1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

84316 Commits

Author SHA1 Message Date
Stefan Metzmacher
853ecd418a libcli/security: add init_mask to existing children in insert_in_object_tree
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Andrew Bartlett
5b4e3de2bb libcli/security: handle node initialisation in one spot in insert_in_object_tree()
This removes special-case for initalising the children array in
insert_in_object_tree().  talloc_realloc() handles the intial allocate
case perfectly well, so there is no need to have this duplicated.

This also restores having just one place were the rest of the elements
are intialised, to ensure uniform behaviour.

To do this, we have to rework insert_in_object_tree to have only one
output variable, both because having both root and new_node as output
variables was too confusing, and because otherwise the two pointers
were being allowed to point at the same memory.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
a359aef083 libcli/security: avoid usage of dom_sid_parse_talloc() in sec_access_check_ds()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
a3fffde368 libcli/security: simplify get_ace_object_type()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
b0f731fc3b libcli/security: fix formating in access_check.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
10a90ce842 libcli/security: fix whitespaces in access_check.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
0ebb93708e dsdb-acl: the SEC_ADS_DELETE_CHILD checks need objectclass->schemaIDGUID
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
8f8d97f9fe dsdb-acl: make use of acl_check_access_on_objectclass() for the object in acl_delete()
We should only use dsdb_module_check_access_on_dn() on the parent.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
8aa8555730 dsdb-acl: make use of acl_check_access_on_{attribute,objectclass} in acl_rename()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
8d31e42eed dsdb-acl: make use of acl_check_access_on_attribute() in acl_modify()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
8e47e64f5d dsdb-acl: remove unused acl_check_access_on_class()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
34f1a52689 dsdb-acl: use acl_check_access_on_objectclass() instead of acl_check_access_on_class()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Andrew Bartlett
6a4063f302 dsdb-acl: Use the structural objectClass in acl_check_access_on_attribute()
This commit enters the GUID into the object tree so that that access
rights assigned to the structural objectClass are also available, as
well as rights assigned to the attribute property groups.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Andrew Bartlett
e8cc59eb78 dsdb-acl: Pass the structural objectClass into acl_check_access_on_attribute
This will, when the GUID is entered into the object tree (not in this
commit) ensure that access rights assigned to the structural
objectClass are also available, as well as rights assigned to the
attribute property groups.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Andrew Bartlett
93944ea900 dsdb-acl: Remove unused get_oc_guid_from_message()
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Andrew Bartlett
a1b421e8cc dsdb-acl: ask for the objectClass attribute if it's not in the scope of the clients search
This will be used later.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Andrew Bartlett
6ab4150685 dsdb-acl: use dsdb_get_structural_oc_from_msg() rather than class_schemaid_guid_by_lDAPDisplayName
This uses dsdb_get_last_structural_objectclass(), which encodes this ordering
knowledge in one place in the code, rather than using this uncommented
magic expression:

(char *)oc_el->values[oc_el->num_values-1].data

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Andrew Bartlett
730433984c dsdb-acl: Use dsdb_get_structural_oc_from_msg() in acl_rename()
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Andrew Bartlett
6d7e53aaac dsdb-acl: Use dsdb_get_structural_oc_from_msg() in acl_modify()
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
097fae2d1d dsdb-acl: add acl_check_access_on_objectclass() helper
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Andrew Bartlett
74bfec0269 dsdb-acl: Add helper function dsdb_get_structural_oc_from_msg()
This will eventually replace get_oc_guid_from_message(), returning the full dsdb_class.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
2685a4ed66 dsdb-acl: attr is not optional to acl_check_access_on_attribute()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
d695b8abc7 dsdb-acl: dsdb_attribute_by_lDAPDisplayName() is needed for all attributes
"clearTextPassword" is the only exception.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
ddfb8fe89c dsdb-acl: introduce a 'el' helper variable to acl_modify()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
71b856a3f0 dsdb-acl: introduce a 'msg' helper variable to acl_modify()
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:45 +01:00
Stefan Metzmacher
c2853f55fc dsdb-schema: make sure we build [system]PossibleInferiors completely
Otherwise callers like dsdb_schema_copy_shallow() will corrupt the
talloc hierarchie.

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:44 +01:00
Stefan Metzmacher
1f673bf920 dsdb-schema: make sure use clean caches in schema_inferiors.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:44 +01:00
Stefan Metzmacher
c4b9ee2558 dsdb-schema: make schema_subclasses_order_recurse() static
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 16:12:44 +01:00
Günther Deschner
58fadf2f48 BUG 9474: Downgrade v4 printer driver requests to v3.
Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Jan 21 16:11:02 CET 2013 on sn-devel-104
2013-01-21 16:11:02 +01:00
Andreas Schneider
c38fb0b106 BUG 9574: Fix a possible null pointer dereference in spoolss.
If the the client enumerates the printers and didn't specify a
servername we have a null pointer dereference, so the process serving
the connection crashes.

Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Mon Jan 21 13:30:11 CET 2013 on sn-devel-104
2013-01-21 13:30:11 +01:00
Matthieu Patou
f70d0ac739 Tests: remove redondent testsuites in provision
Removed provision are already tested somewhere else.

Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Matthieu Patou <mat@samba.org>
Autobuild-Date(master): Mon Jan 21 09:59:43 CET 2013 on sn-devel-104
2013-01-21 09:59:43 +01:00
Matthieu Patou
95fc53a37b Tests: avoid adding python options that are functions in the env
This fix errors when running test --testenv --screen

Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 08:21:20 +01:00
Matthieu Patou
e1ab7b6804 Tests: rewrite ldap_schema to specify attributes
Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 08:21:20 +01:00
Jeremy Allison
853360b8e5 Fix warnings with mismatched sizes in arguments to DEBUG statements.
This can cause compile errors on 32-bit systems.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Sat Jan 19 12:14:13 CET 2013 on sn-devel-104
2013-01-19 12:14:13 +01:00
Jeremy Allison
80a6fe8427 Remove some unused variables.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-19 10:32:30 +01:00
Andrew Bartlett
dda48146a2 heimdal_build: Try again to sort out the strerror_r mess
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-19 10:32:17 +01:00
Andrew Bartlett
d90b709ebb printing: Free talloc_stackframe() on all exit paths
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-19 09:42:02 +01:00
Ira Cooper
63a7d3817f nsswitch: Fix two bitfield constants being the same.
WBFLAG_PAM_AUTH_PAC and WBFLAG_BIG_NTLMV2_BLOB
are the same causing errors in NTLMv2 authentication.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jan 18 22:13:09 CET 2013 on sn-devel-104
2013-01-18 22:13:09 +01:00
Jeremy Allison
d814cfac01 Sort winbind request flags. Ira saw we have a duplicate.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed by: Ira Cooper <ira@wakeful.net>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-18 11:28:40 -08:00
Volker Lendecke
a8fe624948 smbtorture: Satisfy a linker dependency
Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-18 09:16:58 -08:00
Volker Lendecke
15596a8d9c winbind: Handle child requests in a tevent_fd
This enables the use of standard tevent_loop_once in the child, which
now also uses epoll where available.

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-18 09:16:58 -08:00
Volker Lendecke
5e75564377 winbind: Introduce "struct child_handler_state"
This will make the next patch simpler. child_handler_state contains the
information that the handler for the parent fde needs to pass to
process_child_request

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-18 09:16:58 -08:00
Volker Lendecke
3e830e44d3 winbind: Use standard tevent_context_init
This makes winbind use epoll instead of poll

Reviewed by: Jeremy Allison <jra@samba.org>
2013-01-18 09:16:58 -08:00
David Disseldorp
4f9cffbae6 BUG 9378: Add extra attributes for AD printer publishing.
Currently attempting to publish a printer in AD fails with "Object class
violation", due to a number of missing attributes in the LDAP request.

Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jan 18 17:27:35 CET 2013 on sn-devel-104
2013-01-18 17:27:35 +01:00
David Disseldorp
12a08d8ae2 printing: Remove invalid free from error path.
Reviewed-by: Andreas Schneider <asn@samba.org>
2013-01-18 15:37:10 +01:00
Jeremy Allison
f0852a3483 Remove locking across the lifetime of the copychunk call.
Previous commit handles this around each read/write call.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Fri Jan 18 01:47:01 CET 2013 on sn-devel-104
2013-01-18 01:47:01 +01:00
Jeremy Allison
f2d028ef55 Move copychunk locking to be local to the read/write calls.
Eliminates the need to hold locks across the
entire lifetime of the call.

Next commit will remove these.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-01-18 00:06:52 +01:00
Jeremy Allison
d562e9006a Add additional copychunk checks.
For printer, ipc$ connections, and directory handles.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-01-18 00:06:52 +01:00
Jeremy Allison
d6e10f0066 Move handle checking code to copychunk_check_handles().
Planning to add extra checks to ensure we don't attempt
copychunk on printer or IPC$ handles.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
2013-01-18 00:06:52 +01:00
Volker Lendecke
7a21f605c1 tevent: Fix a comment
liboop.org is now in a language I don't understand. But it does definitely not
contain a library.

Reviewed by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jan 18 00:05:37 CET 2013 on sn-devel-104
2013-01-18 00:05:37 +01:00