1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-28 17:47:29 +03:00

71 Commits

Author SHA1 Message Date
Jeremy Allison
a81d700ae9 First cut of new ACL mapping code from Andreas Gruenbacher <agruen@suse.de>.
This is not 100% the same as what SuSE shipped in their Samba, there is
a crash bug fix, a race condition fix, and a few logic changes I'd like to
discuss with Andreas. Added Andreas to (C) notices for posix_acls.c
Jeremy.
-
Jeremy Allison
a6b3acfc7b Fix based on Jim McDonough's code for ACL inheritance problem.
Jeremy.
-
Jeremy Allison
80d30dbfec Fix from Andreas Gruenbacher <agruen@suse.de> to prevent ACL set on read-only
share.
Jeremy.
-
Jeremy Allison
cfd1bf250b Merge of "profile acls" code.
Jeremy.
-
Jeremy Allison
2b06fd305b Lanman print jobs are *16* bits, not 32. arggggh. Map them....
Jeremy.
-
Andrew Bartlett
1de04ec473 Kill off const warnings - add a pile of const to various places. -
Jeremy Allison
3f72910cf9 Ensure when allowing fchown with write access and dos filemodes that
we leave the gid alone.
Jeremy.
-
Jeremy Allison
174df5d914 Merge from 2.2.
Jeremy.
-
Jeremy Allison
2f67f39d21 Fix bug where creating a file and setting a security descriptor atomically
that only contains an "everyone" DACL doesn't apply this to user and group
entries also.
Jeremy.
-
Andrew Tridgell
b6c2ef4f54 try to cope better with the take ownership operation for foreign SIDs
what we do is map to the authenticated user when the sid is unmappable
and dos filemodes are enabled
-
Jeremy Allison
7d59445b69 Added POSIX ACL layer into the vfs.
Jeremy.
-
Jeremy Allison
d85133e269 Implemented default ACL patch (set inherit acls = true on a per share basis).
Based on code donated by Olaf Frczyk <olaf@cbk.poznan.pl>. Further commit
will change to sending via vfs interface.
Jeremy.
-
Andrew Tridgell
c55737fb25 a more informitive debug message when a SID can't be validated -
Tim Potter
6a58c9bd06 Removed version number from file header.
Changed "SMB/Netbios" to "SMB/CIFS" in file header.
-
Gerald Carter
7dc1c34145 merge from 2.2 -
Andrew Tridgell
1c5e19a418 fixed a crash in merge_aces()
when we free curr_ace_outer we need to not try to use it again :)
-
Jeremy Allison
2d7b81e692 Allow ACL set to fail gracefully on HP HFS filesystems.
Jeremy.
-
Jeremy Allison
b926660e73 Stop using getgrgid() - a very expensive call with winbindd, to look up
a group name.
Jeremy.
-
Tim Potter
9712d3f15a Renamed sid field in SEC_ACE to trustee to be more in line with MS's
definitions.
-
Jeremy Allison
4a54a633c5 Log sys_acl_set_XX at level 2 not zero.
Jeremy.
-
Jeremy Allison
bc7963bd64 Ignore unmappable (NT Authority, BUILTIN etc.) SIDs in an ACL set.
Jeremy.
-
Simo Sorce
a95943fde0 move to SAFE_FREE() -
Jeremy Allison
9961c4c1a3 Don't fail if no owner/group owner set. Use existing owners.
Jeremy.
-
Herb Lewis
65ea13420c if no ACL elements then use chmod - fixes ability to set read-only bit
on files that do not have an ACL
-
Jeremy Allison
324ba0512e Fix from Michael Davidson <md@caldera.com> for DEC OSF/1 ACLs (ie.
Digital UNIX).
Jeremy.
-
Andrew Tridgell
debb471267 The big character set handling changeover!
This commit gets rid of all our old codepage handling and replaces it with
iconv. All internal strings in Samba are now in "unix" charset, which may
be multi-byte. See internals.doc and my posting to samba-technical for
a more complete explanation.
-
Jeremy Allison
d989f8bd3e lib/util_getent.c: removed debug code.
smbd/posix_acls.c: Attempt to fix the "lose default acl" problem in Solaris.
Needs testing.
lib/sysacls.c: Typo fix.
Jeremy.
-
Jeremy Allison
1b3977c536 *Wonderful* patch from Andrew Bartlett that will help ensure tdb's are
cleaned on clients abending connections. Thanks Andrew !
Jeremy.
-
Jeremy Allison
aba243ca08 Fixed nasty little bug found by Gerald where we were corrupting the mode
bits before checking if we should change them on non-acl systems.
Jeremy.
-
Jeremy Allison
0db8a61d71 Made "security XXX" masks apply to ACL set. By default they have no effect.
Removed "restrict acl with mask" - redundent.
Jeremy.
-
Jeremy Allison
f100e091ab Fix for bad profile perms. Ensure r on files and rwx on directories.
Jeremy.
-
Jeremy Allison
7792e32ba7 Fixed SHM_R/SHM_W warnings by moving sys/ipc.h and sys/shm.h into includes.h
and using autoconf tests.
Added "restrict acl with mask" parameter.
Jeremy.
-
Jeremy Allison
a60ecb4e53 Tidy up args to DEBUG Statements - found by gcc on Solaris.
Jeremy.
-
Jeremy Allison
f02e67a096 Sync with default perm changes in 2.2.
Jeremy.
-
Jeremy Allison
5870e6019b Michael Davidson <md@sco.COM> pointed out that acl_get_qualifier can potentially
return a malloced area so added sys_acl_free_qualifier() calls to all supported
ACL interfaces to code with this (only Linux needs actual free call).
Jeremy.
-
Jeremy Allison
fe38692643 Fixed extern ref typo for file generic perms. 2am coding strikes again :-).
Jeremy.
-
Jeremy Allison
51987684bd This is a big, rather ugly patch. Whilst investigating the files not truncated
when copying to a full disk problem, I discovered that we were not allowing
the delete on close flag to be set properly, this led to other things, and
after investigation of the proper delete on close semantics and their relationship
to the file_share_delete flag I discovered there were some cases where we
weren't doing the deny modes properly. And this after only 5 years working
on them..... :-) :-).
So here's the latest attempt. I realised the delete on close flag needs to
be set across all smbds with a dev/ino pair open - in addition, the delete
on close flag, allow share delete and delete access requested all need to
be stored in the share mode tdb.
The "delete_on_close" entry in the fsp struct is now redundant and should
really be removed. This may also mean we can get rid of the "iterate_fsp"
calls that I didn't like adding in the first place. Whilst doing this patch,
I also discovered we needed to do the se_map_generic() call for file opens
and POSIX ACL mapping, so I added that also.
This code, although ugly, now passes the deny mode torture tests plus the
delete on close tests I added. I do need to add one more multiple connection
delete on close test to make sure I got the semantics exactly right, plus we
should also (as Andrew suggested) move to random testing here.

