1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-04 17:47:26 +03:00

200 Commits

Author SHA1 Message Date
Jelmer Vernooij
35fbc7bbda s4-smbtorture: Make test names lowercase and dot-separated.
This is consistent with the test names used by selftest, should
make the names less confusing and easier to integrate with other tools.

Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Sat Dec 11 04:16:13 CET 2010 on sn-devel-104
2010-12-11 04:16:13 +01:00
Matthias Dieter Wallnöfer
19ea37886c s4:libcli/security/session.h - fix include ordering for "enum security_user_level" 2010-11-27 21:50:41 +01:00
Jelmer Vernooij
3deece5591 s4: Remove the old perl/m4/make/mk-based build system.
The new waf-based build system now has all the same functionality, and
the old build system has been broken for quite some time.

Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Sun Oct 31 02:01:44 UTC 2010 on sn-devel-104
2010-10-31 02:01:44 +00:00
Jelmer Vernooij
a74e8be6d1 waf: Stop automaticaly changing dashes to underscores in library names. 2010-10-26 10:17:18 -07:00
Jelmer Vernooij
d9cbcdd410 s4: Drop duplicate 'lib' prefix for private libraries. 2010-10-26 10:17:16 -07:00
Jelmer Vernooij
ca16d805bd s4: Rename LIBSECURITY{_SESSION,} to libsecurity{_session,} 2010-10-24 00:20:04 +00:00
Andrew Tridgell
e98ca6e868 s4-libcli: make LIBSECURITY_SESSION a private library 2010-10-21 19:03:25 +11:00
Andrew Bartlett
a879a4610d libcli/auth Merge source4/libcli/security and util_sid.c into the common code
This should ensure we only have one copy of these core functions
in the tree.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-10-14 02:35:05 +00:00
Andrew Bartlett
353d9bc3e4 s4-acl Merge sec_access_check() with se_access_check() from source3/
Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-10-14 02:35:05 +00:00
Andrew Bartlett
f768b32e37 libcli/security Provide a common, top level libcli/security/security.h
This will reduce the noise from merges of the rest of the
libcli/security code, without this commit changing what code
is actually used.

This includes (along with other security headers) dom_sid.h and
security_token.h

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Tue Oct 12 05:54:10 UTC 2010 on sn-devel-104
2010-10-12 05:54:10 +00:00
Andrew Bartlett
8beaa29242 s4-libcli/security Use seperate subsystem for session related functions
The merged I plan in this area require spliting security.h into
two header files, a common header and a session.h for the
remaining source4-specific code.

Andrew Bartlett
2010-10-12 02:54:16 +00:00
Andrew Bartlett
ae52f953af libcli/security Move most of security_token.c to common code.
The source4-specific session_info functions have been left in session.c

Andrew Bartlett
2010-10-12 02:54:16 +00:00
Jelmer Vernooij
e12e661f35 s4-selftest: Move more tests to scripting/python, simplifies running of tests. 2010-09-21 22:54:38 -07:00
Andrew Bartlett
a02a2c3557 libcli/security Use talloc_zero when making a struct security_token 2010-09-11 18:46:14 +10:00
Andrew Bartlett
dbee98d30f libcli/security Move source4/ privileges code into the common libcli/security
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-09-11 18:46:07 +10:00
Andrew Bartlett
9abfd8fe3b s4-privs Add a lookup by index of privilages
Now that privileges are no longer given luid values sequentially,
we need another way to look them up for enumeration.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-09-11 18:46:05 +10:00
Andrew Bartlett
e113af6fb1 privs Add my Copyright
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-09-11 18:46:05 +10:00
Andrew Bartlett
e655e9f676 s4-privs Remove link between enum sec_privilege and the privilege bitmap
This allows us to set the enum sec_privilege constants to the LUID
values that are seen from windows, which we need to match, in order
to preserve the support for the NT Print Migrator tool after a merge
with the source3/ privileges code.

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2010-09-11 18:46:04 +10:00
Matthias Dieter Wallnöfer
59559bd02f s4:libcli/security/*.c - fix some wrong typed counters
According to "librpc/gen_ndr/security.h" they need to be "uint32_t".
2010-09-09 20:35:43 +02:00
Andrew Bartlett
6cf29b3e4f s4:security Change struct security_token->sids from struct dom_sid * to struct dom_sid
This makes the structure much more like NT_USER_TOKEN in the source3/
code.  (The remaining changes are that privilages still need to be merged)

Andrew Bartlett
2010-08-23 08:50:55 +10:00
Andrew Bartlett
7c6ca95bec s4:security Remove use of user_sid and group_sid from struct security_token
This makes the structure more like Samba3's NT_USER_TOKEN
2010-08-18 09:50:38 +10:00
Andrew Bartlett
e229f68b3e s4:security Bring in #defines for the user and primary group token location
This will allow us to stop duplicating the user and primary group SID in the
struct security_token, and therefore make it more like the NT_USER_TOKEN
in Samba3.

