pastebin - collaborative debugging tool
rovema.kpaste.net RSS


msnfs41client: Prototype uid2sid mapping, try #001
Posted by Anonymous on Fri 6th Oct 2023 11:40
raw | new post
modification of post by Anonymous (view diff)

  1. diff --git a/daemon/acl.c b/daemon/acl.c
  2. index 3a86735..80287e1 100644
  3. --- a/daemon/acl.c
  4. +++ b/daemon/acl.c
  5. @@ -60,19 +60,28 @@ static int create_unknownsid(WELL_KNOWN_SID_TYPE type, PSID *sid,
  6.      dprintf(ACLLVL, "create_unknownsid: CreateWellKnownSid type %d returned %d "
  7.              "GetLastError %d sid len %d needed\n", type, status,
  8.              GetLastError(), *sid_len);
  9. -    if (status)
  10. -        return ERROR_INTERNAL_ERROR;
  11. +    if (status) {
  12. +        status = ERROR_INTERNAL_ERROR;
  13. +       goto err;
  14. +    }
  15.      status = GetLastError();
  16. -    if (status != ERROR_INSUFFICIENT_BUFFER)
  17. -        return status;
  18. +    if (status != ERROR_INSUFFICIENT_BUFFER)
  19. +        goto err;
  20. +#if 1
  21. +(*sid_len) += 128;
  22. +#endif
  23.      *sid = malloc(*sid_len);
  24. -    if (*sid == NULL)
  25. -        return ERROR_INSUFFICIENT_BUFFER;
  26. +    if (*sid == NULL) {
  27. +        status = ERROR_INSUFFICIENT_BUFFER;
  28. +        goto err;
  29. +    }
  30.      status = CreateWellKnownSid(type, NULL, *sid, sid_len);
  31. -    if (status)
  32. +    if (status)
  33.          return ERROR_SUCCESS;
  34.      free(*sid);
  35. +    *sid = NULL;
  36.      status = GetLastError();
  37. +err:
  38.      eprintf("create_unknownsid: CreateWellKnownSid failed with %d\n", status);
  39.      return status;
  40.  }
  41. @@ -90,20 +99,223 @@ static void convert_nfs4name_2_user_domain(LPSTR nfs4name,
  42.      }
  43.  }
  44.  
  45. -static int map_name_2_sid(DWORD *sid_len, PSID *sid, LPCSTR name)
  46. +/*
  47. + * Allocate a SID from SECURITY_SAMBA_UNIX_AUTHORITY, which encodes an
  48. + * UNIX/POSIX uid directly into a SID.
  49. + *
  50. + * Examples:
  51. + * UID 1616 gets mapped to "Unix_User+1616", encoding the UID into the
  52. + * SID as "S-1-22-1-1616":
  53. + * $ getent passwd Unix_User+1616
  54. + * Unix_User+1616:*:4278191696:4278191696:U-Unix_User616,S-1-22-1-1616:/:/sbin/nologin
  55. + *
  56. + * GID 1984 gets mapped to "Unix_Group+1984", encoding the GID into the
  57. + * SID as "S-1-22-2-1984":
  58. + * $ getent group Unix_Group+1984
  59. + * Unix_Group+1984:S-1-22-2-1984:4278192064:
  60. + *
  61. + */
  62. +
  63. +#define SECURITY_SAMBA_UNIX_AUTHORITY { { 0,0,0,0,0,22 } }
  64. +SID_IDENTIFIER_AUTHORITY sid_id_auth = SECURITY_SAMBA_UNIX_AUTHORITY;
  65. +
  66. +static
  67. +BOOL allocate_unixuser_sid(unsigned long uid, PSID *pSid)
  68. +{
  69. +    PSID sid = NULL;
  70. +    PSID malloced_sid = NULL;
  71. +    DWORD sid_len;
  72. +
  73. +    if (AllocateAndInitializeSid(&sid_id_auth, 2, 1, (DWORD)uid,
  74. +        0, 0, 0, 0, 0, 0, &sid)) {
  75. +        sid_len = GetLengthSid(sid);
  76. +#if 1
  77. +sid_len += 128;
  78. +#endif
  79. +       malloced_sid = malloc(sid_len);
  80. +
  81. +       if (malloced_sid) {
  82. +           /*
  83. +            * |AllocateAndInitializeSid()| has an own memory
  84. +            * allocator, but we need the sid in memory from
  85. +            * |malloc()|
  86. +            */
  87. +           if (CopySid(sid_len, malloced_sid, sid)) {
  88. +               FreeSid(sid);
  89. +               *pSid = malloced_sid;
  90. +                dprintf(ACLLVL, "allocate_unixuser_sid(): Allocated "
