1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-07 17:18:11 +03:00
Commit Graph

119 Commits

Author SHA1 Message Date
Ralph Boehme
9796ebcec4 pysmbd: reformat py_smbd_set_simple_acl() kwnames and PyArg_ParseTupleAndKeywords() call
No change in behaviour.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-12-20 11:41:41 +00:00
Jeremy Allison
634a4d13e1 s3: pysmbd: Change py_smbd_chown() to use SMB_VFS_FCHOWN() internally.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-10-15 18:46:37 +00:00
Jeremy Allison
56b355d079 s3: pysmbd: Change py_smbd_unlink() to call SMB_VFS_UNLINKAT().
Use conn->cwd_fsp as current fsp.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-09-26 17:20:48 +00:00
Jeremy Allison
e4e819c087 s3: pysmbd: Change py_smbd_mkdir() to call SMB_VFS_MKDIRAT().
Use conn->cwd_fsp as current fsp.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-09-11 18:24:30 +00:00
Jeremy Allison
5e7828faf3 s3: pysmbd: Ensure conn->cwd_fsp member of created connections is initialized.
This is needed to correctly call the XXXAT() vfs calls.

We should probably just use create_conn_struct_tos_cwd() here
and pass $cwd instead of using create_conn_struct_tos() and
passing "/" as the share root. We wouldn't change the current
working directory and the created share root would be set to $cwd
but I'm not sure what effects this may have on users of pysmbd
in case any of them pass paths above the $cwd to these functions.

Less changes to just call vfs_ChDir(conn, &cwd) which doesn't
change the current directory and leaves the share root as "/".

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-09-11 18:24:28 +00:00
Douglas Bagnall
f3b65ff4e5 s3/smbd/py: avoid null deref with bad python arguments
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-07-22 22:20:26 +00:00
Noel Power
8c8fe32362 s3/smbd: squash 'cast between incompatible function types' warning
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
2019-05-16 17:55:17 +00:00
Andrew Bartlett
17b3d2ebff CVE-2019-3870 pysmbd: Ensure a zero umask is set for smbd.mkdir()
mkdir() is the other call that requires a umask of 0 in Samba.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13834

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-04-08 10:27:34 +00:00
Andrew Bartlett
1899e16e6f CVE-2019-3870 pysmbd: Move umask manipuations as close as possible to users
Umask manipulation was added to pysmbd with e146fe5ef9 in 2012
and init_files_struct was split out in 747c3f1fb3 in 2018 for
Samba 4.9. (It was added to assist the smbd.create_file() routine used in the backup and
restore tools, which needed to write files with full metadata).

This in turn avoids leaving init_files_struct() without resetting the umask to
the original, saved, value.

Per umask(2) this is required before open() and mkdir() system calls (along
side other file-like things such as those for Unix domain socks and FIFOs etc).

Therefore for safety and clarify the additional 'belt and braces' umask
manipuations elsewhere are removed.

mkdir() will be protected by a umask() bracket, for correctness, in the next patch.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13834

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-04-08 10:27:34 +00:00
Björn Baumbach
bc8d0d5160 pysmbd: handle file not found error
Avoid PANIC: internal error

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Volker Lendecke <vl@samba.org>
2018-10-11 10:28:18 +02:00
Björn Baumbach
ab558fa14c pysmbd: add option to pass a session info to set_nt_acl() function
A filled session info is needed by some vfs modules, e.g. full_audit.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Volker Lendecke <vl@samba.org>
2018-10-11 10:28:18 +02:00
Joe Guo
aec40e3a39 pysmbd: add session_info arg to py_smbd_set_nt_acl
Add session_info arg as optional and pass it down to get_conn_tos.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-07-12 04:31:59 +02:00
Joe Guo
760e36ddbc pysmbd: add session_info arg to get_conn_tos
Add session_info arg, so caller can pass it in to reuse authentication info
later. This will improve performance a lot while doing ntacl operations
on large amount of files, e.g.: sysvolreset.

Modification for upstream caller will come in following patches.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13521

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-07-12 04:31:59 +02:00
Joe Guo
1078c969ab pysmbd: add py_smbd_create_file
Add create_file function to smbd API.

