15 Commits

Author	SHA1	Message	Date
Jeremy Allison	27d72ed1cf	Removed the special casing of SIDs in se_access_check. This is now done (correctly) ... when the NT_USER_TOKEN is *created*. Jeremy.	0001-01-01 00:00:00 +00:00
Jeremy Allison	05fcb124df	Owner always has READ_CONTROL and WRITE_DAC access. ... Jeremy.	0001-01-01 00:00:00 +00:00
Jeremy Allison	e466c863f5	Tidied up security rights definitions. ... Jeremy.	0001-01-01 00:00:00 +00:00
Jeremy Allison	1d9a5494f8	Removed requirement that sid have an owner before being interpreted. ... Thanks to Elrond for pointing this out. Jeremy.	0001-01-01 00:00:00 +00:00
Jeremy Allison	7507f6f408	Fixed memory leak with NT tokens. ... Added debug messages to se_access_check(). Added FULL_ACCESS acl to default acl on printers. Jeremy.	0001-01-01 00:00:00 +00:00
Jeremy Allison	b3a1038ac1	Added SID "Everyone" S-1-1-0 as always matching if present in an ACE. ... Jeremy.	0001-01-01 00:00:00 +00:00
Jeremy Allison	5a4a7cd472	Changed the sec desc access checks to match the spec. Needs testing. ... Jeremy.	0001-01-01 00:00:00 +00:00
Jeremy Allison	1f7300df67	Fixed up se_access_check() to use the token list from the user struct ... as the SID list. Now to go through and tidy up the algorithm. Jeremy.	0001-01-01 00:00:00 +00:00
Jeremy Allison	5e5cc6efe2	Started to canonicalize our handling of uid -> sid code in order to ... get ready and fix se_access_check(). Added cannonical lookup_name(), lookup_sid(), uid_to_sid(), gid_to_sid() functions that look via winbind first the fall back on local lookup. All Samba should use these rather than trying to call winbindd code directly. Added NT_USER_TOKEN struct in user_struct, contains list of NT sids associated with this user. se_access_check() should use this (cached) value rather than attempting to do the same thing itself when given a uid/gid pair. More work needs to be done to preserve these things accross security context changes (especially with the tricky pipe problem) but I'm beginning to see how this will be done..... probably by registering a new vuid for an authenticated RPC pipe and not treating the pipe calls specially. More thoughts needed - but we're almost there... Jeremy.	0001-01-01 00:00:00 +00:00
Tim Potter	ff7938310d	Added some debugs. ... Changed interface to se_access_check to take a user struct instead of each bit as a separate parameter.	0001-01-01 00:00:00 +00:00
Tim Potter	898a483cda	Fixes for various compile warnings on Solaris 8.	0001-01-01 00:00:00 +00:00
Tim Potter	f866c18f6b	Moved winbind client functions from various odd locations to ... nsswitch/wb_client.c Merge of nsswitch/common.c rename to nsswitch/wb_common.c from TNG.	0001-01-01 00:00:00 +00:00
Tim Potter	1478198b70	Added some useful debugging stuff. ... Fixes for se_access_check() when you are the owner of the object.	0001-01-01 00:00:00 +00:00
Tim Potter	27d821913c	Rewrite of se_access_check() function. Added comments and fixed a bunch of ... bugs. I think there is a problem though with the permissions granted when SEC_RIGHTS_MAXIMUM_ALLOWED is passed as the permissions requested.	0001-01-01 00:00:00 +00:00
Luke Leighton	6de329f6bf	added se_access_check.	0001-01-01 00:00:00 +00:00