'domain guest group' parameters ! We're not playing anymore with the user's group RIDs ! - in get_domain_user_groups(), if the user's gid is a group, put it first in the group RID list. I just have to write an HOWTO now ;-) J.F. (This used to be commit fef52c4b96c987115fb1818c00c2352c67790e50) --- source3/rpc_server/srv_netlog_nt.c | 22 +--- source3/rpc_server/srv_samr_nt.c | 7 +- source3/rpc_server/srv_util.c | 208 +++++++++++-------------------------- 3 files changed, 67 insertions(+), 170 deletions(-) (limited to 'source3/rpc_server') diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c index 5f85d4db9c..d15175d4ae 100644 --- a/source3/rpc_server/srv_netlog_nt.c +++ b/source3/rpc_server/srv_netlog_nt.c @@ -27,8 +27,6 @@ #include "includes.h" -extern BOOL sam_logon_in_ssb; -extern pstring samlogon_user; extern pstring global_myname; extern DOM_SID global_sam_sid; @@ -642,16 +640,10 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON * int num_gids = 0; pstring my_name; pstring my_workgroup; - pstring domain_groups; /* set up pointer indicating user/password failed to be found */ usr_info->ptr_user_info = 0; - /* XXXX hack to get standard_sub_basic() to use sam logon username */ - /* possibly a better way would be to do a change_to_user() call */ - sam_logon_in_ssb = True; - pstrcpy(samlogon_user, nt_username); - pstrcpy(my_workgroup, lp_workgroup()); pstrcpy(my_name, global_myname); strupper(my_name); @@ -664,17 +656,8 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON * * JRA. */ - *domain_groups = 0; - - get_domain_user_groups(domain_groups, nt_username); - - /* - * make_dom_gids allocates the gids array. JRA. - */ - gids = NULL; - num_gids = make_dom_gids(p->mem_ctx, domain_groups, &gids); - - sam_logon_in_ssb = False; + gids = NULL; + get_domain_user_groups(p->mem_ctx, &num_gids, &gids, server_info->sam_account); init_net_user_info3(p->mem_ctx, usr_info, server_info->sam_account, 0, /* logon_count */ @@ -687,6 +670,7 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON * my_workgroup, /* char *logon_dom */ &global_sam_sid, /* DOM_SID *dom_sid */ NULL); /* char *other_sids */ + } free_server_info(&server_info); return status; diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c index 5e19fd1e7c..853a130859 100644 --- a/source3/rpc_server/srv_samr_nt.c +++ b/source3/rpc_server/srv_samr_nt.c @@ -1854,11 +1854,13 @@ NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, S if (ret == False) { samr_clear_sam_passwd(sam_pass); + pdb_free_sam(&sam_pass); return NT_STATUS_NO_SUCH_USER; } - if(!new_get_domain_user_groups(p->mem_ctx, &num_groups, &gids, sam_pass)) { + if(!get_domain_user_groups(p->mem_ctx, &num_groups, &gids, sam_pass)) { samr_clear_sam_passwd(sam_pass); + pdb_free_sam(&sam_pass); return NT_STATUS_NO_SUCH_GROUP; } @@ -1868,6 +1870,7 @@ NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, S DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__)); samr_clear_sam_passwd(sam_pass); + pdb_free_sam(&sam_pass); return r_u->status; } @@ -2745,7 +2748,7 @@ NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u, for (i=0; inum_sids1; i++) { - r_u->status=new_get_alias_user_groups(p->mem_ctx, &info->sid, &tmp_num_groups, &tmp_rids, &(q_u->sid[i].sid)); + r_u->status=get_alias_user_groups(p->mem_ctx, &info->sid, &tmp_num_groups, &tmp_rids, &(q_u->sid[i].sid)); /* * if there is an error, we just continue as diff --git a/source3/rpc_server/srv_util.c b/source3/rpc_server/srv_util.c index 80090cf6e0..5c781c20ae 100644 --- a/source3/rpc_server/srv_util.c +++ b/source3/rpc_server/srv_util.c @@ -76,84 +76,10 @@ rid_name domain_group_rids[] = { 0 , NULL } }; -int make_dom_gids(TALLOC_CTX *ctx, char *gids_str, DOM_GID **ppgids) -{ - char *ptr; - pstring s2; - int count; - DOM_GID *gids; - - *ppgids = NULL; - - DEBUG(4,("make_dom_gids: %s\n", gids_str)); - - if (gids_str == NULL || *gids_str == 0) - return 0; - - for (count = 0, ptr = gids_str; - next_token(&ptr, s2, NULL, sizeof(s2)); - count++) - ; - - gids = (DOM_GID *)talloc(ctx, sizeof(DOM_GID) * count ); - if(!gids) - { - DEBUG(0,("make_dom_gids: talloc fail !\n")); - return 0; - } - - for (count = 0, ptr = gids_str; - next_token(&ptr, s2, NULL, sizeof(s2)) && - count < LSA_MAX_GROUPS; - count++) - { - /* the entries are of the form GID/ATTR, ATTR being optional.*/ - char *attr; - uint32 rid = 0; - int i; - - attr = strchr_m(s2,'/'); - if (attr) - *attr++ = 0; - - if (!attr || !