The good news is that NT should now correctly delete the file on disk
full error when copying to a disk :-).

Jeremy.
-
Jeremy Allison
4fa8cf68c3 Fixed the problem Gerald reported. Unfortunately we need to go back to
reporting imaginary "default" inheritable ACLs on directories, otherwise,
when you add an entry and click on apply without noticing there's no
default entry associated with it, it applies a null acl on the files
within the directory (hey, that's what you told NT you wanted, right ! :-).
Also ensure that minimum permissions for a directory are r-x for owner,
not just r--.
Jeremy.
-
Jeremy Allison
641ada44ae smbd/posix_acls.c: Saving and restoring errno here is the wrong place. Moved it
to the places where [f]chmod_acl is called instead.
Jeremy.
-
Jeremy Allison
83f52394e6 smbd/posix_acls.c: Sync up with 2.2 changes - don't return deny ACE's.
smbd/vfs.c: Don't call [f]chmod_acl if no acl support.
Jeremy.
-
Jeremy Allison
38b19fad28 More unused variables.
Jeremy.
-
Jeremy Allison
29414fe0d6 groupdb/mapping.c:
include/proto.h: Fix missing (void) in proto.
rpc_server/srv_samr_nt.c: Fix user private group problem by filtering out groups that
							clash with users.
smbd/posix_acls.c: Ensure default ACE's are sensible.
utils/pdbedit.c: Fix from Simo Sorce.
Jeremy.
-
Jeremy Allison
5b9a88c2d0 Sync up with 2.2 ACL code.
Jeremy.
-
Jeremy Allison
852b9e15ac New POSIX ACL mapping code. Works with UNIX permissions, now for testing
with real ACLs...
Jeremy.
-
Jeremy Allison
af364b93d9 lib/system.c (Finally) fixed all insure errors in password caching code. We can't
stop libc routines from calling getpwXXX functions, so caching a pointer to them
is impossible. This new code now makes two copies of the returned struct passwd
struct - one used as a cache, one returned to allow the caller to modify. When
doing a lookup we compare against the cached copy. Code is now easier to understand
also.
smbd/posix_acls.c: If we move the head of the linked list, remember to pass a
reference to that pointer.....
Jeremy.
-
Jeremy Allison
7b97ac289e I'm happy with the mapping for NT getACL, now for NT setACL.
Jeremy.
-
Jeremy Allison
0d6c7dedd2 Tidyup return of zero-permissions (map to ACE_DENIED, GENERIC_ALL, Everyone).
Jeremy.
-
Jeremy Allison
45e96777d0 Last tweak (I promise :-). Fallback to returning our SID if we're a domain
member but can't get the domain sid.
Jeremy.
-
Jeremy Allison
0be41d5158 Merge of new 2.2 code into HEAD (Gerald I hate you :-) :-). Allows new SAMR
RPC code to merge with new passdb code.
Currently rpcclient doesn't compile. I'm working on it...
Jeremy.
-
Jeremy Allison
14d5997dc8 Move to talloc control of SPOOL_XXX structs. Move to talloc control of
security descriptors and pointers. Syncup with 2.2 tree.
Jeremy.
-