  91. +                   "Unix_User+%lu: success, len=%ld\n",
  92. +                   uid, (long)sid_len);
  93. +                return TRUE;
  94. +           }
  95. +       }
  96. +    }
  97. +
  98. +    FreeSid(sid);
  99. +    free(malloced_sid);
  100. +    dprintf(ACLLVL, "allocate_unixuser_sid(): Failed to allocate "
  101. +        "SID for Unix_User+%lu: error code %d\n",
  102. +        uid, GetLastError());
  103. +    return FALSE;
  104. +}
  105. +
  106. +static
  107. +BOOL allocate_unixgroup_sid(unsigned long gid, PSID *pSid)
  108. +{
  109. +    PSID sid = NULL;
  110. +    PSID malloced_sid = NULL;
  111. +    DWORD sid_len;
  112. +
  113. +    if (AllocateAndInitializeSid(&sid_id_auth, 2, 2, (DWORD)gid,
  114. +        0, 0, 0, 0, 0, 0, &sid)) {
  115. +        sid_len = GetLengthSid(sid);
  116. +#if 1
  117. +sid_len += 128;
  118. +#endif
  119. +       malloced_sid = malloc(sid_len);
  120. +
  121. +       if (malloced_sid) {
  122. +           /*
  123. +            * |AllocateAndInitializeSid()| has an own memory
  124. +            * allocator, but we need the sid in memory from
  125. +            * |malloc()|
  126. +            */
  127. +           if (CopySid(sid_len, malloced_sid, sid)) {
  128. +               FreeSid(sid);
  129. +               *pSid = malloced_sid;
  130. +                dprintf(ACLLVL, "allocate_unixgroup_sid(): Allocated "
  131. +                   "Unix_Group+%lu: success, len=%ld\n",
  132. +                   gid, (long)sid_len);
  133. +                return TRUE;
  134. +           }
  135. +       }
  136. +    }
  137. +
  138. +    FreeSid(sid);
  139. +    free(malloced_sid);
  140. +    dprintf(ACLLVL, "allocate_unixgroup_sid(): Failed to allocate "
  141. +        "SID for Unix_Group+%lu: error code %d\n",
  142. +        gid, GetLastError());
  143. +    return FALSE;
  144. +}
  145. +
  146. +static int map_name_2_sid(int query, DWORD *sid_len, PSID *sid, LPCSTR name)
  147.  {
  148.      int status = ERROR_INTERNAL_ERROR;
  149.      SID_NAME_USE sid_type;
  150.      LPSTR tmp_buf = NULL;
  151.      DWORD tmp = 0;
  152. +    signed long user_uid = -1;
  153. +    signed long group_gid = -1;
  154. +
  155. +    if (query & OWNER_SECURITY_INFORMATION) {
  156. +        if (isdigit(name[0])) {
  157. +            user_uid = atol(name);
  158. +        }
  159. +        else if(!strcmp(name, "nobody")) {
  160. +            user_uid = 65534;
  161. +        }
  162. +        else if(!strcmp(name, "root")) {
  163. +            user_uid = 0;
  164. +        }
  165. +        else if(!strcmp(name, "rmainz")) {
  166. +            user_uid = 1616;
  167. +        }
  168. +        else if(!strcmp(name, "swulsch")) {
  169. +            user_uid = 1818;
  170. +        }
  171. +        else if(!strcmp(name, "mwenzel")) {
  172. +            user_uid = 8239;
  173. +        }
  174. +        else if(!strcmp(name, "test001")) {
  175. +            user_uid = 1000;
  176. +        }
  177. +    }
  178. +
  179. +    if (query & GROUP_SECURITY_INFORMATION) {
  180. +        if (isdigit(name[0])) {
  181. +            group_gid = atol(name);
  182. +        }
  183. +        else if(!strcmp(name, "nobody")) {
  184. +            group_gid = 65534;
  185. +        }
  186. +        else if(!strcmp(name, "root")) {
  187. +            group_gid = 0;
  188. +        }
  189. +        else if(!strcmp(name, "rmainz")) {
  190. +            group_gid = 1616;
  191. +        }
  192. +        else if(!strcmp(name, "swulsch")) {
