1
0
mirror of https://github.com/samba-team/samba.git synced 2025-12-17 04:23:50 +03:00
Commit Graph

42 Commits

Author SHA1 Message Date
Jelmer Vernooij
566aa14139 r25554: Convert last instances of BOOL, True and False to the standard types. 2007-10-10 15:07:55 -05:00
Andrew Tridgell
fcf38a38ac r23792: convert Samba4 to GPLv3
There are still a few tidyups of old FSF addresses to come (in both s3
and s4). More commits soon.
2007-10-10 14:59:12 -05:00
Andrew Tridgell
90f044e63b r19199: split out the xattr NTACL code into a separate part of the posix
backend, allowing other ACL backends to be added. The xattr backend is
still the default backend
2007-10-10 14:20:52 -05:00
Andrew Tridgell
024ca6a91c r18581: also check for SEC_STD_DELETE, and split out the check into a separate
static function
2007-10-10 14:18:51 -05:00
Andrew Tridgell
ceffc34f3e r18580: map the PVFS_FLAG_READONLY bit in the posix backend onto
NT_STATUS_ACCESS_DENIED in the access mask checks
2007-10-10 14:18:51 -05:00
Stefan Metzmacher
98f58d710a r15774: take care of the SYSTEM_SECURITY flag
metze
2007-10-10 14:08:17 -05:00
Stefan Metzmacher
46b3096d93 r15118: - do access checks also when the owner and group are not changed
- only call chown/fchown when we want to change something

metze
2007-10-10 14:04:10 -05:00
Stefan Metzmacher
fde8922947 r15071: fix typo
metze
2007-10-10 14:04:06 -05:00
Stefan Metzmacher
2a61f65cd4 r15069: - don't crash on a NULL acl
- add the correct access checks for changing sd->group and sd->dacl

metze
2007-10-10 14:04:06 -05:00
Stefan Metzmacher
9ec706238c r14860: create libcli/security/security.h
metze
2007-10-10 13:59:44 -05:00
Stefan Metzmacher
10e627032d r14487: split smbsrv_request into two parts, one will be moved to ntvfs_request
but I don't to get the commit to large, to I'll do this tomorrow...

metze
2007-10-10 13:57:32 -05:00
Jelmer Vernooij
3dd477ca51 r14464: Don't include ndr_BASENAME.h files unless strictly required, instead
try to include just the BASENAME.h files (containing only structs)
2007-10-10 13:57:27 -05:00
Stefan Metzmacher
2ef3f59709 r14173: change smb interface structures to always use
a union smb_file, to abtract
- const char *path fot qpathinfo and setpathinfo
- uint16_t fnum for SMB
- smb2_handle handle for SMB2

the idea is to later add a struct ntvfs_handle *ntvfs
so that the ntvfs subsystem don't need to know the difference between SMB and SMB2

metze
2007-10-10 13:56:57 -05:00
Stefan Metzmacher
ed9ed1f48f r14157: - pass a struct ntvfs_request to the ntvfs layer
(for now we just do #define ntvfs_request smbsrv_request,
   but it's the first step...)
- rename ntvfs_openfile() -> ntvfs_open()
- fix the talloc hierachie in some places in the ntvfs_map_*() code

metze
2007-10-10 13:56:55 -05:00
Jelmer Vernooij
1228358767 r13924: Split more prototypes out of include/proto.h + initial work on header
file dependencies
2007-10-10 13:52:24 -05:00
Andrew Tridgell
2acc069185 r6342: fixed a bad union assumption that caused ACLs to fail on 64 bit machines
Thanks to lars and agruen for finding this
2007-10-10 13:11:33 -05:00
Andrew Tridgell
9db6c79e90 r5298: - got rid of pstring.h from includes.h. This at least makes it a bit
less likely that anyone will use pstring for new code

 - got rid of winbind_client.h from includes.h. This one triggered a
   huge change, as winbind_client.h was including system/filesys.h and
   defining the old uint32 and uint16 types, as well as its own
   pstring and fstring.
2007-10-10 13:09:38 -05:00
Andrew Tridgell
8ebc61a229 r5050: make sure we translate the generic to the specific bits before doing a
pvfs_access_check_unix().

Fixes a problem with the cifsfs filesystem
2007-10-10 13:09:17 -05:00
Andrew Tridgell
ec32b22ed5 r5037: got rid of all of the TALLOC_DEPRECATED stuff. My apologies for the
large commit. I thought this was worthwhile to get done for
consistency.
2007-10-10 13:09:15 -05:00
Andrew Tridgell
0e61a422bd r4615: added acl checking on directory search in pvfs 2007-10-10 13:08:33 -05:00
Andrew Tridgell
5a1a17d3fc r4595: on create check access against parent not child ... 2007-10-10 13:08:31 -05:00
Andrew Tridgell
e729061bcd r4584: fix pvfs backend to pass the new enhanced RAW-ACLS test. Easy once I really the
strange behaviour I saw was a w2k3 bug :-)
2007-10-10 13:08:29 -05:00
Andrew Tridgell
1df985a49b r4501: when copying files it is common for clients to copy the ACL. When the
ACL is the default ACL this menas the copied file would have an xattr
but the original would not. Avoid this by checking if the ACL being
set is the original ACL, and avoid the copy.
2007-10-10 13:08:15 -05:00
Andrew Tridgell
0a29fb45c3 r4464: added pvfs backend support for the special CREATOR_OWNER and CREATOR_GROUP inheritance rules 2007-10-10 13:07:53 -05:00
Andrew Tridgell
5761fa35ab r4448: - fixed access_mask checking on acl set
- honor the change ownership requests of acl set, changing the underlying
  unix owner/group

