1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Commit Graph

29277 Commits

Author SHA1 Message Date
Stefan Metzmacher
646012954c s4:winbind: let wb_sam_logon_send/recv() use the netlogon_queue (bug #9097)
metze
2012-08-25 01:39:42 +02:00
Stefan Metzmacher
19daec6a95 s4:winbind: add a netlogon_queue (tevent_queue)
This will protect the netlogon_creds later.

metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
d4aa8978cc s4:winbind: convert wb_update_rodc_dns_send/recv to tevent_req
metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
0ccdaa940a s4:winbind: convert wb_sam_logon_send/recv to tevent_req
metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
d3756d8738 s4:winbind: convert wb_sid2domain to tevent_req internally
The public wrapper still uses composite_context, because I don't
have time to fix all the callers...

metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
89a5a71654 s4:librpc/rpc: don't do async requests if gensec doesn't support async replies (bug #9097)
metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
0bd0ad967d s4:librpc/rpc: also call dcerpc_schedule_io_trigger() after bind and alter_context responses
metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
e44b5bdb2c s4:librpc/rpc: use dcerpc_req_dequeue() in dcerpc_request_recv_data()
metze
2012-08-25 01:39:41 +02:00
Stefan Metzmacher
81bc57d395 s4:librpc/rpc: use talloc_zero for 'struct rpc_request'
metze
2012-08-25 01:39:41 +02:00
Andrew Bartlett
123ee7f9b5 s4-selftest: Add test for samba-tool ntacl sysvolcheck 2012-08-23 15:02:26 +02:00
Andrew Bartlett
ebcdc4a36b s4-samba-tool: Add samba-tool ntacl sysvolcheck command
This command verifies that the current on-disk ACLs match the directory and
the defaults from provision.

Unlike sysvolreset, this does not change any of the permissions.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
0aed29105e s3-smbd: Add security_info_wanted argument to get_nt_acl_no_snum
I need to get at the owner, group, DACL and SACL when testing correct
ACL storage.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
7cf50b9f30 s4-selftest: Add testing of samba-tool ntacl sysvolreset 2012-08-23 15:02:26 +02:00
Andrew Bartlett
8c71dc3505 param: Add startup checks for valid server role/binary combinations
This should eliminate confusion from our users about what they can
expect to successfully run.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
7e7ed72bbe s4-provision: Fix internal documentation 2012-08-23 15:02:26 +02:00
Andrew Bartlett
51e3547426 s3-pysmbd: Allow a mode to be specified for the simple ACL
The additional group for the ACL is now optional.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
8f909199c4 s4-samba-tool: Add 'samba-tool ntacl sysvolreset' tool
This will reset the NT ACL on the sysvol share to the default from
provision, with GPO objects matching the LDAP ACL (as required).

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
56fd072fdd selftest: Add a test of the NT ACL -> posix ACL mapping layer to selftest 2012-08-23 15:02:26 +02:00
Andrew Bartlett
4fe344ef05 selftest: Cope with the multiple possible representations of -1 in posixacl.py 2012-08-23 15:02:26 +02:00
Andrew Bartlett
bd00c92865 selftest: Extend posixacl test to check the actual ACL
Needing to be able to write this test is the primary reason I have
been reworking the VFS and posix ACL layer over the past few weeks.
By exposing the POSIX ACL as a IDL object we can eaisly manipulate it
in python, and then verify that the ACL was handled correctly.

This ensures the when we write an ACL in provision, that it will
indeed allow that access at the FS layer.

We need to extend this beyond just the critical two ACLs set during
provision, to also include some special (hard) cases involving the
merging of ACE entries, as this is the most delicate part of the ACL
transfomation.

A similar test should also be written to read the posix ACL and the
mapped NT ACL on a file that has never had an NT ACL set.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
318b8cb4fa selftest: Add a test of the NT ACL -> posix ACL mapping layer
This is the start of what will be a series of tests confirming exactly how
some NT ACLs are mapped to posix ACLs.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
b1825c6421 s4-scripting: Redefine getntacl() as accessing via the smbd VFS or directly
This allows us to write tests that compare the smbd vfs with what is
in the DB or xattr.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
a778662da8 s4-provision: set POSIX ACLs to for use with the smbd file server (s3fs)
This handles the fact that smbd will rarely override the POSIX ACL enforced by
the kernel.  This has caused issues with the creation of group policies by
other members of the Domain Admins group.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
be9a8cf4ca s4-dsdb: Remove unused variables 2012-08-23 15:02:26 +02:00
Andrew Bartlett
d1eac79690 s4-dsdb: Do not use a possibly-old loadparm context in schema reload
The loadparm context on the schema DB might have gone away already.
Pre-cache the schema refresh interval at load time to avoid worrying
about this.

Andrew Bartlett
2012-08-23 15:02:25 +02:00
Andrew Bartlett
a58ac39a5a s4-upgradeprovision: Use ntvfs in reference provision
We do not need filesystem ACLs set when creating the reference provision, so it is
easier to use the NTVFS backend as it does not cause trouble with make test.

Andrew Bartlett
2012-08-23 15:02:25 +02:00
Andrew Bartlett
c1012c6817 selftest: Specify --use-ntvfs when testing the group code
We do not need to set filesystem ACLs in this case.

Andrew Bartlett
2012-08-23 15:02:25 +02:00
Andrew Bartlett
b2ff36566b selftest: Specify --use-ntvfs when testing the newuser code
We do not need to set filesystem ACLs in this case.

Andrew Bartlett
2012-08-23 15:02:25 +02:00
Andrew Bartlett
2fc6760d5a selftest: Specify --use-ntvfs when testing the LDAP backend init code
We do not need to set filesystem ACLs in this case.

