1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-27 03:21:53 +03:00
Commit Graph

82480 Commits

Author SHA1 Message Date
Jeremy Allison
5e0365dfe8 Now SEC_RIGHTS_PRIV_RESTORE and SEC_RIGHTS_PRIV_BACKUP don't include any generic bits (they're used directly in the fileserver where the generic bits have already been mapped into file specific bits) we need to add the generic bits to the test when we have these privileges.
Mark samba4.base.maximum_allowed knownfail until we implement NTCREATEX_OPTIONS_BACKUP_INTENT.
2012-08-31 20:32:37 -07:00
Jeremy Allison
6550bc0d26 Rewrite torture_samba3_rpc_sharesec() to use a non-privileged user for share security descriptor testing. 2012-08-31 20:29:13 -07:00
Jeremy Allison
64e57a1770 Add a comment showing where to set log level in tests. 2012-08-31 20:29:13 -07:00
Jeremy Allison
46455642a7 Change the S3 fileserver over to se_file_access_check().
Don't set the priv_open_requested yet until the open-for-backup
request is correctly passed in.
2012-08-31 20:29:13 -07:00
Jeremy Allison
2b89e1a20a Factor out privilege checking code into se_file_access_check() which takes a bool priv_open_requested parameter. 2012-08-31 20:29:13 -07:00
Jeremy Allison
69d925d110 SEC_RIGHTS_DIR_PRIV_BACKUP and SEC_RIGHTS_DIR_PRIV_RESTORE aren't used anywhere. Remove (can re-add if needed).
Ensure the privilege rights are always specific rights, not generic.
By the time the privilege rights are examined, we've already mapped
from generic to specific in the access_mask.
2012-08-31 20:29:13 -07:00
Andrew Bartlett
4d7dad1315 s4-dsdb: Remove unused variables
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Sep  1 05:10:47 CEST 2012 on sn-devel-104
2012-09-01 05:10:47 +02:00
Andrew Bartlett
8557c692f6 s4-kdc: Improve grammer and clarity of password change failure messages.
This can still be improved further, but avoid mentioning reasons that
clearly do not apply in this case.

Andrew Bartlett
2012-09-01 03:33:21 +02:00
Volker Lendecke
f0a9180ae9 s3: Fix warnings in aio_fork.c 2012-09-01 03:33:21 +02:00
Volker Lendecke
2ffe69082e s3: Remove a shadowing variable declaration 2012-09-01 03:33:21 +02:00
Andrew Bartlett
01ade93c7c s4-dsdb: Remove unused tmp_ctx leaked onto long-term ldb_context
This was found based on a log provided by Ricky Nance
<ricky.nance@weaubleau.k12.mo.us>.  Thanks Ricky!

Andrew Bartlett
2012-09-01 03:33:20 +02:00
Kai Blin
c256566aa9 s4 dns: Store TKEYs in a ringbuffer
This stops us from potentially being DoSed by tons of TKEYs

Autobuild-User(master): Kai Blin <kai@samba.org>
Autobuild-Date(master): Fri Aug 31 22:46:01 CEST 2012 on sn-devel-104
2012-08-31 22:46:01 +02:00
David Disseldorp
e4505fc27b tdb: return unpack error on strdup failure
Signed-off-by: Lars Müller <lars@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Fri Aug 31 21:05:21 CEST 2012 on sn-devel-104
2012-08-31 21:05:21 +02:00
Volker Lendecke
85706c4e16 s3: Fix a few "warning: ISO C90 forbids mixed declarations and code"
Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Fri Aug 31 19:24:47 CEST 2012 on sn-devel-104
2012-08-31 19:24:47 +02:00
Christian Ambach
2eb606bfa9 s3:build fix autoconf build on RHEL5
RHEL5 only has autoconf 2.59, so autogen.sh still needs to find autoconf-2.60.m4
somewhere, but it was removed with 5f58359

Autobuild-User(master): Christian Ambach <ambi@samba.org>
Autobuild-Date(master): Fri Aug 31 12:50:03 CEST 2012 on sn-devel-104
2012-08-31 12:50:03 +02:00
Christof Schmitt
3dfd179638 s3:doc Fix name of timeout parameter in documentation
The name is time_audit:timeout, not time_audit:audit_timeout.

Signed-off-by: Christian Ambach <ambi@samba.org>
2012-08-31 11:10:14 +02:00
Christof Schmitt
424492a963 s3:dbwrap_ctdb: Add DB name and key to warning message
When a operation takes too long, it is useful for debugging to know the
DB and the key.

