1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-28 17:47:29 +03:00

143 Commits

Author SHA1 Message Date
Jeremy Allison
2d35fd7259 Fix bug #8811 - sd_has_inheritable_components segfaults on an SD that se_access_check accepts.
Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Wed Mar 14 05:08:03 CET 2012 on sn-devel-104
2012-03-14 05:08:03 +01:00
Richard Sharpe
44590c1b70 Fix bug #8795 - Samba does not handle the Owner Rights permissions at all
Signed-off-by: Jeremy Allison <jra@samba.org>

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Wed Mar 14 02:26:34 CET 2012 on sn-devel-104
2012-03-14 02:26:34 +01:00
Richard Sharpe
1e8141f40a Fix bug #8797 - Samba does not correctly handle DENY ACEs when privileges apply.
Signed-off-by: Jeremy Allison <jra@samba.org>

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Sat Mar 10 01:33:45 CET 2012 on sn-devel-104
2012-03-10 01:33:44 +01:00
Richard Sharpe
1082532500 Honor SeTakeOwnershiPrivilege when client asks for SEC_STD_WRITE_OWNER but has no permission for that, but token has SeTakeOwnershipPrivilege
Autobuild-User: Richard Sharpe <sharpe@samba.org>
Autobuild-Date: Wed Feb 22 19:19:32 CET 2012 on sn-devel-104
2012-02-22 19:19:32 +01:00
Jeremy Allison
f15cf9176d Second part of fix for bug #8673 - NT ACL issue.
Ensure we process the entire ACE list instead of returning ACCESS_DENIED
and terminating the walk - ensure we only return the exact bits that cause
the access to be denied. Some of the S3 fileserver needs to know if we
are only denied DELETE access before overriding it by looking at the
containing directory ACL.

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Wed Jan 11 19:24:53 CET 2012 on sn-devel-104
2012-01-11 19:24:53 +01:00
Christian Ambach
53ad886f75 security: add local authority well-known SIDs
add the S-1-2 well-known SID family

Autobuild-User: Christian Ambach <ambi@samba.org>
Autobuild-Date: Thu Nov 24 19:01:08 CET 2011 on sn-devel-104
2011-11-24 19:01:08 +01:00
Andrew Bartlett
055f017b36 build: Reduce build systems to just top level waf and autoconf
The s3-waf build system is a key component of the top level build, but
with this commit is is no longer available directly.  This reduces the
number of build system combinations in master as we prepare for the
Samba 4.0 release.

Andrew Bartlett
2011-10-07 17:42:03 +11:00
Volker Lendecke
fe66abd6ff Adapt del_sid_from_array to Samba coding style
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Wed Aug 17 16:46:24 CEST 2011 on sn-devel-104
2011-08-17 16:46:24 +02:00
Volker Lendecke
e5a6d4cdb6 Fix a typo 2011-08-17 14:11:03 +02:00
Volker Lendecke
28b237b2cc Remove unused "sid_equal" 2011-08-17 12:30:08 +02:00
Volker Lendecke
8fd5e0ff2e Replace calls to sid_equal with calls to dom_sid_equal 2011-08-17 12:30:08 +02:00
Jelmer Vernooij
f8ec7f6cb1 pytalloc: Use consistent prefix for functions, add ABI file. 2011-08-10 15:36:21 +02:00
Stefan Metzmacher
82413e829e libcli/security: add some const to marshall_sec_desc[_buf]()
metze
2011-07-23 09:55:54 +02:00
Volker Lendecke
36e674c134 s3: Allow NULL sd_size in make_sec_desc
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Sat Jun 18 22:26:15 CEST 2011 on sn-devel-104
2011-06-18 22:26:15 +02:00
Günther Deschner
a49c1b7019 libcli/security/secdesc.h: fix licence/copyright
Guenther
2011-06-10 15:11:40 +02:00
Volker Lendecke
b9a727c5f1 Tiny simplification to dom_sid_string_buf
Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Tue May 31 23:16:31 CEST 2011 on sn-devel-104
2011-05-31 23:16:31 +02:00
Andrew Bartlett
381423b1bd libcli/security: move secdesc.c to the top level libcli/security
This code does not rely on lp_ or other source3 only functions, so can
be part of the common library.

