pastebin - collaborative debugging tool
rovema.kpaste.net RSS


msnfs41client: Prototype uid2sid mapping, try #001
Posted by Anonymous on Thu 5th Oct 2023 13:32
raw | new post
view followups (newest first): msnfs41client: Prototype uid2sid mapping, try #001 by Anonymous
modification of post by Anonymous (view diff)

  1. diff --git a/daemon/acl.c b/daemon/acl.c
  2. index 3a86735..1145011 100644
  3. --- a/daemon/acl.c
  4. +++ b/daemon/acl.c
  5. @@ -60,11 +60,16 @@ static int create_unknownsid(WELL_KNOWN_SID_TYPE type, PSID *sid,
  6.      dprintf(ACLLVL, "create_unknownsid: CreateWellKnownSid type %d returned %d "
  7.              "GetLastError %d sid len %d needed\n", type, status,
  8.              GetLastError(), *sid_len);
  9. -    if (status)
  10. -        return ERROR_INTERNAL_ERROR;
  11. +    if (status) {
  12. +        status = ERROR_INTERNAL_ERROR;
  13. +       goto err;
  14. +    }
  15.      status = GetLastError();
  16.      if (status != ERROR_INSUFFICIENT_BUFFER)
  17. -        return status;
  18. +               goto err;
  19. +#if 1
  20. +(*sid_len) += 128;
  21. +#endif
  22.      *sid = malloc(*sid_len);
  23.      if (*sid == NULL)
  24.          return ERROR_INSUFFICIENT_BUFFER;
  25. @@ -73,6 +78,7 @@ static int create_unknownsid(WELL_KNOWN_SID_TYPE type, PSID *sid,
  26.          return ERROR_SUCCESS;
  27.      free(*sid);
  28.      status = GetLastError();
  29. +err:
  30.      eprintf("create_unknownsid: CreateWellKnownSid failed with %d\n", status);
  31.      return status;
  32.  }
  33. @@ -90,20 +96,131 @@ static void convert_nfs4name_2_user_domain(LPSTR nfs4name,
  34.      }
  35.  }
  36.  
  37. +/*
  38. + * Allocate a SID from SECURITY_SAMBA_UNIX_AUTHORITY, which encodes an
  39. + * UNIX/POSIX uid directly into a SID.
  40. + *
  41. + * Example:
  42. + * UID 1616 gets mapped to "Unix_User+1616", encoding the UID into the
  43. + * SID as "S-1-22-1-1616"
  44. + * $ getent passwd Unix_User+1616
  45. + * Unix_User+1616:*:4278191696:4278191696:U-Unix_User616,S-1-22-1-1616:/:/sbin/nologin
  46. + *
  47. + */
  48. +
  49. +/* S-1-22-1-0 for uid 0 */
  50. +#define SECURITY_SAMBA_UNIX_AUTHORITY { { 0,0,0,0,0,22 } }
  51. +SID_IDENTIFIER_AUTHORITY sid_id_auth = SECURITY_SAMBA_UNIX_AUTHORITY;
  52. +
  53. +BOOL AllocateUnixUserSID(unsigned long uid, PSID *pSid)
  54. +{
  55. +    PSID sid = NULL;
  56. +    PSID malloced_sid = NULL;
  57. +    DWORD sid_len;
  58. +
  59. +    if (AllocateAndInitializeSid(&sid_id_auth, 2, 1, (DWORD)uid,
  60. +        0, 0, 0, 0, 0, 0, &sid)) {
  61. +        sid_len = GetLengthSid(sid);
  62. +#if 1
  63. +sid_len += 128;
  64. +#endif
  65. +       malloced_sid = malloc(sid_len);
  66. +
  67. +       if (malloced_sid) {
  68. +           /*
  69. +            * |AllocateAndInitializeSid()| has an own memory
  70. +            * allocator, but we need the sid in memory from
  71. +            * |malloc()|
  72. +            */
  73. +           if (CopySid(sid_len, malloced_sid, sid)) {
  74. +               FreeSid(sid);
  75. +               *pSid = malloced_sid;
  76. +                dprintf(ACLLVL, "AllocateUnixUserSID(): Allocated "
  77. +                   "Unix_User+%lu: success, len=%ld\n",
  78. +                   uid, (long)sid_len);
  79. +                return TRUE;
  80. +           }
  81. +       }
  82. +    }
  83. +    
  84. +    FreeSid(sid);
  85. +    free(malloced_sid);
  86. +    dprintf(ACLLVL, "AllocateUnixUserSID(): Failed to allocate "
  87. +        "Unix_User+%lu: error code %d\n",
  88. +        uid, GetLastError());
  89. +    return FALSE;
  90. +}
  91. +
  92.  static int map_name_2_sid(DWORD *sid_len, PSID *sid, LPCSTR name)
  93.  {
  94.      int status = ERROR_INTERNAL_ERROR;
  95.      SID_NAME_USE sid_type;
  96.      LPSTR tmp_buf = NULL;
  97.      DWORD tmp = 0;
  98. +    signed long name_uid = -1;
  99. +
  100. +    if (isdigit(name[0])) {
  101. +        /* fixme: |name| can be a group name, too */
  102. +        name_uid = atol(name);