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-06-28 09:25:09 +02:00
Joe Guo
747c3f1fb3 pysmbd: extract init_files_struct function
Extract initialization code from set_nt_acl_conn for reuse.

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-06-28 09:25:09 +02:00
Joe Guo
f1566c2ef9 pysmbd: add py_smbd_mkdir
Add mkdir for smbd API.

Signed-off-by: Joe Guo <joeg@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-06-28 09:25:09 +02:00
Stefan Metzmacher
1566766f38 pysmbd: make use of create_conn_struct_tos()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2018-06-14 20:52:21 +02:00
Stefan Metzmacher
67ea594843 pysmbd: remove explicit talloc_stackframe() from get_conn() and name it get_conn_tos()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2018-06-14 20:52:21 +02:00
Stefan Metzmacher
539f51f0df pysmbd: fix some talloc_stackframe() memory leaks and clean up the frame hierarchy in make_simple_acl().
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2018-06-14 20:52:21 +02:00
Stefan Metzmacher
7ef67df3f3 pysmbd: consitently use talloc_stackframe() for temporary memory
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2018-06-14 20:52:20 +02:00
Stefan Metzmacher
cbde2e348b pysmbd: remove useless explicit conn_free() from set_nt_acl_conn()
The following TALLOC_FREE(frame); will do the same via
conn_free_wrapper().

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2018-06-14 20:52:20 +02:00
Noel Power
53e76ed2ff python3 port for smbd module
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-04-05 08:59:09 +02:00
Uri Simchoni
d6f5ee6707 pysmbd: fix use of sysacl API
Fix pysmbd to use the sysacl (POSIX ACL support) as intended, and
not assume too much about the inner structure and implementation
of the permissions in the sysacl API.

This will allow the inner structure to change in a following commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13176

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2017-12-21 19:12:07 +01:00
Jeremy Allison
aada94885d s3: VFS: Change SMB_VFS_SYS_ACL_SET_FILE to use const struct smb_filename * instead of const char *.
We need to migrate all pathname based VFS calls to use a struct
to finish modernising the VFS with extra timestamp and flags parameters.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-05-31 22:50:22 +02:00
Jeremy Allison
cea8e57eac s3: VFS: Change SMB_VFS_SYS_ACL_GET_FILE to use const struct smb_filename * instead of const char *.
We need to migrate all pathname based VFS calls to use a struct
to finish modernising the VFS with extra timestamp and flags parameters.

Requires a few extra cleanups in calling code.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2017-05-31 22:50:22 +02:00
Jeremy Allison
dc5dad4813 s3: Filenames: Add uint32_t flags parameter to synthetic_smb_fname().
Get it from parent/deriving smb_filename if present.
Use 0 (as usually this a Windows-style lookup) if
not.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2016-03-24 22:57:16 +01:00
Jeremy Allison
b4246f863c s3:lib: Move internal lp_posix_pathnames() call out of utility function synthetic_smb_fname_split().
Make it a passed in parameter instead.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2016-03-10 20:55:09 +01:00
Jeremy Allison
153af65e44 s3:lib: Remove the const SMB_STRUCT_STAT * parameter from synthetic_smb_fname_split().
Only one caller uses this, and this can be handled externally.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2016-03-10 20:55:09 +01:00
Jeremy Allison
d1f26bc432 VFS: Modify chown to take a const struct smb_filename * instead of const char *
Preparing to reduce use of lp_posix_pathnames().

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2016-03-05 09:39:18 +01:00
Jeremy Allison
616d068f0c s3: VFS: Modify SMB_VFS_GET_NT_ACL to take a const struct smb_filename * instead of const char *
Bumps VFS version to 35.

Preparing to reduce use of lp_posix_pathnames().

