mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
1bab76223c
This will serve as a check to make sure that in particular a SAMR client is really root. This is for example used in get_user_info_18() handing out a machine password. The unix domain sockets for NCACN_NP can only be contacted by root, the "np\" subdirectory for those sockets is root/root 0700. Connecting to such a socket is done in two situations: First, local real root processes connecting and smbd on behalf of SMB clients connecting to \\pipe\name, smbd does become_root() there. Via the named_pipe_auth_req_info4 smbd hands over the SMB session information that the RPC server blindly trusts. The session information (i.e. the NT token) is heavily influenced by external sources like the KDC. It is highly unlikely that we get a system token via SMB, but who knows, this is information not fully controlled by smbd. This is where this additional field in named_pipe_auth_req_info5 makes a difference: This field is set to NCACN_NP by smbd's code, not directly controlled by the clients. Other clients directly connecting to a socket in "np\" is root anyway (only smbd can do become_root()) and can set this field to NCALRPC. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> |
||
|---|---|---|
| .. | ||
| cifs | ||
| common | ||
| ipc | ||
| posix | ||
| simple | ||
| sysdep | ||
| unixuid | ||
| ntvfs_base.c | ||
| ntvfs_generic.c | ||
| ntvfs_interface.c | ||
| ntvfs_util.c | ||
| ntvfs.h | ||
| README | ||
| wscript_build | ||
This is the base of the new NTVFS subsystem for Samba. The model for NTVFS backends is quite different than for the older style VFS backends, in particular: - the NTVFS backends receive windows style file names, although they are in the unix charset (usually UTF8). This means the backend is responsible for mapping windows filename conventions to unix filename conventions if necessary - the NTVFS backends are responsible for changing effective UID before calling any OS local filesystem operations (if needed). The become_*() functions are provided to make this easier. - the NTVFS backends are responsible for resolving DFS paths - each NTVFS backend handles either disk, printer or IPC$ shares, rather than one backend handling all types - the entry points of the NTVFS backends correspond closely with basic SMB operations, wheres the old VFS was modelled directly on the POSIX filesystem interface. - the NTVFS backends are responsible for all semantic mappings, such as mapping dos file attributes, ACLs, file ownership and file times