From 2e894625e7c951b5ee66670124b4bef82a8129d9 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 7 Apr 2006 13:15:46 +0000 Subject: r14964: - move sidmap code from ntvfs_common to SAMDB - make ntvfs_common a library - create sys_notify library metze (This used to be commit a3e1d56cf7b688c515f5d6d4d43e0b24c2261d15) --- source4/dsdb/common/sidmap.c | 566 ++++++++++++++++++++++++++ source4/dsdb/config.mk | 1 + source4/ntvfs/common/config.mk | 16 +- source4/ntvfs/common/init.c | 33 ++ source4/ntvfs/common/notify.c | 2 +- source4/ntvfs/common/sidmap.c | 566 -------------------------- source4/ntvfs/config.mk | 5 +- source4/ntvfs/posix/config.mk | 2 +- source4/ntvfs/posix/vfs_posix.c | 10 +- source4/ntvfs/posix/vfs_posix.h | 1 + source4/ntvfs/sysdep/config.m4 | 4 +- source4/ntvfs/sysdep/config.mk | 28 +- source4/ntvfs/sysdep/inotify.c | 2 +- source4/ntvfs/sysdep/sys_notify.c | 27 +- source4/ntvfs/sysdep/sys_notify.h | 9 +- source4/ntvfs/unixuid/config.mk | 1 + source4/ntvfs/unixuid/vfs_unixuid.c | 2 +- source4/rpc_server/lsa/dcesrv_lsa.c | 2 - source4/rpc_server/unixinfo/dcesrv_unixinfo.c | 3 +- 19 files changed, 673 insertions(+), 607 deletions(-) create mode 100644 source4/dsdb/common/sidmap.c create mode 100644 source4/ntvfs/common/init.c delete mode 100644 source4/ntvfs/common/sidmap.c (limited to 'source4') diff --git a/source4/dsdb/common/sidmap.c b/source4/dsdb/common/sidmap.c new file mode 100644 index 0000000000..ee314cddec --- /dev/null +++ b/source4/dsdb/common/sidmap.c @@ -0,0 +1,566 @@ +/* + Unix SMB/CIFS implementation. + + mapping routines for SID <-> unix uid/gid + + Copyright (C) Andrew Tridgell 2004 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "system/passwd.h" +#include "ads.h" +#include "dsdb/samdb/samdb.h" +#include "auth/auth.h" +#include "libcli/ldap/ldap.h" +#include "db_wrap.h" +#include "libcli/security/security.h" +#include "librpc/gen_ndr/ndr_security.h" + +/* + these are used for the fallback local uid/gid to sid mapping + code. +*/ +#define SIDMAP_LOCAL_USER_BASE 0x80000000 +#define SIDMAP_LOCAL_GROUP_BASE 0xC0000000 +#define SIDMAP_MAX_LOCAL_UID 0x3fffffff +#define SIDMAP_MAX_LOCAL_GID 0x3fffffff + +/* + private context for sid mapping routines +*/ +struct sidmap_context { + struct ldb_wrap *samctx; +}; + +/* + open a sidmap context - use talloc_free to close +*/ +_PUBLIC_ struct sidmap_context *sidmap_open(TALLOC_CTX *mem_ctx) +{ + struct sidmap_context *sidmap; + sidmap = talloc(mem_ctx, struct sidmap_context); + if (sidmap == NULL) { + return NULL; + } + sidmap->samctx = samdb_connect(sidmap, system_session(sidmap)); + if (sidmap->samctx == NULL) { + talloc_free(sidmap); + return NULL; + } + + return sidmap; +} + + +/* + check the sAMAccountType field of a search result to see if + the account is a user account +*/ +static BOOL is_user_account(struct ldb_message *res) +{ + uint_t atype = samdb_result_uint(res, "sAMAccountType", 0); + if (atype && (!(atype & ATYPE_ACCOUNT))) { + return False; + } + return True; +} + +/* + check the sAMAccountType field of a search result to see if + the account is a group account +*/ +static BOOL is_group_account(struct ldb_message *res) +{ + uint_t atype = samdb_result_uint(res, "sAMAccountType", 0); + if (atype && atype == ATYPE_NORMAL_ACCOUNT) { + return False; + } + return True; +} + + + +/* + return the dom_sid of our primary domain +*/ +static NTSTATUS sidmap_primary_domain_sid(struct sidmap_context *sidmap, + TALLOC_CTX *mem_ctx, struct dom_sid **sid) +{ + const char *attrs[] = { "objectSid", NULL }; + int ret; + struct ldb_message **res = NULL; + + ret = gendb_search_dn(sidmap->samctx, mem_ctx, samdb_base_dn(mem_ctx), + &res, attrs); + if (ret != 1) { + talloc_free(res); + return NT_STATUS_NO_SUCH_DOMAIN; + } + + *sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid"); + talloc_free(res); + if (*sid == NULL) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + + +/* + map a sid to a unix uid +*/ +_PUBLIC_ NTSTATUS sidmap_sid_to_unixuid(struct sidmap_context *sidmap, + struct dom_sid *sid, uid_t *uid) +{ + const char *attrs[] = { "sAMAccountName", "unixID", + "unixName", "sAMAccountType", NULL }; + int ret; + const char *s; + TALLOC_CTX *tmp_ctx; + struct ldb_message **res; + struct dom_sid *domain_sid; + NTSTATUS status; + + tmp_ctx = talloc_new(sidmap); + + ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, + "objectSid=%s", ldap_encode_ndr_dom_sid(tmp_ctx, sid)); + if (ret != 1) { + goto allocated_sid; + } + + /* make sure its a user, not a group */ + if (!is_user_account(res[0])) { + DEBUG(0,("sid_to_unixuid: sid %s is not an account!