Most of this is boilerplate, the only subtleties are in
the modules:

vfs_catia.c
vfs_media_harmony.c
vfs_shadow_copy2.c
vfs_unityed_media.c

Where the path is modified then passed to SMB_VFS_NEXT_GET_NT_ACL().
In these cases the change uses synthetic_smb_fname() to
create a new struct smb_filename from the modified path.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <rb@sernet.de>
2016-02-16 19:59:24 +01:00
Stefan Metzmacher
70737dd551 s3:pysmbd: #include <Python.h> must be the first include in order to avoid compiler warnings
This is the only exception, normally "replace.h" or "includes.h" need to be the
first include.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2015-06-12 17:08:20 +02:00
Richard Sharpe
6abd986704 Convert all uses of uint8/16/32 to _t in source3/smbd.
Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-05-06 04:14:14 +02:00
Garming Sam
ad773cc014 pysmbd: improve the return of error codes in the python smbd bindings
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2014-02-05 08:42:25 +01:00
Volker Lendecke
1dc29208f3 pysmbd: Convert py_smbd_unlink to synthetic_smb_fname
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-04-17 14:50:00 -07:00
Volker Lendecke
204d971d89 pysmbd: Convert set_nt_acl_conn to synthetic_smb_fname
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-04-17 14:50:00 -07:00
Jeremy Allison
7ba6850904 source3/smbd/pysmbd.c: Always use create_conn_struct(). Don't hand create connection structs.
Signed-off-by: Jeremy Allison <jra@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-09 14:54:29 +11:00
Andrew Bartlett
cef5f466af pysmbd: Change to keyword based arguments
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-01-07 16:23:24 -08:00
Andrew Bartlett
813a3f0df9 pysmbd: Convert pysmbd to take an optional service to connect to
This uses create_conn_struct to correctly call VFS_CONNECT(), but only
if a service has been specified.

Andrew Bartlett

Reviewed-by: Jeremy Allison <jra@samba.org>
2013-01-07 16:18:35 -08:00
Andrew Bartlett
236977bf46 Change get_nt_acl_no_snum() to return an NTSTATUS, not a struct security_descriptor *.
Internally change the implementation to use SMB_VFS_GET_NT_ACL()
instead of SMB_VFS_FGET_NT_ACL() with a faked-up file struct.

Andrew Bartlett

Reviewed by: Jeremy Allison <jra@samba.org>
2012-11-13 22:48:19 +01:00
Andrew Bartlett
a4434297f1 smbd: Correctly set fsp->is_directory before dealing with ACLs
Change set_nt_acl_no_snum() to correctly set up the fsp.
This does a stat on a real fsp in set_nt_acl_no_snum.

Reviewed by: Jeremy Allison <jra@samba.org>
2012-11-13 22:48:19 +01:00
Andrew Bartlett
a6a01552ef pysmbd: Add SMB_ACL_EXECUTE to the mask set by make_simple_acl()
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2012-11-12 00:05:12 +11:00
Volker Lendecke
d236709d15 Remove two unused variables
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Wed Nov  7 17:18:06 CET 2012 on sn-devel-104
2012-11-07 17:18:06 +01:00
Andrew Bartlett
e146fe5ef9 pysmbd: Set umask to 0 during smbd operations 2012-10-26 17:26:21 +11:00
Andrew Bartlett
728e56b463 pysmbd: Remember to close files after setting the NT ACL 2012-10-26 17:26:20 +11:00
Andrew Bartlett
e107c6ace7 pysmbd: Add hook for unlink() so python scripts can remove xattr.tdb entries
If we do not provide a way to remove files from xattr.tdb, we can re-use the inode.

Andrew Bartlett
2012-10-26 17:26:20 +11:00
Andrew Bartlett
3cdd888093 pysmbd: Fix pysmbd octal mode handling
It is clearly too long since Computer Science 101... ;-)

Andrew Bartlett
2012-10-25 17:01:52 +11:00
Andrew Bartlett
9158974540 smbd: Add mem_ctx to sys_acl_init() and all callers
This changes from allocation on NULL to allocation on the supplied
memory context.

Currently that supplied context is talloc_tos() at the the final consumer of
the ACL.