Signed-off-by: Christian Ambach <ambi@samba.org>
2012-08-31 11:10:14 +02:00
Kai Blin
7204dc9708 s4 dns: Negotiate GSSAPI-based TKEYs
Autobuild-User(master): Kai Blin <kai@samba.org>
Autobuild-Date(master): Fri Aug 31 10:38:35 CEST 2012 on sn-devel-104
2012-08-31 10:38:35 +02:00
Andrew Bartlett
d2c0387d66 s4-kdc: Give information on how long the password history is
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 31 08:06:17 CEST 2012 on sn-devel-104
2012-08-31 08:06:17 +02:00
Andrew Bartlett
efec5a9299 s4-libnet: Fix memory leak of lsa_RefDomainList and lsa_String onto libnet_ctx
These are only needed for as long as the call, and should be children of the
private context.

This was found based on a log provided by Ricky Nance
<ricky.nance@weaubleau.k12.mo.us>.  Thanks Ricky!

Andrew Bartlett
2012-08-31 14:30:38 +10:00
Andrew Bartlett
a5d57a04c2 auth/credentials: Do not print passwords in a talloc memory dump
The fact that a password was created here is enough information, so
overwrite with the function name and line.

Andrew Bartlett
2012-08-31 14:30:38 +10:00
Andrew Bartlett
a3b67e5299 VERSION: Move on to beta9
We home beta8 will be the last beta, but to avoid confusion and allow
more releases if required I won't mark it as rc1 until the actual
release candidate.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 31 02:07:23 CEST 2012 on sn-devel-104
2012-08-31 02:07:23 +02:00
Andrew Bartlett
524876aa51 VERSION: Mark as the beta8 release 2012-08-31 08:33:15 +10:00
Andrew Bartlett
757df37e70 WHATSNEW: prepare for 4.0 beta8 2012-08-31 08:31:45 +10:00
Jeremy Allison
4ff446636a The NTVFS server doesn't pass the SMB1 INHERITFLAGS test.
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Aug 30 21:38:02 CEST 2012 on sn-devel-104
2012-08-30 21:38:02 +02:00
Jeremy Allison
7c4ae72851 Now ACL inheritance flags are working, add test_inheritance_flags() back into raw.acls to ensure we don't regress. 2012-08-30 11:01:30 -07:00
Jeremy Allison
da670e4830 With the inheritance ACL changes we now pass samba3.smb2.acls.INHERITFLAGS. 2012-08-30 10:08:50 -07:00
Jeremy Allison
cf29863c69 Fix bug #9124 - Samba fails to set "inherited" bit on inherited ACE's.
Change se_create_child_secdesc() to handle inheritance correctly.
2012-08-30 10:08:50 -07:00
Jeremy Allison
3d34406c7b Windows does canonicalization of inheritance bits. Do the same.
We need to filter out the
SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ
bits. If both are set we store SEC_DESC_DACL_AUTO_INHERITED
as this alters whether SEC_ACE_FLAG_INHERITED_ACE is set
when an ACE is inherited. Otherwise we zero these bits out.
See:

http://social.msdn.microsoft.com/Forums/eu/os_fileservices/thread/11f77b68-731e-407d-b1b3-064750716531

for details.
2012-08-30 10:08:50 -07:00
Jeremy Allison
795920cf4a Change the other two places where we set a security descriptor given by the client to got through set_sd(),
the canonicalize sd function.
2012-08-30 10:08:50 -07:00
Jeremy Allison
70ebf1da67 Re-add set_sd(), called from set_sd_blob(). Allows us to centralize all ACL canonicalization. 2012-08-30 10:08:50 -07:00
Jeremy Allison
8c84ecef89 Rename set_sd() to set_sd_blob() - this describes what it does. 2012-08-30 10:08:50 -07:00
Christian Ambach
02aacb17d1 s3:libsmb correctly set isFsctl for snapshot list
FSCTL_GET_SHADOW_COPY_DATA is a FSCTL, so set the isFsctl marker
otherwise smbclient allinfo will not report snapshots any more with the changes
made for Bug #8311

Autobuild-User(master): Christian Ambach <ambi@samba.org>
Autobuild-Date(master): Thu Aug 30 18:57:24 CEST 2012 on sn-devel-104
2012-08-30 18:57:24 +02:00
Andreas Schneider
461209255d selftest: Remove spoolss tests from knownfail.
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Aug 30 17:17:55 CEST 2012 on sn-devel-104
2012-08-30 17:17:55 +02:00
Andreas Schneider
20cfa38b9d selftest: Add missing printing options for plugin_s4_dc. 2012-08-30 15:42:58 +02:00
Andreas Schneider
fb917eba47 file_server: Fix spoolss support with s3fs. 2012-08-30 15:42:58 +02:00
Andreas Schneider
bf36462555 selftest: Define the log directory for s3fs. 2012-08-30 15:42:58 +02:00
Andrew Bartlett
5131359eda auth/credentials: Support match-by-key in cli_credentials_get_server_gss_creds()
This allows a password alone to be used to accept kerberos tickets.

