1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

81 Commits

Author SHA1 Message Date
Andreas Schneider
9e8876a9d7 lib: Update uid_wrapper to version 1.2.1
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-22 00:23:20 +01:00
Andreas Schneider
fae40ec5b4 uwrap: Bump version to 1.2.0
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Nov  5 12:30:02 CET 2015 on sn-devel-104
2015-11-05 12:30:02 +01:00
Andreas Schneider
2dae19c43b uwrap: Fix build warning with release build
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:16 +01:00
Andreas Schneider
3328bcede7 uwrap: Add the EINVAL check to setegid()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:16 +01:00
Andreas Schneider
6e30b2e638 uwrap: Allow setgid calls only for privileged users
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:16 +01:00
Andreas Schneider
be0cb8ab4d uwrap: Allow setregid calls only for privileged users
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:16 +01:00
Andreas Schneider
6b388799e1 uwrap: Allow setresgid calls only for privileged users
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:16 +01:00
Andreas Schneider
2232db8173 uwrap: Move the EINVAL check down in seteuid()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:16 +01:00
Andreas Schneider
56970b467b uwrap: Allow setuid calls only for privileged users
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:16 +01:00
Andreas Schneider
253f42c837 uwrap: Allow setreuid calls only for privileged users
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:16 +01:00
Andreas Schneider
5a9c80da7f uwrap: Allow setresuid calls only for privileged users
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:15 +01:00
Andreas Schneider
656f0db652 uwrap: Fix a possible null pointer dereference
If uid_wrapper is loaded but not enabled (UID_WRAPPER environment
variable not set), then we dereference a NULL pointer while forking.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:15 +01:00
Andreas Schneider
aad7019e2d uwrap: Improve debug output
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:15 +01:00
Andreas Schneider
8922654f84 uwrap: Fix debug line in uwrap_init()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-11-05 09:23:15 +01:00
Andrew Bartlett
2bad085305 build: Build *_wrapper without -DNDEBUG for in-tree use
These binaires are not installed, so are only used in make test,
and there we need debug output.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Oct 16 16:36:22 CEST 2015 on sn-devel-104
2015-10-16 16:36:22 +02:00
Andrew Bartlett
1dc05386f2 build: Move __attribute__ ((destructor)) and ((constructor)) tests to wafsamba
This allows us to use them in talloc as well.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Adrian Cochrane <adrianc@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-10-09 20:14:06 +02:00
Andreas Schneider
f504681c83 uwrap: Bump version to 1.1.1
Signed-off-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Aug 21 17:48:45 CEST 2015 on sn-devel-104
2015-08-21 17:48:45 +02:00
Andreas Schneider
a71610cbfa uwrap: Removed double newline
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-08-21 14:46:15 +02:00
Andreas Schneider
fc68e845e2 uwrap: Fix build if getres(uid|gid) are not available.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2015-08-21 14:46:15 +02:00
Andreas Schneider
c93e2cdd1e waf: Check for Linux has 32-bit credential calls
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 14 18:04:53 CEST 2015 on sn-devel-104
2015-08-14 18:04:53 +02:00
Andreas Schneider
62671ad7b2 uwrap: Bump version to 1.1.0.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jan 28 19:44:39 CET 2015 on sn-devel-104
2015-01-28 19:44:39 +01:00
Andreas Schneider
0588a5847a uwrap: Make sure we leave if the id is NULL.
CID #97616

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:08 +01:00
Robin Hack
99a9855d38 uwrap: Support scenario where threads fork or creates threads.
When fork() is called here there is no need to disable uwrap as a whole.
This change disables only uwrap for the thread which called fork().

uwrap catches calls of pthread_create() and pthread_exit() functions
from libpthread library now.

Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:08 +01:00
Robin Hack
a5b70c0e5f uwrap: Prepare for overload of libpthread functions.
uwrap_bind_symbol are now renamed to uwrap_bind_symbol_libc
and simlilar uwrap_bind_symbol_libpthread are introduced.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:08 +01:00
Robin Hack
526c1d5147 uwrap: Introduce UWRAP_LOCK_ALL and UWRAP_UNLOCK_ALL macros
Introduce UWRAP_LOCK_ALL and UWRAP_UNLOCK_ALL which make
locking easier.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:08 +01:00
Robin Hack
308230d4fc uwrap: Rewrite uwrap_libc_fns struct to pass strict aliasing rules.
Also rename struct uwrap_libc_fns fns to uwrap_libc_symbols and
uwrap_load_lib_function to uwrap_bind_symbol (same for _uwrap_load_...
variant.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
2fb08a6750 uwrap: Fix wrong data types in syscalls switch.
Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
34062ac77a uwrap: Add support for getresuid() and getresgid() glibc/syscall.
Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
fbdd2d4624 uwrap: Extend support for (set|get)groups libc functions and syscalls.
Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
c6a1e6058e uwrap: Extend support for syscalls called from threads or main process.
We need to distinguish if the syscall is called from main process or
from a thread.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
e1e067f332 uwrap: Small uwrap_init optimalization.
Don't call libc_getuid/getgid function twice.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Andreas Schneider
fa8290e7b9 uwrap: Add support for running with address sanitizer.
The address sanitzer will complain about our hack with variable function
attributes. This disables the checking of it.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
50b6d94867 uwrap: Reflect changes of uid/gid in threads to main process.
When thread changes uid/gid this change must be reflected to main
process.

Syscalls changes only uid/gid of thread. Call of libc functions changes
also uid/gid of main process.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
bda49a3af4 uwrap: Small optimalization of uwrap_init().
Don't call getenv("UID_WRAPPER") on start of uwrap_init().

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
0830d93eec uwrap: Optimalization of uid_wrapper_enabled() function.
Check only bool variable inside uwrap structure instead
of calling whole uid_init().

In the best case only one mutex lock is need when check.

NOTES:
 * This patch uses __atomic_load gcc builtin function.
 * uid_init() were moved outside uid_wrapper_enabled() function.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
b21106a1a1 uid_wrapper: Fix race condition - uwrap_init.
Patch moves uwrap_id_mutex before if (uwrap.initialised) statement
which can be passed by concurrent threads.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
199b7b7fe8 uwrap: Fix race condition - glibc lookups.
Patch adds libc_symbol_binding_mutex which guards global table of libc
functions and their lookup.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
a79b5cf41c uwrap: Add library constructor and move pthread_atfork inside.
Library constructor is used for pthread_atfork call. Moved here because
pthread_atfork is cumulative and should be called only once.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Robin Hack
e279eee670 uwrap: Use UWRAP_LOCK/UNLOCK macros instead of pthread_mutex_lock/unlock calls.
New macros UWRAP_LOCK/UNLOCK has been created and all calls to
pthread_mutex_lock/unlock has been replaced by these macros.

Signed-off-by: Robin Hack <hack.robin@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2015-01-28 17:17:07 +01:00
Andreas Schneider
6ca1cf208e uwrap: Fix the handle loop for older gcc versions.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2015-01-28 17:17:07 +01:00
Jeremy Allison
7366204845 lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library.
Originally from youzhong@gmail.com.

https://bugzilla.samba.org/show_bug.cgi?id=10851

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-10-06 10:12:06 +02:00
Jakub Hrozek
8c251d6390 uwrap: Support dropping all supplemetary groups with setgroups()
Dropping all supplementary groups is a common practice when changing
UIDs. This patch adds support for dropping all supplementary groups when
setgroups is called with size=0.

Signed-off-by: Jakub Hrozek <jakub.hrozek@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-07-31 18:49:48 +02:00
Andreas Schneider
de1f924f08 uwrap: Add logging if uwrap is enabled correctly.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-07-31 18:49:48 +02:00
Andreas Schneider
41d7b64744 uwrap: Log error if we are out of memory.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-07-31 18:49:48 +02:00
Andreas Schneider
0a3d142484 uwrap: Add a better logging function.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-07-31 18:49:47 +02:00
Andreas Schneider
6bbf9fa6df uwrap: Check for HAVE_FUNCTION_ATTRIBUTE_FORMAT.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-07-31 18:49:47 +02:00
Andreas Schneider
9711f77313 uwrap: Fall back to RTLD_NEXT if we can't find libc.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-07-31 18:49:47 +02:00
Andreas Schneider
a88f5a6da2 uwrap: Add mutex in uwrap_destructor().
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-07-31 18:49:47 +02:00
Andreas Schneider
b7f9d3b491 uwrap: Fix memory leak on error.
Found by Coverity.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-07-31 18:49:47 +02:00
Andreas Schneider
6d23354f72 lib: Change uid_wrapper to preloadable version.
This imports version 1.0.1 of uid_wrapper.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-17 14:56:05 +02:00