Andrew Bartlett
2012-10-11 12:25:11 +11:00
Volker Lendecke
1b403d46c7 s3: Fix some blank line endings 2012-09-25 22:41:51 +02:00
Volker Lendecke
0feb341502 pysmbd: Fix cut&paste errors 2012-09-25 22:41:51 +02:00
Andrew Bartlett
6638d10366 smbd: Remove pre-allocation of ACL array in sys_acl_init()
Instead, this is just handled with realloc in sys_acl_create_entry()

This allows us to remove the size element from the SMB_ACL_T.

Andrew Bartlett
2012-09-12 05:26:16 +02:00
Andrew Bartlett
0aed29105e s3-smbd: Add security_info_wanted argument to get_nt_acl_no_snum
I need to get at the owner, group, DACL and SACL when testing correct
ACL storage.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
e058dfb3b0 s3-pysmbd: Fix return type of smbd.get_nt_acl
The security_ prefix is stripped off in the python bindings.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
332efe1539 s3-pysmbd: Fix error message 2012-08-23 15:02:26 +02:00
Andrew Bartlett
51e3547426 s3-pysmbd: Allow a mode to be specified for the simple ACL
The additional group for the ACL is now optional.

Andrew Bartlett
2012-08-23 15:02:26 +02:00
Andrew Bartlett
125e93cdde s3-pysmbd: Correct the python type for smb_acl_t
The t is weird, but the python bindings trim the traditional IDL name
prefix of each element, as it is usually rudundent.

Andrew Bartlett
2012-08-22 01:31:57 +02:00
Andrew Bartlett
dc063bf3bd s3-pysmbd: Add get/set functions for the posix ACL layer
These will be used to verify that an ACL set as an NT ACL creates
the correct posix ACL.

Andrew Bartlett
2012-08-21 15:25:50 +10:00
Andrew Bartlett
4df2c65ea6 s3-pysmbd: Correct comments in python VFS bindings 2012-08-21 15:25:50 +10:00
Andrew Bartlett
d963aaf73b s3-pysmbd: Add hook for a VFS chown() 2012-08-21 15:25:49 +10:00
Volker Lendecke
fbebd7530e s3-libsmb: Add a python wrapper
Please note that this is not finished and only for internal use.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2012-08-16 21:10:32 +02:00
Andrew Bartlett
6ccfd05e72 s3-sysacls: Remove sys_acl_free_acl() and replace with TALLOC_FREE() 2012-08-15 11:44:50 +10:00
Andrew Bartlett
f06c216d0b s3-pysmbd: Try opening as a file, then as a directory
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Aug  7 08:59:21 CEST 2012 on sn-devel-104
2012-08-07 08:59:21 +02:00
Andrew Bartlett
e571d5c03e s3-pysmbd: Use talloc_zero()
This avoids operating on uninitialised data

Andrew Bartlett
2012-08-07 14:57:33 +10:00
Andrew Bartlett
227d490477 s3-pysmbd: Add talloc_stackframe() to smbd_set_simple_acl wrapper 2012-08-07 14:57:07 +10:00
Andrew Bartlett
1e5098d5e1 s3-pysmbd: Add hook for get_nt_acl()
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Aug  2 13:27:55 CEST 2012 on sn-devel-104
2012-08-02 13:27:54 +02:00
Andrew Bartlett
64f494de5e s3-pysmbd: fix DEBUG 2012-08-02 11:35:19 +02:00
Andrew Bartlett
e5686a4cf0 s3-pysmbd: Add my copyright 2012-08-02 11:35:19 +02:00
Andrew Bartlett
55a0d6606c s3-pysmbd: Add set_nt_acl() function based on parts of vfstest
This will allow us to set the full NT ACL on a file, using the VFS
layer, during provision of the AD DC.

Andrew Bartlett
2012-08-02 11:35:19 +02:00
Andrew Bartlett
33ff033204 s4-provision: Give better clues on what Samba needs for s3fs ACL support
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun 21 14:07:55 CEST 2012 on sn-devel-104
2012-06-21 14:07:55 +02:00
Andrew Bartlett
859aa43f73 s3-python: Add python bindings for posix ACL layer
This will allow us to check that posix ACLs work in the s4 provision, and avoid
--use-s3fs if they do not.

Andrew Bartlett
2012-05-08 04:51:59 +02:00