*attr) - attr = "7"; /* default value for attribute is 7 */ - - /* look up the RID string and see if we can turn it into a rid number */ - for (i = 0; builtin_alias_rids[i].name != NULL; i++) - { - if (strequal(builtin_alias_rids[i].name, s2)) - { - rid = builtin_alias_rids[i].rid; - break; - } - } - - if (rid == 0) - rid = atoi(s2); - - if (rid == 0) - { - DEBUG(1,("make_dom_gids: unknown well-known alias RID %s/%s\n", s2, attr)); - count--; - } - else - { - gids[count].g_rid = rid; - gids[count].attr = atoi(attr); - - DEBUG(5,("group id: %d attr: %d\n", gids[count].g_rid, gids[count].attr)); - } - } - - *ppgids = gids; - return count; -} - /******************************************************************* gets a domain user's groups ********************************************************************/ -NTSTATUS new_get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, uint32 **prids, DOM_SID *q_sid) +NTSTATUS get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, uint32 **prids, DOM_SID *q_sid) { SAM_ACCOUNT *sam_pass=NULL; char *sep; @@ -186,7 +112,7 @@ NTSTATUS new_get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups sep = lp_winbind_separator(); - DEBUG(10,("new_get_alias_user_groups: looking if SID %s is a member of groups in the SID domain %s\n", + DEBUG(10,("get_alias_user_groups: looking if SID %s is a member of groups in the SID domain %s\n", sid_to_string(str_qsid, q_sid), sid_to_string(str_domsid, sid))); sid_peek_rid(q_sid, &rid); @@ -195,27 +121,30 @@ NTSTATUS new_get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups become_root(); ret = pdb_getsampwrid(sam_pass, rid); unbecome_root(); - if (ret == False) + if (ret == False) { + pdb_free_sam(&sam_pass); return NT_STATUS_NO_SUCH_USER; + } fstrcpy(user_name, pdb_get_username(sam_pass)); grid=pdb_get_group_rid(sam_pass); gid=pdb_get_gid(sam_pass); grp = glist = getgrent_list(); - if (grp == NULL) + if (grp == NULL) { + pdb_free_sam(&sam_pass); return NT_STATUS_NO_MEMORY; - + } for (; grp != NULL; grp = grp->next) { if(!get_group_from_gid(grp->gr_gid, &map, MAPPING_WITHOUT_PRIV)) { - DEBUG(10,("new_get_alias_user_groups: gid %d. not found\n", (int)grp->gr_gid)); + DEBUG(10,("get_alias_user_groups: gid %d. not found\n", (int)grp->gr_gid)); continue; } /* if it's not an alias, continue */ if (map.sid_name_use!=SID_NAME_ALIAS) { - DEBUG(10,("new_get_alias_user_groups: not returing %s, not an ALIAS group.\n", map.nt_name)); + DEBUG(10,("get_alias_user_groups: not returing %s, not an ALIAS group.\n", map.nt_name)); continue; } @@ -224,24 +153,24 @@ NTSTATUS new_get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups /* if the sid is not in the correct domain, continue */ if (!sid_equal(&tmp_sid, sid)) { - DEBUG(10,("new_get_alias_user_groups: not returing %s, not in the domain SID.\n", map.nt_name)); + DEBUG(10,("get_alias_user_groups: not returing %s, not in the domain SID.\n", map.nt_name)); continue; } /* Don't return winbind groups as they are not local! */ if (strchr_m(map.nt_name, *sep) != NULL) { - DEBUG(10,("new_get_alias_user_groups: not returing %s, not local.\n", map.nt_name)); + DEBUG(10,("get_alias_user_groups: not returing %s, not local.\n", map.nt_name)); continue; } /* Don't return user private groups... */ if (Get_Pwnam(map.nt_name) != 0) { - DEBUG(10,("new_get_alias_user_groups: not returing %s, clashes with user.\n", map.nt_name)); + DEBUG(10,("get_alias_user_groups: not returing %s, clashes with user.\n", map.nt_name)); continue; } /* the group is fine, we can check if there is the user we're looking for */ - DEBUG(10,("new_get_alias_user_groups: checking if the user is a member of %s.\n", map.nt_name)); + DEBUG(10,("get_alias_user_groups: checking if the user is a member of %s.\n", map.nt_name)); for(num=0; grp->gr_mem[num]!=NULL; num++) { if(strcmp(grp->gr_mem[num], user_name)==0) { @@ -249,69 +178,70 @@ NTSTATUS new_get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups new_rids=(uint32 *)Realloc(rids, sizeof(uint32)*(cur_rid+1)); if (new_rids==NULL) { - DEBUG(10,("new_get_alias_user_groups: could not realloc memory\n")); + DEBUG(10,("get_alias_user_groups: could not realloc memory\n")); + pdb_free_sam(&sam_pass); return NT_STATUS_NO_MEMORY; } rids=new_rids; sid_peek_rid(&map.sid, &(rids[cur_rid])); - DEBUG(10,("new_get_alias_user_groups: user found in group %s\n", map.nt_name)); + DEBUG(10,("get_alias_user_groups: user found in group %s\n", map.nt_name)); cur_rid++; break; } } - } - + grent_free(glist); - + /* now check for the user's gid (the primary group rid) */ for (i=0; igr_mem[num], user_name)==0) { /* we found the user, add the group to the list */ sid_peek_rid(&map[i].sid, &(gids[cur_gid].g_rid)); - gids[cur_gid].attr=map[i].sid_name_use; - DEBUG(10,("new_get_domain_user_groups: user found in group %s\n", map[i].nt_name)); + gids[cur_gid].attr=7; + DEBUG(10,("get_domain_user_groups: user found in group %s\n", map[i].nt_name)); cur_gid++; break; } @@ -387,62 +317,42 @@ BOOL new_get_domain_user_groups(TALLOC_CTX *ctx, int *numgroups, DOM_GID **pgids /* the user's gid is already there */ if (i!=cur_gid) { + /* + * the primary group of the user but be the first one in the list + * don't ask ! JFM. + */ + gids[i].g_rid=gids[0].g_rid; + gids[0].g_rid=grid; goto done; } for(i=0; i