sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

CVE-2020-25717: s3:auth: don't let create_local_token depend on !winbind_ping()

Browse Source 
We always require a running winbindd on a domain member, so
we should better fail a request instead of silently alter
the behaviour, which results in a different unix token, just
because winbindd might be restarted.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Stefan Metzmacher 2021-10-04 18:03:55 +02:00 committed by Jule Anger
parent 52190982de
commit 57abb7f8f8
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
source3/auth/auth_util.c
View File

@ -570,13 +570,11 @@ NTSTATUS create_local_token(TALLOC_CTX *mem_ctx,
}
/*
* If winbind is not around, we can not make much use of the SIDs the
* domain controller provided us with. Likewise if the user name was
* mapped to some local unix user.
* If the user name was mapped to some local unix user,
* we can not make much use of the SIDs the
* domain controller provided us with.
*/
if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
(server_info->nss_token)) {
if (server_info->nss_token) {
char *found_username = NULL;
status = create_token_from_username(session_info,
server_info->unix_name,