Of course, we need to have got the salt right, but we do not need also
the correct kvno.  This allows gensec_gssapi to accept tickets based on
a secrets.tdb entry.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Aug 30 01:26:12 CEST 2012 on sn-devel-104
2012-08-30 01:26:12 +02:00
Andrew Bartlett
a58bf44c1e s4-torture: Add start of a test to confirm winbindd PAC parsing
So far this confirms that we can accept a ticket using the secrets.tdb
entry.

Andrew Bartlett
2012-08-29 23:46:17 +02:00
Andrew Bartlett
fe36bb4bcc lib/krb4_wrap: Add const to kt_copy_one_principal 2012-08-29 23:46:17 +02:00
Christof Schmitt
6678907fae s3:vfs_gpfs: Use directory not file to get fileset id
The query of the fileset quota needs to determine the file set id first.
With the currently available interface, this requires opening the file
to get a file descriptor. For files, this open can fail when a share
mode is set.

Workaround this by querying the fileset id on the directory instead.

The proper solution would be getting an interface for getting the
fileset id that does not require opening the file.

Autobuild-User(master): Christian Ambach <ambi@samba.org>
Autobuild-Date(master): Wed Aug 29 18:58:34 CEST 2012 on sn-devel-104
2012-08-29 18:58:33 +02:00
Björn Jacke
f31d0d0e30 vfs_media_harmony: fix some compile warnings with llvm
Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Wed Aug 29 16:05:10 CEST 2012 on sn-devel-104
2012-08-29 16:05:09 +02:00
David Disseldorp
fb15e5a58f s3-printing: fix bug 9123 lprng job tracking errors
The lprng printing back-end is truncating the print job filename in the
lpq output, which means that Samba is not able to determine the back-end
job ID for a newly submitted print job.
Remove the unneeded spoolss job ID from the print job file name to
ensure the job filename is not truncated. Also log these warnings at a
higher log level.

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Wed Aug 29 14:25:13 CEST 2012 on sn-devel-104
2012-08-29 14:25:12 +02:00
Andreas Schneider
24356f3cc9 libkrb5: Fix build with MIT Kerberos.
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Aug 29 12:23:37 CEST 2012 on sn-devel-104
2012-08-29 12:23:37 +02:00
Andrew Bartlett
e39cce4214 s4-libnet: Fix passing samba_all_enctypes as a fn rather than the encrypt array it returns
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Aug 29 09:56:27 CEST 2012 on sn-devel-104
2012-08-29 09:56:27 +02:00
Andrew Bartlett
5d96498680 s4-dsdb: Avoid printing secret attributes in ldb trace logs
These are printed when Samba has debug level 10, which is often used for debugging.

To indicate that these attributes are secret, we set an opaque.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Aug 29 06:04:33 CEST 2012 on sn-devel-104
2012-08-29 06:04:33 +02:00
Andrew Bartlett
395b8e4d58 lib/ldb: Avoid printing secret attributes in ldb trace logs
These are printed when Samba has debug level 10, which is often used for debugging.

Instead, print a note to say that this attribute has been skipped.

Andrew Bartlett
2012-08-29 12:28:38 +10:00
Andrew Bartlett
17337cfec0 auth/credentials: Remove unused, and un-declared cli_credentials_set_krbtgt() 2012-08-29 11:34:52 +10:00
Andrew Bartlett
beafdd6410 auth/credentials: Better integrate fetch of secrets.tdb and secrets.ldb records
By checking first if there is a secrets.tdb record and passing in the password and last change time
we avoid setting one series of values and then replacing them.  We also avoid the need to work
around the setting of anonymous.

Andrew Bartlett
2012-08-29 11:34:52 +10:00
Andrew Bartlett
a0e4bdcb5b auth/credentials: Improve memory handling in cli_credentials_set_machine_account
By using a tempoary talloc context this is much tidier and more reliable code.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Aug 29 03:11:10 CEST 2012 on sn-devel-104
2012-08-29 03:11:09 +02:00