Andrew Bartlett
2010-08-18 09:30:08 +10:00
Andrew Tridgell
84bedf4028 s4-drs: fixed check for SECURITY_RO_DOMAIN_CONTROLLER
check more than the user_sid, and also check for the right rid value

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-08-17 21:21:50 +10:00
Jelmer Vernooij
c92db7b6dc python: Use samba.tests.TestCase, make sure base class tearDown and
setUp methods are called, fix formatting.
2010-06-19 22:46:45 +02:00
Andrew Tridgell
bb1ba4ff76 s4-drs: added new SECURITY_RO_DOMAIN_CONTROLLER level
This is used for allowing operations by RODCs, and denying them
operations that should only be allowed for a full DC

This required a new domain_sid argument to
security_session_user_level()

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-With: Rusty Russell <rusty@samba.org>
2010-04-22 19:36:16 +10:00
Nadezhda Ivanova
4fc59089c8 Removed more excess looping and fixed problem with incorrect IO flag handling. 2010-04-20 00:23:42 +03:00
Nadezhda Ivanova
205c826611 A bit of refactoring in the SD creation code. 2010-04-15 14:44:34 +03:00
Andrew Tridgell
b690fedef5 s4-waf: removed the AUTOGENERATED markers
we won't be using the mk -> wscript generator again
2010-04-06 20:27:16 +10:00
Andrew Tridgell
f9eae32f4b s4-waf: mark the wscript files as python so vim/emacs knows how to highlight them 2010-04-06 20:27:11 +10:00
Andrew Tridgell
844acb2260 build: waf quicktest nearly works
Rewrote wafsamba using a new dependency handling system, and started
adding the waf test code
2010-04-06 20:26:48 +10:00
Andrew Tridgell
845e0cbe6f build: commit all the waf build files in the tree 2010-04-06 20:26:48 +10:00
Andrew Tridgell
088096d1ba python: use '#!/usr/bin/env python' to cope with varying install locations
this should be much more portable
2010-03-25 14:37:19 +11:00
Jeremy Allison
c2d1b01103 Missing include guard in source4/libcli/security/security.h
Jeremy.
2010-03-24 12:20:03 -07:00
Michael Adam
15b60a7e3f s4:move the sddl code down to the top level
Michael
2010-03-03 09:16:34 +01:00
Matt Kraai
d8071e7ed7 Change uint_t to unsigned int in source4
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2010-02-02 07:18:18 +01:00
Andrew Tridgell
0bc902ac84 s4-sddl: DRS replication needs REVISION_ADS for SDs
DRS replication with w2k8-r2 fails with a schema mismatch error if we
set the revision to NT4
2010-01-02 17:28:35 +11:00
Jelmer Vernooij
dbd7a62baa py/security: Add test for dom_sid.split.
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-12-31 17:33:33 +11:00
Nadezhda Ivanova
c0883fb451 Fixed incorrect checking of PRINCIPAL_SELF permissions.
If an ace has the PRINCIPAL_SELF as trustee, this sid has to be replaced with
the onjectSid of the object being checked. PRINCIPAL_SELF is the way to grant rights
to an account over itself.
2009-12-17 17:25:11 +02:00
Matthias Dieter Wallnöfer
207067d1a8 s4:security/sddl - rework of the security descriptor abbreviations
- Reoder them
- Add some new ones (needed for the security descriptor in the provision script)
2009-11-27 22:45:43 +01:00
Nadezhda Ivanova
a97460d657 Fixed incorrect SID for RAS Servers. 2009-11-17 17:10:23 +02:00
Nadezhda Ivanova
55d2cec640 Fixed some major bugs in inheritance and access checks.
Fixed sd creation not working on LDAP modify.
Fixed incorrect replacement of CO and CG.
Fixed incorrect access check on modify for SD modification.
Fixed failing sec_descriptor test and enabled it.
Fixed failing sd add test in ldap.python
2009-11-15 22:31:44 +02:00
Nadezhda Ivanova
1fc47e1228 Version 1.0 of the directory service acls module.
At this point, support for checks on LDAP add, delete, rename and modify.
Old kludge_acl is still there to handle the searches.
This module is synchronous as the async version was impossible to debug,
will be converted to async after some user testing.
2009-11-05 17:34:12 +02:00
Nadezhda Ivanova
25d9cc8383 Fixed some missing flags and bugs in the security creation.
Also, added some logging. It needs improvement, possibly ability to
turn in on and off via configuration file.
2009-11-03 13:33:30 +02:00
Nadezhda Ivanova
0abfc90ac9 Fixed a bug in object specific access checks. 2009-11-03 12:43:51 +02:00
Matthias Dieter Wallnöfer
0defcfb4f7 s4:libcli/security/access_check - Add "const" in front of "type"
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-10-22 10:02:38 +11:00
Andrew Tridgell
c3b09d18a8 s4-acl: SEC_FLAG_MAXIMUM_ALLOWED doesn't auto-apply privilege access masks 2009-10-17 13:01:03 +11:00
Andrew Tridgell
9da4af062b s4-security: honor more of the privilege access bits 2009-10-17 13:01:03 +11:00
Matthias Dieter Wallnöfer
44df2488e3 s4: fix various warnings (not "const" related ones) 2009-10-02 15:33:48 +02:00
Andrew Tridgell
5acd8bc01b s4-acl: fixed SD creation
Thanks for Nadya and Metze for this. The SDs were being created with
invalid fields (noticed by w2k8-r2 client when joining our domain)
2009-09-28 10:21:33 +10:00
Nadezhda Ivanova
df0d629f37 Fixed a dereferenced null pointer. 2009-09-24 18:54:14 -07:00