\n", + dom_sid_string(tmp_ctx, sid))); + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_SID; + } + + /* first try to get the uid directly */ + s = samdb_result_string(res[0], "unixID", NULL); + if (s != NULL) { + *uid = strtoul(s, NULL, 0); + talloc_free(tmp_ctx); + return NT_STATUS_OK; + } + + /* next try via the UnixName attribute */ + s = samdb_result_string(res[0], "unixName", NULL); + if (s != NULL) { + struct passwd *pwd = getpwnam(s); + if (!pwd) { + DEBUG(0,("unixName %s for sid %s does not exist as a local user\n", s, + dom_sid_string(tmp_ctx, sid))); + talloc_free(tmp_ctx); + return NT_STATUS_NO_SUCH_USER; + } + *uid = pwd->pw_uid; + talloc_free(tmp_ctx); + return NT_STATUS_OK; + } + + /* finally try via the sAMAccountName attribute */ + s = samdb_result_string(res[0], "sAMAccountName", NULL); + if (s != NULL) { + struct passwd *pwd = getpwnam(s); + if (!pwd) { + DEBUG(0,("sAMAccountName '%s' for sid %s does not exist as a local user\n", + s, dom_sid_string(tmp_ctx, sid))); + talloc_free(tmp_ctx); + return NT_STATUS_NO_SUCH_USER; + } + *uid = pwd->pw_uid; + talloc_free(tmp_ctx); + return NT_STATUS_OK; + } + + +allocated_sid: + status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(tmp_ctx); + return NT_STATUS_NO_SUCH_DOMAIN; + } + + if (dom_sid_in_domain(domain_sid, sid)) { + uint32_t rid = sid->sub_auths[sid->num_auths-1]; + if (rid >= SIDMAP_LOCAL_USER_BASE && + rid < SIDMAP_LOCAL_GROUP_BASE) { + *uid = rid - SIDMAP_LOCAL_USER_BASE; + talloc_free(tmp_ctx); + return NT_STATUS_OK; + } + } + + + DEBUG(0,("sid_to_unixuid: no unixID, unixName or sAMAccountName for sid %s\n", + dom_sid_string(tmp_ctx, sid))); + + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_SID; +} + + +/* + map a sid to a unix gid +*/ +_PUBLIC_ NTSTATUS sidmap_sid_to_unixgid(struct sidmap_context *sidmap, + struct dom_sid *sid, gid_t *gid) +{ + const char *attrs[] = { "sAMAccountName", "unixID", + "unixName", "sAMAccountType", NULL }; + int ret; + const char *s; + TALLOC_CTX *tmp_ctx; + struct ldb_message **res; + NTSTATUS status; + struct dom_sid *domain_sid; + + tmp_ctx = talloc_new(sidmap); + + ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, + "objectSid=%s", ldap_encode_ndr_dom_sid(tmp_ctx, sid)); + if (ret != 1) { + goto allocated_sid; + } + + /* make sure its not a user */ + if (!is_group_account(res[0])) { + DEBUG(0,("sid_to_unixgid: sid %s is a ATYPE_NORMAL_ACCOUNT\n", + dom_sid_string(tmp_ctx, sid))); + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_SID; + } + + /* first try to get the gid directly */ + s = samdb_result_string(res[0], "unixID", NULL); + if (s != NULL) { + *gid = strtoul(s, NULL, 0); + talloc_free(tmp_ctx); + return NT_STATUS_OK; + } + + /* next try via the UnixName attribute */ + s = samdb_result_string(res[0], "unixName", NULL); + if (s != NULL) { + struct group *grp = getgrnam(s); + if (!grp) { + DEBUG(0,("unixName '%s' for sid %s does not exist as a local group\n", + s, dom_sid_string(tmp_ctx, sid))); + talloc_free(tmp_ctx); + return NT_STATUS_NO_SUCH_USER; + } + *gid = grp->gr_gid; + talloc_free(tmp_ctx); + return NT_STATUS_OK; + } + + /* finally try via the sAMAccountName attribute */ + s = samdb_result_string(res[0], "sAMAccountName", NULL); + if (s != NULL) { + struct group *grp = getgrnam(s); + if (!grp) { + DEBUG(0,("sAMAccountName '%s' for sid %s does not exist as a local group\n", s, dom_sid_string(tmp_ctx, sid))); + talloc_free(tmp_ctx); + return NT_STATUS_NO_SUCH_USER; + } + *gid = grp->gr_gid; + talloc_free(tmp_ctx); + return NT_STATUS_OK; + } + +allocated_sid: + status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(tmp_ctx); + return NT_STATUS_NO_SUCH_DOMAIN; + } + + if (dom_sid_in_domain(domain_sid, sid)) { + uint32_t rid = sid->sub_auths[sid->num_auths-1]; + if (rid >= SIDMAP_LOCAL_GROUP_BASE) { + *gid = rid - SIDMAP_LOCAL_GROUP_BASE; + talloc_free(tmp_ctx); + return NT_STATUS_OK; + } + } + + DEBUG(0,("sid_to_unixgid: no unixID, unixName or sAMAccountName for sid %s\n", + dom_sid_string(tmp_ctx, sid))); + + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_SID; +} + + +/* + map a unix uid to a dom_sid + the returned sid is allocated in the supplied mem_ctx +*/ +_PUBLIC_ NTSTATUS sidmap_uid_to_sid(struct sidmap_context *sidmap, + TALLOC_CTX *mem_ctx, + uid_t uid, struct dom_sid **sid) +{ + const char *attrs[] = { "sAMAccountName", "objectSid", "sAMAccountType", NULL }; + int ret, i; + TALLOC_CTX *tmp_ctx; + struct ldb_message **res; + struct passwd *pwd; + struct dom_sid *domain_sid; + NTSTATUS status; + + /* + we search for the mapping in the following order: + + - check if the uid is in the dynamic uid range assigned for winbindd + use. If it is, then look in winbindd sid mapping + database (not implemented yet) + - look for a user account in samdb that has unixID set to the + given uid + - look for a user account in samdb that has unixName or + sAMAccountName set to the name given by getpwuid() + - assign a SID by adding the uid to SIDMAP_LOCAL_USER_BASE in the local + domain + */ + + + tmp_ctx = talloc_new(mem_ctx); + + + /* + step 2: look for a user account in samdb that has unixID set to the + given uid + */ + + ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, + "unixID=%u", (unsigned int)uid); + for (i=0;isamctx, tmp_ctx, NULL, &res, attrs, + "(|(unixName=%s)(sAMAccountName=%s))", + pwd->pw_name, pwd->pw_name); + for (i=0;i SIDMAP_MAX_LOCAL_UID) { + return NT_STATUS_INVALID_SID; + } + + status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(tmp_ctx); + return status; + } + + *sid = dom_sid_add_rid(mem_ctx, domain_sid, SIDMAP_LOCAL_USER_BASE + uid); + talloc_free(tmp_ctx); + + if (*sid == NULL) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + + +/* + map a unix gid to a dom_sid + the returned sid is allocated in the supplied mem_ctx +*/ +_PUBLIC_ NTSTATUS sidmap_gid_to_sid(struct sidmap_context *sidmap, + TALLOC_CTX *mem_ctx, + gid_t gid, struct dom_sid **sid) +{ + const char *attrs[] = { "sAMAccountName", "objectSid", "sAMAccountType", NULL }; + int ret, i; + TALLOC_CTX *tmp_ctx; + struct ldb_message **res; + struct group *grp; + struct dom_sid *domain_sid; + NTSTATUS status; + + /* + we search for the mapping in the following order: + + - check if the gid is in the dynamic gid range assigned for winbindd + use. If it is, then look in winbindd sid mapping + database (not implemented yet) + - look for a group account in samdb that has unixID set to the + given gid + - look for a group account in samdb that has unixName or + sAMAccountName set to the name given by getgrgid() + - assign a SID by adding the gid to SIDMAP_LOCAL_GROUP_BASE in the local + domain + */ + + + tmp_ctx = talloc_new(sidmap); + + + /* + step 2: look for a group account in samdb that has unixID set to the + given gid + */ + + ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, + "unixID=%u", (unsigned int)gid); + for (i=0;isamctx, tmp_ctx, NULL, &res, attrs, + "(|(unixName=%s)(sAMAccountName=%s))", + grp->gr_name, grp->gr_name); + for (i=0;i SIDMAP_MAX_LOCAL_GID) { + return NT_STATUS_INVALID_SID; + } + + status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(tmp_ctx); + return status; + } + + *sid = dom_sid_add_rid(mem_ctx, domain_sid, SIDMAP_LOCAL_GROUP_BASE + gid); + talloc_free(tmp_ctx); + + if (*sid == NULL) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + +/* + check if a sid is in the range of auto-allocated SIDs from our primary domain, + and if it is, then return the name and atype +*/ +_PUBLIC_ NTSTATUS sidmap_allocated_sid_lookup(struct sidmap_context *sidmap, + TALLOC_CTX *mem_ctx, + const struct dom_sid *sid, + const char **name, + uint32_t *atype) +{ + NTSTATUS status; + struct dom_sid *domain_sid; + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); + uint32_t rid; + + status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid); + if (!NT_STATUS_IS_OK(status)) { + return NT_STATUS_NO_SUCH_DOMAIN; + } + + if (!dom_sid_in_domain(domain_sid, sid)) { + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_SID; + } + + talloc_free(tmp_ctx); + + rid = sid->sub_auths[sid->num_auths-1]; + if (rid < SIDMAP_LOCAL_USER_BASE) { + return NT_STATUS_INVALID_SID; + } + + if (rid < SIDMAP_LOCAL_GROUP_BASE) { + struct passwd *pwd; + uid_t uid = rid - SIDMAP_LOCAL_USER_BASE; + *atype = ATYPE_NORMAL_ACCOUNT; + pwd = getpwuid(uid); + if (pwd == NULL) { + *name = talloc_asprintf(mem_ctx, "uid%u", uid); + } else { + *name = talloc_strdup(mem_ctx, pwd->pw_name); + } + } else { + struct group *grp; + gid_t gid = rid - SIDMAP_LOCAL_GROUP_BASE; + *atype = ATYPE_LOCAL_GROUP; + grp = getgrgid(gid); + if (grp == NULL) { + *name = talloc_asprintf(mem_ctx, "gid%u", gid); + } else { + *name = talloc_strdup(mem_ctx, grp->gr_name); + } + } + + if (*name == NULL) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} diff --git a/source4/dsdb/config.mk b/source4/dsdb/config.mk index b0ab2cda62..7537e53300 100644 --- a/source4/dsdb/config.mk +++ b/source4/dsdb/config.mk @@ -12,6 +12,7 @@ OBJ_FILES = \ samdb/samdb.o \ samdb/samdb_privilege.o \ samdb/cracknames.o \ + common/sidmap.o \ common/flag_mapping.o # # End SUBSYSTEM SAMDB diff --git a/source4/ntvfs/common/config.mk b/source4/ntvfs/common/config.mk index 6eb9073b73..96ddfb348b 100644 --- a/source4/ntvfs/common/config.mk +++ b/source4/ntvfs/common/config.mk @@ -1,13 +1,15 @@ ################################################ -# Start MODULE ntvfs_common -[MODULE::ntvfs_common] -SUBSYSTEM = ntvfs +# Start LIBRARY ntvfs_common +[LIBRARY::ntvfs_common] PRIVATE_PROTO_HEADER = proto.h +VERSION = 0.0.1 +SO_VERSION = 0 +DESCRIPTION = Generic Code for use in NTVFS modules OBJ_FILES = \ + init.o \ brlock.o \ opendb.o \ - notify.o \ - sidmap.o -REQUIRED_SUBSYSTEMS = -# End MODULE ntvfs_common + notify.o +REQUIRED_SUBSYSTEMS = NDR_OPENDB NDR_NOTIFY sys_notify +# End LIBRARY ntvfs_common ################################################ diff --git a/source4/ntvfs/common/init.c b/source4/ntvfs/common/init.c new file mode 100644 index 0000000000..6cdc70dc50 --- /dev/null +++ b/source4/ntvfs/common/init.c @@ -0,0 +1,33 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2006 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +/* + this is the change notify database. It implements mechanisms for + storing current change notify waiters in a tdb, and checking if a + given event matches any of the stored notify waiiters. +*/ + +#include "includes.h" +#include "ntvfs/sysdep/sys_notify.h" + +_PUBLIC_ NTSTATUS ntvfs_common_init(void) +{ + return sys_notify_init(); +} diff --git a/source4/ntvfs/common/notify.c b/source4/ntvfs/common/notify.c index a701880701..2d880dd5c4 100644 --- a/source4/ntvfs/common/notify.c +++ b/source4/ntvfs/common/notify.c @@ -115,7 +115,7 @@ struct notify_context *notify_init(TALLOC_CTX *mem_ctx, uint32_t server, messaging_register(notify->messaging_ctx, notify, MSG_PVFS_NOTIFY, notify_handler); - notify->sys_notify_ctx = sys_notify_init(snum, notify, ev); + notify->sys_notify_ctx = sys_notify_context_create(snum, notify, ev); return notify; } diff --git a/source4/ntvfs/common/sidmap.c b/source4/ntvfs/common/sidmap.c deleted file mode 100644 index 6f3cd42b62..0000000000 --- a/source4/ntvfs/common/sidmap.c +++ /dev/null @@ -1,566 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - mapping routines for SID <-> unix uid/gid - - Copyright (C) Andrew Tridgell 2004 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" -#include "system/passwd.h" -#include "ads.h" -#include "dsdb/samdb/samdb.h" -#include "auth/auth.h" -#include "libcli/ldap/ldap.h" -#include "db_wrap.h" -#include "libcli/security/security.h" -#include "librpc/gen_ndr/ndr_security.h" - -/* - these are used for the fallback local uid/gid to sid mapping - code. -*/ -#define SIDMAP_LOCAL_USER_BASE 0x80000000 -#define SIDMAP_LOCAL_GROUP_BASE 0xC0000000 -#define SIDMAP_MAX_LOCAL_UID 0x3fffffff -#define SIDMAP_MAX_LOCAL_GID 0x3fffffff - -/* - private context for sid mapping routines -*/ -struct sidmap_context { - struct ldb_wrap *samctx; -}; - -/* - open a sidmap context - use talloc_free to close -*/ -struct sidmap_context *sidmap_open(TALLOC_CTX *mem_ctx) -{ - struct sidmap_context *sidmap; - sidmap = talloc(mem_ctx, struct sidmap_context); - if (sidmap == NULL) { - return NULL; - } - sidmap->samctx = samdb_connect(sidmap, system_session(sidmap)); - if (sidmap->samctx == NULL) { - talloc_free(sidmap); - return NULL; - } - - return sidmap; -} - - -/* - check the sAMAccountType field of a search result to see if - the account is a user account -*/ -static BOOL is_user_account(struct ldb_message *res) -{ - uint_t atype = samdb_result_uint(res, "sAMAccountType", 0); - if (atype && (!(atype & ATYPE_ACCOUNT))) { - return False; - } - return True; -} - -/* - check the sAMAccountType field of a search result to see if - the account is a group account -*/ -static BOOL is_group_account(struct ldb_message *res) -{ - uint_t atype = samdb_result_uint(res, "sAMAccountType", 0); - if (atype && atype == ATYPE_NORMAL_ACCOUNT) { - return False; - } - return True; -} - - - -/* - return the dom_sid of our primary domain -*/ -static NTSTATUS sidmap_primary_domain_sid(struct sidmap_context *sidmap, - TALLOC_CTX *mem_ctx, struct dom_sid **sid) -{ - const char *attrs[] = { "objectSid", NULL }; - int ret; - struct ldb_message **res = NULL; - - ret = gendb_search_dn(sidmap->samctx, mem_ctx, samdb_base_dn(mem_ctx), - &res, attrs); - if (ret != 1) { - talloc_free(res); - return NT_STATUS_NO_SUCH_DOMAIN; - } - - *sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid"); - talloc_free(res); - if (*sid == NULL) { - return