Andrew Bartlett
2011-05-31 00:32:07 +02:00
Günther Deschner
03b9a9938b libcli/security: fix build warning, cr_descr_log_acl() is not used currently.
Guenther
2011-05-06 10:48:11 +02:00
Volker Lendecke
d4c693df98 Add dom_sid_parse_endp
This returns a pointer to the first non-parsed character, along the lines of
strtoul for example.

Signed-off-by: Jeremy Allison <jra@samba.org>
2011-04-13 14:13:24 -07:00
Andrew Bartlett
663dc94e63 auth: Move auth_session_info into IDL
This changes auth_session_info_transport to just be a wrapper, rather
than a copy that has to be kept in sync.

As auth_session_info was already wrapped in python, this required
changes to the existing pyauth wrapper and it's users.

Andrew Bartlett
2011-04-05 23:46:04 +02:00
Stefan Metzmacher
4928d66fc2 libcli/security: make sure that we don't grant SEC_STD_DELETE to the owner by default
In the file server SEC_STD_DELETE is granted on the file/directory
or by FILE_DELETE_CHILD on the parent directory.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Mon Mar 21 23:25:05 CET 2011 on sn-devel-104
2011-03-21 23:25:05 +01:00
Jelmer Vernooij
fa387825e2 libcli/: Fix prototypes for all functions. 2011-03-19 03:20:05 +01:00
Günther Deschner
e1f84330ba libcli/security: move display_sec headers to own header file and add to
security.h grouping header.

Guenther
2011-03-16 10:11:08 +01:00
Andrew Tridgell
73e7b72936 libcli: openchange doesn't need these headers any more
thanks to Simo for pointing this out

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Wed Mar 16 00:25:10 CET 2011 on sn-devel-104
2011-03-16 00:25:10 +01:00
Andrew Tridgell
b2b41a5087 libcli: protect access_check.h against double inclusion
Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Tue Mar 15 05:07:01 CET 2011 on sn-devel-104
2011-03-15 05:07:01 +01:00
Andrew Tridgell
6c6ab50a40 waf: build substituted public headers in build tree
the bin/default/include/public directory will contain headers that are
ready to install
2011-03-15 12:22:19 +11:00
Volker Lendecke
16b007c223 Quite some callers of sid_split_rid do not care about the rid 2011-03-10 18:48:34 +01:00
Volker Lendecke
70517477f8 Add dom_sid_string_buf
This prints into a fixed buffer with the same overflow semantics as snprintf
has: Return required string length, regardless of whether it fit or not.
2011-03-03 22:08:49 +01:00
Andrew Bartlett
86aa05e860 libcli/security Add unix_token and unix_info to auth_session_info too
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Tue Mar  1 07:13:43 CET 2011 on sn-devel-104
2011-03-01 07:13:43 +01:00
Andrew Bartlett
e3821f2c40 s4-auth Move libcli/security/session.c to the top level
This code is now useful in common, as the elements of the
auth_session_info structure have now been defined in common IDL.

Andrew Bartlett
2011-02-22 16:20:11 +11:00
Matthias Dieter Wallnöfer
d2b336ae31 libcli/security/security_descriptor.c - fix three wrong counter variables
These strictly need to be "uint32_t" since "acl*->num_aces" has been
defined by this type.