  103. +    }
  104. +    else if(!strcmp(name, "nobody")) {
  105. +        name_uid = 65534;
  106. +    }
  107. +    else if(!strcmp(name, "nogroup")) {
  108. +        name_uid = 65534;
  109. +    }
  110. +    else if(!strcmp(name, "root")) {
  111. +        name_uid = 0;
  112. +    }
  113. +    else if(!strcmp(name, "rmainz")) {
  114. +        name_uid = 1616;
  115. +    }
  116. +    else if(!strcmp(name, "swulsch")) {
  117. +        name_uid = 1818;
  118. +    }
  119. +    else if(!strcmp(name, "mwenzel")) {
  120. +        name_uid = 8239;
  121. +    }
  122. +    else if(!strcmp(name, "test001")) {
  123. +        name_uid = 1000;
  124. +    }
  125. +    
  126. +    if (name_uid != -1) {
  127. +        switch (name_uid) {
  128. +            case 1000:
  129. +            case 197608:
  130. +                dprintf(ACLLVL, "map_name_2_sid(name='%s'): "
  131. +                   "remap %ld to 'roland_mainz'\n", name, name_uid);
  132. +                name = "roland_mainz";
  133. +                break;
  134. +            default:
  135. +                if (AllocateUnixUserSID(name_uid, sid)) {
  136. +                    dprintf(ACLLVL, "map_name_2_sid(name='%s'): "
  137. +                       "AllocateUnixUserSID(uid=%ld) success\n",
  138. +                       name, name_uid);
  139. +                   return ERROR_SUCCESS;
  140. +               }
  141. +
  142. +                status = GetLastError();
  143. +                dprintf(ACLLVL, "map_name_2_sid(name='%s'): "
  144. +                   "AllocateUnixUserSID(uid=%ld) failed, error=%d\n",
  145. +                   name, name_uid, status);
  146. +               return status;
  147. +        }
  148. +    }
  149.  
  150.      status = LookupAccountName(NULL, name, NULL, sid_len, NULL, &tmp, &sid_type);
  151. -    dprintf(ACLLVL, "map_name_2_sid: LookupAccountName for %s returned %d "
  152. +    dprintf(ACLLVL, "map_name_2_sid(name='%s'): LookupAccountName returned %d "
  153.              "GetLastError %d name len %d domain len %d\n", name, status,
  154.              GetLastError(), *sid_len, tmp);
  155.      if (status)
  156.          return ERROR_INTERNAL_ERROR;
  157.  
  158. +#if 1
  159. +       (*sid_len)+=128;
  160. +       tmp += 128;
  161. +#endif
  162. +
  163.      status = GetLastError();
  164.      switch(status) {
  165.      case ERROR_INSUFFICIENT_BUFFER:
  166. @@ -119,7 +236,7 @@ static int map_name_2_sid(DWORD *sid_len, PSID *sid, LPCSTR name)
  167.                                      &tmp, &sid_type);
  168.          free(tmp_buf);
  169.          if (!status) {
  170. -            eprintf("map_name_2_sid: LookupAccountName for %s failed "
  171. +            eprintf("map_name_2_sid(name='%s'): LookupAccountName failed "
  172.                      "with %d\n", name, GetLastError());
  173.              goto out_free_sid;
  174.          } else {
  175. @@ -140,15 +257,23 @@ static int map_name_2_sid(DWORD *sid_len, PSID *sid, LPCSTR name)
  176.          status = ERROR_SUCCESS;
  177.          break;
  178.      case ERROR_NONE_MAPPED:
  179. +        dprintf(1, "map_name_2_sid(name='%s'): none mapped, using WinNullSid mapping\n",
  180. +           name);
  181.          status = create_unknownsid(WinNullSid, sid, sid_len);
  182.          if (status)
  183.              goto out_free_sid;
  184. +       break;
  185. +    default:
  186. +        dprintf(1, "map_name_2_sid(name='%s'): error %d not handled\n",
  187. +           name, GetLastError());
  188. +       break;
  189.      }
  190.  out:
  191.      return status;
  192.  out_free_sid:
  193.      status = GetLastError();
  194.      free(*sid);
  195. +    *sid = NULL;
  196.      goto out;
  197.  }
  198.  
  199. @@ -798,4 +923,4 @@ const nfs41_upcall_op nfs41_op_setacl = {
  200.      parse_setacl,
  201.      handle_setacl,
  202.      marshall_setacl
  203. -};
  204. \ No newline at end of file
  205. +};

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at