NT_STATUS_NO_MEMORY; - } - - return NT_STATUS_OK; -} - - -/* - map a sid to a unix uid -*/ -NTSTATUS sidmap_sid_to_unixuid(struct sidmap_context *sidmap, - struct dom_sid *sid, uid_t *uid) -{ - const char *attrs[] = { "sAMAccountName", "unixID", - "unixName", "sAMAccountType", NULL }; - int ret; - const char *s; - TALLOC_CTX *tmp_ctx; - struct ldb_message **res; - struct dom_sid *domain_sid; - NTSTATUS status; - - tmp_ctx = talloc_new(sidmap); - - ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, - "objectSid=%s", ldap_encode_ndr_dom_sid(tmp_ctx, sid)); - if (ret != 1) { - goto allocated_sid; - } - - /* make sure its a user, not a group */ - if (!is_user_account(res[0])) { - DEBUG(0,("sid_to_unixuid: sid %s is not an account!\n", - dom_sid_string(tmp_ctx, sid))); - talloc_free(tmp_ctx); - return NT_STATUS_INVALID_SID; - } - - /* first try to get the uid directly */ - s = samdb_result_string(res[0], "unixID", NULL); - if (s != NULL) { - *uid = strtoul(s, NULL, 0); - talloc_free(tmp_ctx); - return NT_STATUS_OK; - } - - /* next try via the UnixName attribute */ - s = samdb_result_string(res[0], "unixName", NULL); - if (s != NULL) { - struct passwd *pwd = getpwnam(s); - if (!pwd) { - DEBUG(0,("unixName %s for sid %s does not exist as a local user\n", s, - dom_sid_string(tmp_ctx, sid))); - talloc_free(tmp_ctx); - return NT_STATUS_NO_SUCH_USER; - } - *uid = pwd->pw_uid; - talloc_free(tmp_ctx); - return NT_STATUS_OK; - } - - /* finally try via the sAMAccountName attribute */ - s = samdb_result_string(res[0], "sAMAccountName", NULL); - if (s != NULL) { - struct passwd *pwd = getpwnam(s); - if (!pwd) { - DEBUG(0,("sAMAccountName '%s' for sid %s does not exist as a local user\n", - s, dom_sid_string(tmp_ctx, sid))); - talloc_free(tmp_ctx); - return NT_STATUS_NO_SUCH_USER; - } - *uid = pwd->pw_uid; - talloc_free(tmp_ctx); - return NT_STATUS_OK; - } - - -allocated_sid: - status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid); - if (!NT_STATUS_IS_OK(status)) { - talloc_free(tmp_ctx); - return NT_STATUS_NO_SUCH_DOMAIN; - } - - if (dom_sid_in_domain(domain_sid, sid)) { - uint32_t rid = sid->sub_auths[sid->num_auths-1]; - if (rid >= SIDMAP_LOCAL_USER_BASE && - rid < SIDMAP_LOCAL_GROUP_BASE) { - *uid = rid - SIDMAP_LOCAL_USER_BASE; - talloc_free(tmp_ctx); - return NT_STATUS_OK; - } - } - - - DEBUG(0,("sid_to_unixuid: no unixID, unixName or sAMAccountName for sid %s\n", - dom_sid_string(tmp_ctx, sid))); - - talloc_free(tmp_ctx); - return NT_STATUS_INVALID_SID; -} - - -/* - map a sid to a unix gid -*/ -NTSTATUS sidmap_sid_to_unixgid(struct sidmap_context *sidmap, - struct dom_sid *sid, gid_t *gid) -{ - const char *attrs[] = { "sAMAccountName", "unixID", - "unixName", "sAMAccountType", NULL }; - int ret; - const char *s; - TALLOC_CTX *tmp_ctx; - struct ldb_message **res; - NTSTATUS status; - struct dom_sid *domain_sid; - - tmp_ctx = talloc_new(sidmap); - - ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, - "objectSid=%s", ldap_encode_ndr_dom_sid(tmp_ctx, sid)); - if (ret != 1) { - goto allocated_sid; - } - - /* make sure its not a user */ - if (!is_group_account(res[0])) { - DEBUG(0,("sid_to_unixgid: sid %s is a ATYPE_NORMAL_ACCOUNT\n", - dom_sid_string(tmp_ctx, sid))); - talloc_free(tmp_ctx); - return NT_STATUS_INVALID_SID; - } - - /* first try to get the gid directly */ - s = samdb_result_string(res[0], "unixID", NULL); - if (s != NULL) { - *gid = strtoul(s, NULL, 0); - talloc_free(tmp_ctx); - return NT_STATUS_OK; - } - - /* next try via the UnixName attribute */ - s = samdb_result_string(res[0], "unixName", NULL); - if (s != NULL) { - struct group *grp = getgrnam(s); - if (!grp) { - DEBUG(0,("unixName '%s' for sid %s does not exist as a local group\n", - s, dom_sid_string(tmp_ctx, sid))); - talloc_free(tmp_ctx); - return NT_STATUS_NO_SUCH_USER; - } - *gid = grp->gr_gid; - talloc_free(tmp_ctx); - return NT_STATUS_OK; - } - - /* finally try via the sAMAccountName attribute */ - s = samdb_result_string(res[0], "sAMAccountName", NULL); - if (s != NULL) { - struct group *grp = getgrnam(s); - if (!grp) { - DEBUG(0,("sAMAccountName '%s' for sid %s does not exist as a local group\n", s, dom_sid_string(tmp_ctx, sid))); - talloc_free(tmp_ctx); - return NT_STATUS_NO_SUCH_USER; - } - *gid = grp->gr_gid; - talloc_free(tmp_ctx); - return NT_STATUS_OK; - } - -allocated_sid: - status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid); - if (!NT_STATUS_IS_OK(status)) { - talloc_free(tmp_ctx); - return NT_STATUS_NO_SUCH_DOMAIN; - } - - if (dom_sid_in_domain(domain_sid, sid)) { - uint32_t rid = sid->sub_auths[sid->num_auths-1]; - if (rid >= SIDMAP_LOCAL_GROUP_BASE) { - *gid = rid - SIDMAP_LOCAL_GROUP_BASE; - talloc_free(tmp_ctx); - return NT_STATUS_OK; - } - } - - DEBUG(0,("sid_to_unixgid: no unixID, unixName or sAMAccountName for sid %s\n", - dom_sid_string(tmp_ctx, sid))); - - talloc_free(tmp_ctx); - return NT_STATUS_INVALID_SID; -} - - -/* - map a unix uid to a dom_sid - the returned sid is allocated in the supplied mem_ctx -*/ -NTSTATUS sidmap_uid_to_sid(struct sidmap_context *sidmap, - TALLOC_CTX *mem_ctx, - uid_t uid, struct dom_sid **sid) -{ - const char *attrs[] = { "sAMAccountName", "objectSid", "sAMAccountType", NULL }; - int ret, i; - TALLOC_CTX *tmp_ctx; - struct ldb_message **res; - struct passwd *pwd; - struct dom_sid *domain_sid; - NTSTATUS status; - - /* - we search for the mapping in the following order: - - - check if the uid is in the dynamic uid range assigned for winbindd - use. If it is, then look in winbindd sid mapping - database (not implemented yet) - - look for a user account in samdb that has unixID set to the - given uid - - look for a user account in samdb that has unixName or - sAMAccountName set to the name given by getpwuid() - - assign a SID by adding the uid to SIDMAP_LOCAL_USER_BASE in the local - domain - */ - - - tmp_ctx = talloc_new(mem_ctx); - - - /* - step 2: look for a user account in samdb that has unixID set to the - given uid - */ - - ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, - "unixID=%u", (unsigned int)uid); - for (i=0;isamctx, tmp_ctx, NULL, &res, attrs, - "(|(unixName=%s)(sAMAccountName=%s))", - pwd->pw_name, pwd->pw_name); - for (i=0;i SIDMAP_MAX_LOCAL_UID) { - return NT_STATUS_INVALID_SID; - } - - status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid); - if (!NT_STATUS_IS_OK(status)) { - talloc_free(tmp_ctx); - return status; - } - - *sid = dom_sid_add_rid(mem_ctx, domain_sid, SIDMAP_LOCAL_USER_BASE + uid); - talloc_free(tmp_ctx); - - if (*sid == NULL) { - return NT_STATUS_NO_MEMORY; - } - - return NT_STATUS_OK; -} - - -/* - map a unix gid to a dom_sid - the returned sid is allocated in the supplied mem_ctx -*/ -NTSTATUS sidmap_gid_to_sid(struct sidmap_context *sidmap, - TALLOC_CTX *mem_ctx, - gid_t gid, struct dom_sid **sid) -{ - const char *attrs[] = { "sAMAccountName", "objectSid", "sAMAccountType", NULL }; - int ret, i; - TALLOC_CTX *tmp_ctx; - struct ldb_message **res; - struct group *grp; - struct dom_sid *domain_sid; - NTSTATUS status; - - /* - we search for the mapping in the following order: - - - check if the gid is in the dynamic gid range assigned for winbindd - use. If it is, then look in winbindd sid mapping - database (not implemented yet) - - look for a group account in samdb that has unixID set to the - given gid - - look for a group account in samdb that has unixName or - sAMAccountName set to the name given by getgrgid() - - assign a SID by adding the gid to SIDMAP_LOCAL_GROUP_BASE in the local - domain - */ - - - tmp_ctx = talloc_new(sidmap); - - - /* - step 2: look for a group account in samdb that has unixID set to the - given gid - */ - - ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, - "unixID=%u", (unsigned int)gid); - for (i=0;isamctx, tmp_ctx, NULL, &res, attrs, - "(|(unixName=%s)(sAMAccountName=%s))", - grp->gr_name, grp->gr_name); - for (i=0;i SIDMAP_MAX_LOCAL_GID) { - return NT_STATUS_INVALID_SID; - } - - status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid); - if (!NT_STATUS_IS_OK(status)) { - talloc_free(tmp_ctx); - return status; - } - - *sid = dom_sid_add_rid(mem_ctx, domain_sid, SIDMAP_LOCAL_GROUP_BASE + gid); - talloc_free(tmp_ctx); - - if (*sid == NULL) { - return NT_STATUS_NO_MEMORY; - } - - return NT_STATUS_OK; -} - -/* - check if a sid is in the range of auto-allocated SIDs from our primary domain, - and if it is, then return the name and atype -*/ -NTSTATUS sidmap_allocated_sid_lookup(struct sidmap_context *sidmap, - TALLOC_CTX *mem_ctx, - const struct dom_sid *sid, - const char **name, - uint32_t *atype) -{ - NTSTATUS status; - struct dom_sid *domain_sid; - TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); - uint32_t rid; - - status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid); - if (!NT_STATUS_IS_OK(status)) { - return NT_STATUS_NO_SUCH_DOMAIN; - } - - if (!dom_sid_in_domain(domain_sid, sid)) { - talloc_free(tmp_ctx); - return NT_STATUS_INVALID_SID; - } - - talloc_free(tmp_ctx); - - rid = sid->sub_auths[sid->num_auths-1]; - if (rid < SIDMAP_LOCAL_USER_BASE) { - return NT_STATUS_INVALID_SID; - } - - if (rid < SIDMAP_LOCAL_GROUP_BASE) { - struct passwd *pwd; - uid_t uid = rid - SIDMAP_LOCAL_USER_BASE; - *atype = ATYPE_NORMAL_ACCOUNT; - pwd = getpwuid(uid); - if (pwd == NULL) { - *name = talloc_asprintf(mem_ctx, "uid%u", uid); - } else { - *name = talloc_strdup(mem_ctx, pwd->pw_name); - } - } else { - struct group *grp; - gid_t gid = rid - SIDMAP_LOCAL_GROUP_BASE; - *atype = ATYPE_LOCAL_GROUP; - grp = getgrgid(gid); - if (grp == NULL) { - *name = talloc_asprintf(mem_ctx, "gid%u", gid); - } else { - *name = talloc_strdup(mem_ctx, grp->gr_name); - } - } - - if (*name == NULL) { - return NT_STATUS_NO_MEMORY; - } - - return NT_STATUS_OK; -} diff --git a/source4/ntvfs/config.mk b/source4/ntvfs/config.mk index 2a35bd5cb3..d11e2c848d 100644 --- a/source4/ntvfs/config.mk +++ b/source4/ntvfs/config.mk @@ -48,12 +48,11 @@ OBJ_FILES = \ ipc/vfs_ipc.o \ ipc/ipc_rap.o \ ipc/rap_server.o -REQUIRED_SUBSYSTEMS = DCERPC_COMMON dcerpc_server +REQUIRED_SUBSYSTEMS = dcerpc_server # End MODULE ntvfs_ipc ################################################ - ################################################ # Start MODULE ntvfs_nbench [MODULE::ntvfs_nbench] @@ -78,7 +77,7 @@ OBJ_FILES = \ ntvfs_generic.o \ ntvfs_interface.o \ ntvfs_util.o -REQUIRED_SUBSYSTEMS = NDR_OPENDB NDR_NOTIFY +REQUIRED_SUBSYSTEMS = # # End SUBSYSTEM NTVFS ################################################ diff --git a/source4/ntvfs/posix/config.mk b/source4/ntvfs/posix/config.mk index c49fbc88b7..b9724cb9f2 100644 --- a/source4/ntvfs/posix/config.mk +++ b/source4/ntvfs/posix/config.mk @@ -32,6 +32,6 @@ OBJ_FILES = \ pvfs_notify.o \ xattr_system.o \ xattr_tdb.o -REQUIRED_SUBSYSTEMS = NDR_XATTR EXT_LIB_XATTR EXT_LIB_BLKID +REQUIRED_SUBSYSTEMS = NDR_XATTR EXT_LIB_XATTR EXT_LIB_BLKID ntvfs_common # End MODULE ntvfs_posix ################################################ diff --git a/source4/ntvfs/posix/vfs_posix.c b/source4/ntvfs/posix/vfs_posix.c index dd8c3fe81f..c4d4d11c04 100644 --- a/source4/ntvfs/posix/vfs_posix.c +++ b/source4/ntvfs/posix/vfs_posix.c @@ -332,11 +332,19 @@ NTSTATUS ntvfs_posix_init(void) ops.name = "default"; ret = ntvfs_register(&ops); + if (!NT_STATUS_IS_OK(ret)) { + DEBUG(0,("Failed to register POSIX backend as '%s'!\n", ops.name)); + } + ops.name = "posix"; ret = ntvfs_register(&ops); if (!NT_STATUS_IS_OK(ret)) { - DEBUG(0,("Failed to register POSIX backend!\n")); + DEBUG(0,("Failed to register POSIX backend as '%s'!\n", ops.name)); + } + + if (NT_STATUS_IS_OK(ret)) { + ret = ntvfs_common_init(); } return ret; diff --git a/source4/ntvfs/posix/vfs_posix.h b/source4/ntvfs/posix/vfs_posix.h index f34529bc0f..335cfdf4e0 100644 --- a/source4/ntvfs/posix/vfs_posix.h +++ b/source4/ntvfs/posix/vfs_posix.h @@ -27,6 +27,7 @@ #include "system/filesys.h" #include "ntvfs/ntvfs.h" #include "ntvfs/common/proto.h" +#include "dsdb/samdb/samdb.h" /* this is the private structure for the posix vfs backend. It is used to hold per-connection (per tree connect) state information */ diff --git a/source4/ntvfs/sysdep/config.m4 b/source4/ntvfs/sysdep/config.m4 index f67a3bdace..372e6b5bd5 100644 --- a/source4/ntvfs/sysdep/config.m4 +++ b/source4/ntvfs/sysdep/config.m4 @@ -1,7 +1,7 @@ AC_CHECK_HEADERS(linux/inotify.h asm/unistd.h) AC_CHECK_FUNC(inotify_init) -SMB_ENABLE(ntvfs_inotify, NO) +SMB_ENABLE(sys_notify_inotify, NO) if test x"$ac_cv_header_linux_inotify_h" = x"yes"; then - SMB_ENABLE(ntvfs_inotify, YES) + SMB_ENABLE(sys_notify_inotify, YES) fi diff --git a/source4/ntvfs/sysdep/config.mk b/source4/ntvfs/sysdep/config.mk index 3bcebb5c0e..3b3681adef 100644 --- a/source4/ntvfs/sysdep/config.mk +++ b/source4/ntvfs/sysdep/config.mk @@ -1,20 +1,22 @@ ################################################ -# Start MODULE ntvfs_sys_notify -[MODULE::ntvfs_sys_notify] -SUBSYSTEM = ntvfs +# Start MODULE sys_notify_inotify +[MODULE::sys_notify_inotify] +SUBSYSTEM = sys_notify +INIT_FUNCTION = sys_notify_inotify_init OBJ_FILES = \ - sys_notify.o -# End MODULE ntvfs_sys_notify + inotify.o +# End MODULE sys_notify_inotify ################################################ - ################################################ -# Start MODULE ntvfs_inotify -[MODULE::ntvfs_inotify] -SUBSYSTEM = ntvfs -INIT_FUNCTION = ntvfs_inotify_init +# Start SUBSYSTEM sys_notify +[LIBRARY::sys_notify] +PUBLIC_HEADERS = sys_notify.h +VERSION = 0.0.1 +SO_VERSION = 0 +DESCRIPTION = File System Notify Abstraction Layer OBJ_FILES = \ - inotify.o -# End MODULE ntvfs_inotify + sys_notify.o +REQUIRED_SUBSYSTEMS = +# End SUBSYSTEM sys_notify ################################################ - diff --git a/source4/ntvfs/sysdep/inotify.c b/source4/ntvfs/sysdep/inotify.c index f86e3c1913..33c4ff4928 100644 --- a/source4/ntvfs/sysdep/inotify.c +++ b/source4/ntvfs/sysdep/inotify.c @@ -405,7 +405,7 @@ static struct sys_notify_backend inotify = { /* initialialise the inotify module */ -NTSTATUS ntvfs_inotify_init(void) +NTSTATUS sys_notify_inotify_init(void) { /* register ourselves as a system inotify module */ return sys_notify_register(&inotify); diff --git a/source4/ntvfs/sysdep/sys_notify.c b/source4/ntvfs/sysdep/sys_notify.c index 13c8f4359a..a74312f32b 100644 --- a/source4/ntvfs/sysdep/sys_notify.c +++ b/source4/ntvfs/sysdep/sys_notify.c @@ -28,6 +28,7 @@ #include "ntvfs/sysdep/sys_notify.h" #include "lib/events/events.h" #include "dlinklist.h" +#include "build.h" /* list of registered backends */ static struct sys_notify_backend *backends; @@ -36,9 +37,9 @@ static uint32_t num_backends; /* initialise a system change notify backend */ -struct sys_notify_context *sys_notify_init(int snum, - TALLOC_CTX *mem_ctx, - struct event_context *ev) +struct sys_notify_context *sys_notify_context_create(int snum, + TALLOC_CTX *mem_ctx, + struct event_context *ev) { struct sys_notify_context *ctx; const char *bname; @@ -115,3 +116,23 @@ NTSTATUS sys_notify_register(struct sys_notify_backend *backend) num_backends++; return NT_STATUS_OK; } + +NTSTATUS sys_notify_init(void) +{ + static BOOL initialized = False; + + init_module_fn static_init[] = STATIC_sys_notify_MODULES; + init_module_fn *shared_init; + + if (initialized) return NT_STATUS_OK; + initialized = True; + + shared_init = load_samba_modules(NULL, "sys_notify"); + + run_init_functions(static_init); + run_init_functions(shared_init); + + talloc_free(shared_init); + + return NT_STATUS_OK; +} diff --git a/source4/ntvfs/sysdep/sys_notify.h b/source4/ntvfs/sysdep/sys_notify.h index 9cb01a1db4..6f8e91efec 100644 --- a/source4/ntvfs/sysdep/sys_notify.h +++ b/source4/ntvfs/sysdep/sys_notify.h @@ -26,7 +26,7 @@ typedef void (*sys_notify_callback_t)(struct sys_notify_context *, void *, struct notify_event *ev); typedef NTSTATUS (*notify_watch_t)(struct sys_notify_context *ctx, - struct notify_event *e, + struct notify_entry *e, sys_notify_callback_t callback, void *private, void **handle); @@ -43,9 +43,10 @@ struct sys_notify_backend { }; NTSTATUS sys_notify_register(struct sys_notify_backend *backend); -struct sys_notify_context *sys_notify_init(int snum, - TALLOC_CTX *mem_ctx, - struct event_context *ev); +struct sys_notify_context *sys_notify_context_create(int snum, + TALLOC_CTX *mem_ctx, + struct event_context *ev); NTSTATUS sys_notify_watch(struct sys_notify_context *ctx, struct notify_entry *e, sys_notify_callback_t callback, void *private, void **handle); +NTSTATUS sys_notify_init(void); diff --git a/source4/ntvfs/unixuid/config.mk b/source4/ntvfs/unixuid/config.mk index 3fdeb79e3d..f8af68eb9b 100644 --- a/source4/ntvfs/unixuid/config.mk +++ b/source4/ntvfs/unixuid/config.mk @@ -5,5 +5,6 @@ INIT_FUNCTION = ntvfs_unixuid_init SUBSYSTEM = ntvfs OBJ_FILES = \ vfs_unixuid.o +REQUIRED_SUBSYSTEMS = SAMDB # End MODULE ntvfs_unixuid ################################################ diff --git a/source4/ntvfs/unixuid/vfs_unixuid.c b/source4/ntvfs/unixuid/vfs_unixuid.c index 1bfaf85e70..061b8fbe55 100644 --- a/source4/ntvfs/unixuid/vfs_unixuid.c +++ b/source4/ntvfs/unixuid/vfs_unixuid.c @@ -26,7 +26,7 @@ #include "system/passwd.h" #include "auth/auth.h" #include "ntvfs/ntvfs.h" -#include "ntvfs/common/proto.h" +#include "dsdb/samdb/samdb.h" struct unixuid_private { struct sidmap_context *sidmap; diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c index 1c2d48330f..9d3b55c9e6 100644 --- a/source4/rpc_server/lsa/dcesrv_lsa.c +++ b/source4/rpc_server/lsa/dcesrv_lsa.c @@ -30,10 +30,8 @@ #include "libcli/security/security.h" #include "libcli/auth/libcli_auth.h" #include "librpc/gen_ndr/ndr_security.h" -#include "ntvfs/ntvfs.h" #include "passdb/secrets.h" #include "db_wrap.h" -#include "ntvfs/common/proto.h" /* this type allows us to distinguish handle types diff --git a/source4/rpc_server/unixinfo/dcesrv_unixinfo.c b/source4/rpc_server/unixinfo/dcesrv_unixinfo.c index 57562e940f..d186d7e346 100644 --- a/source4/rpc_server/unixinfo/dcesrv_unixinfo.c +++ b/source4/rpc_server/unixinfo/dcesrv_unixinfo.c @@ -25,8 +25,7 @@ #include "rpc_server/common/common.h" #include "librpc/gen_ndr/ndr_unixinfo.h" #include "lib/events/events.h" -#include "ntvfs/ntvfs.h" -#include "ntvfs/common/proto.h" +#include "dsdb/samdb/samdb.h" #include #include -- cgit