This counter patchset has been reviewed by Andrew Bartlett.
2011-02-21 10:46:40 +01:00
Matthias Dieter Wallnöfer
618c11cc15 libcli/security/privileges.c - fix wrong counter type
This strictly needs to be from type "uint32_t" since "privset->count"
is defined with this type.
2011-02-21 10:43:43 +01:00
Matthias Dieter Wallnöfer
e7659fa802 libcli/security/privileges.c - fix the counting of privileges
Since the privileges are always counted with a signed integer, there is no
reason to specify the upper limit with a "uint32_t".
2011-02-21 10:43:43 +01:00
Matthias Dieter Wallnöfer
a2ded04973 libcli/security/sddl.c - fix wrong counter type
This strictly needs to be from type "uint32_t" since "acl->num_aces" is
defined of this type.
2011-02-21 10:43:43 +01:00
Matthias Dieter Wallnöfer
055857a8d4 libcli/security/display_sec.c - fix wrong counter type
This strictly needs to be of type "uint32_t" due to
"sec_acl->num_aces" which is of type "uint32_t".
2011-02-21 10:43:43 +01:00
Matthias Dieter Wallnöfer
6bfaa4c109 libcli/security - fix two output format specifiers 2011-02-15 11:19:37 +01:00
Nadezhda Ivanova
c3f6cc9993 security: Fixed some handling of ACEs with INHERITED flag provided by the user
Some tests showed that these ACEs are not removed if the DACL_PROTECTED flag is provided at the same time.
This is not documented but tests prove it and it has been observerd in deployment.
2011-02-10 12:43:58 +02:00
Jelmer Vernooij
242797aca9 pysecurity: Add missing dependency on pytalloc-util.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Tue Feb  8 13:16:43 CET 2011 on sn-devel-104
2011-02-08 13:16:43 +01:00
Volker Lendecke
1d58fcc925 libcli/security: Make add_sid_to_array_unique use a uin32_t counter
Logical consequence of the previous commit

Signed-off-by: Michael Adam <obnox@samba.org>

Autobuild-User: Michael Adam <obnox@samba.org>
Autobuild-Date: Mon Feb  7 19:24:19 CET 2011 on sn-devel-104
2011-02-07 19:24:19 +01:00
Volker Lendecke
91a56b420a libcli/security: Make del_sid_from_array take a uint32_t
This aligns it with add_sid_to_array

Signed-off-by: Michael Adam <obnox@samba.org>
2011-02-07 18:37:43 +01:00
Nadezhda Ivanova
fed925079b s4-security: Fixed incorrect inheritance of IO flagged ACES
They should be inherited without the IO flag unless they contain generic information.
2011-01-18 15:08:17 +01:00
Andrew Bartlett
012e570416 libcli/security Add python bindings for se_access_check
Andrew Bartlett
2011-01-14 16:39:32 +11:00
Nadezhda Ivanova
961f503f0d security: Fixed incorrect indentation in create_descriptor.c
Autobuild-User: Nadezhda Ivanova <nivanova@samba.org>
Autobuild-Date: Thu Jan 13 15:53:16 CET 2011 on sn-devel-104
2011-01-13 15:53:16 +01:00
Nadezhda Ivanova
980f68a6f2 security: Fixed bugs in expansion of generic information ACEs
When an ACE gontaining GA, GE, GR, GW, CO or CG is provided by a user or inherited
the final SD actually has to have 2 ACEs, one is an effective expanded one, and the
original one with IO flag added.
2011-01-11 12:20:43 +02:00
Günther Deschner
45227e96c2 libcli/security: fix sid_type_lookup().
It *always* returned "SID *TYPE* is INVALID".

Guenther

Autobuild-User: Günther Deschner <gd@samba.org>
Autobuild-Date: Mon Jan 10 12:47:00 CET 2011 on sn-devel-104
2011-01-10 12:47:00 +01:00
Günther Deschner
10eaad2977 libcli/security: remove unused variable.
Guenther

Autobuild-User: Günther Deschner <gd@samba.org>
Autobuild-Date: Fri Dec 17 13:56:27 CET 2010 on sn-devel-104
2010-12-17 13:56:27 +01:00
Andrew Bartlett
4a4d8e4b0f libcli/security Add sid_blob_parse() to directly parse a binary SID blob 2010-12-16 15:54:30 +11:00
Matthias Dieter Wallnöfer
93d85ca5fd s4:fix some shadowed declaration warnings on Solaris by renaming the symbols 2010-12-06 11:28:58 +01:00
Jeremy Allison
75508cea4a Turns out there are lots of places in S3 where token passed in
here can be NULL (become_root() sets the current security token to
NULL for example). Ensure we don't crash.

Jeremy.

Autobuild-User: Jeremy Allison <jra@samba.org>
Autobuild-Date: Thu Dec  2 03:26:03 CET 2010 on sn-devel-104
2010-12-02 03:26:03 +01:00
Matthias Dieter Wallnöfer
3035fe041f libcli/security/object_tree.c - remove unreachable statement 2010-11-29 14:48:12 +01:00