From 87fddf6a988dfcdb3f1d3a715df585b6c6efa9d7 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 10 Dec 2003 16:40:17 +0000 Subject: more group lookup access fixes on the neverending bug 281 (This used to be commit 9359a6ea80d1228e87ea825a100a2d289c37162d) --- source3/groupdb/mapping.c | 28 +++++++++++++++++++++++----- source3/passdb/passdb.c | 22 ++++++++++++++++------ source3/rpc_server/srv_samr_nt.c | 7 ++++++- source3/rpc_server/srv_util.c | 14 ++++---------- 4 files changed, 49 insertions(+), 22 deletions(-) (limited to 'source3') diff --git a/source3/groupdb/mapping.c b/source3/groupdb/mapping.c index b1c260581e..08ac6a25a5 100644 --- a/source3/groupdb/mapping.c +++ b/source3/groupdb/mapping.c @@ -504,7 +504,8 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map) { struct group *grp; - + BOOL ret; + if(!init_group_mapping()) { DEBUG(0,("failed to initialize group mapping")); return(False); @@ -513,7 +514,12 @@ BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map) DEBUG(10, ("get_domain_group_from_sid\n")); /* if the group is NOT in the database, it CAN NOT be a domain group */ - if(!pdb_getgrsid(map, sid)) + + become_root(); + ret = pdb_getgrsid(map, sid); + unbecome_root(); + + if ( !ret ) return False; DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n")); @@ -547,14 +553,19 @@ BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map) BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map) { + BOOL ret; + if(!init_group_mapping()) { DEBUG(0,("failed to initialize group mapping")); return(False); } /* The group is in the mapping table */ + become_root(); + ret = pdb_getgrsid(map, sid); + unbecome_root(); - if( !pdb_getgrsid(map, sid) ) + if ( !ret ) return False; if ( (map->sid_name_use != SID_NAME_ALIAS) @@ -564,7 +575,7 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map) return False; } -#if 0 /* JERRY */ +#if 1 /* JERRY */ /* local groups only exist in the group mapping DB so this is not necessary */ @@ -572,6 +583,7 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map) /* the group isn't in the mapping table. * make one based on the unix information */ uint32 alias_rid; + struct group *grp; sid_peek_rid(&sid, &alias_rid); map->gid=pdb_group_rid_to_gid(alias_rid); @@ -599,13 +611,19 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map) BOOL get_builtin_group_from_sid(DOM_SID sid, GROUP_MAP *map) { struct group *grp; + BOOL ret; + if(!init_group_mapping()) { DEBUG(0,("failed to initialize group mapping")); return(False); } - if(!pdb_getgrsid(map, sid)) + become_root(); + ret = pdb_getgrsid(map, sid); + unbecome_root(); + + if ( !ret ) return False; if (map->sid_name_use!=SID_NAME_WKN_GRP) { diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index 6246cdaee1..cfa39685e3 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -707,6 +707,7 @@ BOOL local_lookup_sid(DOM_SID *sid, char *name, enum SID_NAME_USE *psid_name_use uint32 rid; SAM_ACCOUNT *sam_account = NULL; GROUP_MAP map; + BOOL ret; if (!sid_peek_check_rid(get_global_sam_sid(), sid, &rid)){ DEBUG(0,("local_lookup_sid: sid_peek_check_rid return False! SID: %s\n", @@ -736,9 +737,10 @@ BOOL local_lookup_sid(DOM_SID *sid, char *name, enum SID_NAME_USE *psid_name_use /* see if the passdb can help us with the name of the user */ + /* BEING ROOT BLLOCK */ become_root(); if (pdb_getsampwsid(sam_account, sid)) { - unbecome_root(); + unbecome_root(); /* -----> EXIT BECOME_ROOT() */ fstrcpy(name, pdb_get_username(sam_account)); *psid_name_use = SID_NAME_USER; @@ -746,10 +748,13 @@ BOOL local_lookup_sid(DOM_SID *sid, char *name, enum SID_NAME_USE *psid_name_use return True; } - unbecome_root(); pdb_free_sam(&sam_account); - - if (pdb_getgrsid(&map, *sid)) { + + ret = pdb_getgrsid(&map, *sid); + unbecome_root(); + /* END BECOME_ROOT BLOCK */ + + if ( ret ) { if (map.gid!=(gid_t)-1) { DEBUG(5,("local_lookup_sid: mapped group %s to gid %u\n", map.nt_name, (unsigned int)map.gid)); } else { @@ -1233,6 +1238,7 @@ BOOL local_sid_to_gid(gid_t *pgid, const DOM_SID *psid, enum SID_NAME_USE *name_ { uint32 rid; GROUP_MAP group; + BOOL ret; *name_type = SID_NAME_UNKNOWN; @@ -1241,8 +1247,12 @@ BOOL local_sid_to_gid(gid_t *pgid, const DOM_SID *psid, enum SID_NAME_USE *name_ /* we don't need to disable winbindd since the gid is stored in the GROUP_MAP object */ - - if ( !pdb_getgrsid(&group, *psid) ) { + + become_root(); + pdb_getgrsid(&group, *psid); + unbecome_root(); + + if ( !ret ) { /* fallback to rid mapping if enabled */ diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c index 7f57a9fc9d..c84e288a4b 100644 --- a/source3/rpc_server/srv_samr_nt.c +++ b/source3/rpc_server/srv_samr_nt.c @@ -1246,6 +1246,7 @@ NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAM DOM_SID sid; GROUP_MAP map; uint32 acc_granted; + BOOL ret; r_u->status = NT_STATUS_OK; @@ -1262,7 +1263,11 @@ NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAM !sid_check_is_in_builtin(&sid)) return NT_STATUS_OBJECT_TYPE_MISMATCH; - if (!pdb_getgrsid(&map, sid)) + become_root(); + ret = pdb_getgrsid(&map, sid); + unbecome_root(); + + if ( !ret ) return NT_STATUS_NO_SUCH_ALIAS; switch (q_u->switch_level) { diff --git a/source3/rpc_server/srv_util.c b/source3/rpc_server/srv_util.c index c2395e6fae..504e6a83c0 100644 --- a/source3/rpc_server/srv_util.c +++ b/source3/rpc_server/srv_util.c @@ -147,8 +147,6 @@ NTSTATUS get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, ui return NT_STATUS_UNSUCCESSFUL; } - become_root(); - for (i=0;i