- fix the access mask on file create with SEC_FLAG_MAXIMUM_ALLOWED
2007-10-10 13:07:51 -05:00
Andrew Tridgell
96d017e521 r4412: SEC_FILE_READ_ATTRIBUTE is always granted, even if not requested. This was being done
in the full ACL code, but not in the unix access check code, which meant that qfileinfo
was failing for some parameters
2007-10-10 13:07:45 -05:00
Andrew Tridgell
30b4c20b1c r4411: when checking for create permissions, we need to check the parent, not the child! 2007-10-10 13:07:45 -05:00
Andrew Tridgell
5fe51807d6 r4408: added the remaining access check hooks into pvfs. All calls should now have acl checking,
and obey the various inheritance rules.
2007-10-10 13:07:44 -05:00
Andrew Tridgell
f4dfb63d53 r4403: - added ACL inheritance in the pvfs backend. ACLs are now inherited on
file and directory creation via ntcreatex. pvfs now passes the
  inheritance test in RAW-ACLS

- cleaned up the error handling a bit in pvfs_open()
2007-10-10 13:07:43 -05:00
Andrew Tridgell
16967f7502 r4391: bring the default ACL inline with what w2k3 uses 2007-10-10 13:07:42 -05:00
Andrew Tridgell
f25c469693 r4314: added ACL checking on unlink 2007-10-10 13:07:33 -05:00
Andrew Tridgell
590e1a91bf r4205: fixed the default acl mapping from posix permissions to use the mapped
uid->sid and gid->sid
2007-10-10 13:07:26 -05:00
Andrew Tridgell
7b446af09b r4147: converted from NT_USER_TOKEN to struct security_token
this is mostly just a tidyup, but also adds the privilege_mask, which
I will be using shortly in ACL checking.

note that I had to move the definition of struct security_token out of
security.idl as pidl doesn't yet handle arrays of pointers, and the
usual workaround (to use a intermediate structure) would make things
too cumbersome for this structure, especially given we never encode it
to NDR.
2007-10-10 13:06:31 -05:00
Andrew Tridgell
c7cbd966d4 r4056: modified the access check code based on results from RAW-ACLS
test. Also added generic mapping bits for pvfs. We don't pass RAW-ACLS
yet, but its close.
2007-10-10 13:06:20 -05:00
Andrew Tridgell
17a4e0b3ac r4035: more effort on consistent naming of the access mask bits.
This removes the duplicate named SEC_RIGHTS_MAXIMUM_ALLOWED and
SEC_RIGHTS_FULL_CONTROL, which are just other names for
SEC_FLAG_MAXIMUM_ALLOWED and SEC_RIGHTS_FILE_ALL. The latter names
match the new naming conventions in security.idl

Also added names for the generic->specific mappings for files are
directories
2007-10-10 13:06:16 -05:00
Andrew Tridgell
9a9a0d0e79 r4026: added NT ACL checking on pvfs_open() for existing files. I need to
work out some way to do a decent test suite for this.
2007-10-10 13:06:15 -05:00
Andrew Tridgell
01c0fa722f r4011: get rid of rpc_secdes.h and replace it with a single sane set of
definitions for security access masks, in security.idl

The previous definitions were inconsistently named, and contained many
duplicate and misleading entries. I kept finding myself tripping up
while using them.
2007-10-10 13:06:13 -05:00
Andrew Tridgell
01e89697fe r3995: improved the default ACL mapping from unix perms 2007-10-10 13:06:12 -05:00
Andrew Tridgell
9ff6ecbdb6 r3990: take advantage of the uid->sid and gid->sid code to create a much
better default NT ACL in pvfs
2007-10-10 13:06:11 -05:00
Andrew Tridgell
4468018cb6 r3836: - fixed the handling of NT_STATUS_BUFFER_TOO_SMALL in nttrans server
- fixed revision number on default DACL

- fixed DACL_PRESENT bit in acl query

with these fixes cacls.exe and the GUI ACL editor in w2k both work
against pvfs. The GUI editor is slow as it times out looking up the
SID -> name mappings.
2007-10-10 13:05:58 -05:00
Andrew Tridgell
17911eea59 r3833: NTACL is a better xattr name than DosAcl (tpot suggested this) 2007-10-10 13:05:58 -05:00
Andrew Tridgell
3a1f20d874 r3832: added NT ACL query/set to the posix NTVFS backend. The default ACL is
based on the current nttoken, which is completely wrong, but works as a start.

The ACL is stored in the xattr system.DosAcl, using a NDR encoded IDL
union with a version number to allow for future expansion.

pvfs does not yet check the ACL for file access. At the moment the ACL
is just query/set.

We also need to do some RPC work to allow the windows ACL editor to be
used. At the moment is queries the ACL fine, but displays an error
when it fails to map the SIDs via rpc.
2007-10-10 13:05:57 -05:00