Andrew Bartlett
2012-08-23 15:02:25 +02:00
Andrew Bartlett
1219eaffbe s4-python: Complete python bindings for idmap.idl
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Aug 22 03:08:51 CEST 2012 on sn-devel-104
2012-08-22 03:08:51 +02:00
Andrew Bartlett
10267f153c s4-python: complete python bindigns for smb_acls.idl 2012-08-22 01:31:57 +02:00
Andrew Bartlett
9170f9ce95 selftest: Specify --use-ntvfs to provision in test scripts
Because these run as non-root, we need to avoid doing things that will
fail during the provision.  The main test of the s3fs provision is the
plugin_s4_dc environment with a smb.conf that specifies vfs_fake_acls.

Andrew Bartlett
2012-08-22 01:31:57 +02:00
Andrew Bartlett
97b13799ce s4-classicupgrade: Add --use-ntvfs option
This is an odd option, but is needed because I wish to add assertions about
ACL setting that will not work in make test without the vfs_fake_acls module
loaded.

Andrew Bartlett
2012-08-22 01:31:57 +02:00
Andrew Bartlett
b5c2747cad s4-provision: pass use_ntvfs from C wrappers and set to true in tests/vampire
None of these cases need the complexity of the s3fs backend.

Andrew Bartlett
2012-08-22 01:31:57 +02:00
Matthias Dieter Wallnöfer
c4b9c3aba8 s4:samldb LDB module - remove unused "member" attribute from search filter
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-22 01:31:57 +02:00
Matthias Dieter Wallnöfer
c8bfb8eb09 s4:dsdb - always fail if a search filter could not be parsed
A NULL string/expression returns the generic "(objectClass=*)" filter

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-22 01:31:55 +02:00
Matthias Dieter Wallnöfer
5f8006cb64 s4:dsdb_sort_objectClass_attr - simplify memory context handling
Do only require the out memory context and build the temporary one in
the body of the function. This greatly simplifies the callers.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-22 01:31:55 +02:00
Matthias Dieter Wallnöfer
166a7d37f7 s4:dsdb_sort_objectClass_attr - use "data_blob_string_const" for setting values
As shown in commit c8e6d8b487 this looks easier and in any case we can
treat schema context data like global data.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-22 01:31:55 +02:00
Andrew Bartlett
84d6e09b95 s4-torture: Use torture_fail() in the unix.unix_info2 test
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Aug 20 15:36:48 CEST 2012 on sn-devel-104
2012-08-20 15:36:47 +02:00
Andrew Bartlett
c75b6154e4 s4-torture: Show that we cannot list extended attributes on streams 2012-08-20 21:58:08 +10:00
Andrew Bartlett
f9837d15f3 s4-torture: Show that we cannot have extended attributes on streams 2012-08-20 21:58:07 +10:00
Andrew Bartlett
bf1e27bd8f s4-torture: Improve raw.streams test to cover EAs and to use torture_assert()
The extension of this test is to create an extended attribute, so we
can confirm that the easize field on a stream actually refers to the
parent file.

This has been run against Windows 7.

Andrew Bartlett
2012-08-20 21:58:07 +10:00
Andrew Bartlett
3ef0e2246b s4-ntvfs: Add TODO on ea_size
This is almost certainly un-important.

Andrew Bartlett
2012-08-20 21:57:46 +10:00
Andrew Bartlett
0769d67682 s4-ntvfs: Ensure we do not attempt to write EAs on streams 2012-08-20 21:57:46 +10:00
Michael Adam
4f4bb1f20d s4:torture:basic: add more delete test - variants of deltest16 and deltest17
There seems to be a difference if the initial delete_on_close flag
was set on a handle that created the file or if the handle if was
for a file that already existed.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Aug 17 21:44:24 CEST 2012 on sn-devel-104
2012-08-17 21:44:24 +02:00
Andrew Bartlett
2e1ab13f6e s4-dsdb: Use tmp_ctx in kccsrv_check_deleted to avoid leaking memory onto part->dn
The confusing use of do_dn as a memory context while legitimate
created a bug when it was copied and modified to search on a DN from
long-term state.

By always using a temporary memory context it is clear what paramter
is the memory context.

This was found based on a log provided by Ricky Nance
<ricky.nance@weaubleau.k12.mo.us>.  Thanks Ricky!

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 17 18:24:10 CEST 2012 on sn-devel-104
2012-08-17 18:24:09 +02:00
Andrew Bartlett
26bfe70def s4-kcc: Avoid use-after-free of dn and add tmp_ctx
By using a tmp_ctx we are clearer about allocating temporary memory.

Andrew Bartlett
2012-08-17 16:41:26 +02:00
Stefan Metzmacher
e2b07c0adc s4:libcli/smb2: reset trsnport->compound.related when a compound chain is finished
metze
2012-08-17 14:51:57 +02:00
Andrew Bartlett
a7b8e9f562 s4-dsdb: Ensure we always free tmp_ctx in schema refresh check
This was found based on a log provided by Ricky Nance
<ricky.nance@weaubleau.k12.mo.us>.  Thanks Ricky!

In that log, over 2.5 days this particular allocation was repeated:

1715099     talloc_new: ../source4/dsdb/samdb/ldb_modules/schema_load.c:120 contains      0 bytes in   1 blocks

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 17 06:21:18 CEST 2012 on sn-devel-104
2012-08-17 06:21:17 +02:00
Volker Lendecke
5251d07e62 s4: Fix returns in py_check_dcerpc_type
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-17 00:57:19 +02:00