  193. +            group_gid = 1818;
  194. +        }
  195. +        else if(!strcmp(name, "mwenzel")) {
  196. +            group_gid = 8239;
  197. +        }
  198. +        else if(!strcmp(name, "test001")) {
  199. +            group_gid = 1000;
  200. +        }
  201. +    }
  202. +
  203. +    if (user_uid != -1) {
  204. +        switch (user_uid) {
  205. +            case 1000:
  206. +            case 197608:
  207. +                dprintf(ACLLVL, "map_name_2_sid(query=%x,name='%s'): "
  208. +                   "remap %ld to 'roland_mainz'\n", query, name, user_uid);
  209. +                name = "roland_mainz";
  210. +                break;
  211. +            default:
  212. +                if (allocate_unixuser_sid(user_uid, sid)) {
  213. +                    dprintf(ACLLVL, "map_name_2_sid(query=%x,name='%s'): "
  214. +                       "allocate_unixuser_sid(uid=%ld) success\n",
  215. +                       query, name, user_uid);
  216. +                   return ERROR_SUCCESS;
  217. +               }
  218. +
  219. +                status = GetLastError();
  220. +                dprintf(ACLLVL, "map_name_2_sid(query=%x,name='%s'): "
  221. +                   "allocate_unixuser_sid(uid=%ld) failed, error=%d\n",
  222. +                   query, name, user_uid, status);
  223. +               return status;
  224. +        }
  225. +    }
  226. +
  227. +    if (group_gid != -1) {
  228. +        switch (group_gid) {
  229. +            case 1000:
  230. +            case 197121: /* Win10 group "Kein" == gid(197121) */
  231. +                dprintf(ACLLVL, "map_name_2_sid(query=%x,name='%s'): "
  232. +                   "remap %ld to 'Kein'\n", query, name, group_gid);
  233. +                name = "Kein";
  234. +                break;
  235. +            default:
  236. +                if (allocate_unixgroup_sid(group_gid, sid)) {
  237. +                    dprintf(ACLLVL, "map_name_2_sid(query=%x,name='%s'): "
  238. +                       "allocate_unixgroup_sid(gid=%ld) success\n",
  239. +                       query, name, group_gid);
  240. +                   return ERROR_SUCCESS;
  241. +               }
  242. +
  243. +                status = GetLastError();
  244. +                dprintf(ACLLVL, "map_name_2_sid(query=%x,name='%s'): "
  245. +                   "allocate_unixgroup_sid(gid=%ld) failed, error=%d\n",
  246. +                   query, name, group_gid, status);
  247. +               return status;
  248. +        }
  249. +    }
  250.  
  251.      status = LookupAccountName(NULL, name, NULL, sid_len, NULL, &tmp, &sid_type);
  252. -    dprintf(ACLLVL, "map_name_2_sid: LookupAccountName for %s returned %d "
  253. -            "GetLastError %d name len %d domain len %d\n", name, status,
  254. -            GetLastError(), *sid_len, tmp);
  255. +    dprintf(ACLLVL, "map_name_2_sid(query=%x,name='%s'): LookupAccountName returned %d "
  256. +            "GetLastError %d name len %d domain len %d\n",
  257. +           query, name, status, GetLastError(), *sid_len, tmp);
  258.      if (status)
  259.          return ERROR_INTERNAL_ERROR;
  260.  
  261. +#if 1
  262. +       (*sid_len)+=128;
  263. +       tmp += 128;
  264. +#endif
  265. +
  266.      status = GetLastError();
  267.      switch(status) {
  268.      case ERROR_INSUFFICIENT_BUFFER:
  269. @@ -119,8 +331,8 @@ static int map_name_2_sid(DWORD *sid_len, PSID *sid, LPCSTR name)
  270.                                      &tmp, &sid_type);
  271.          free(tmp_buf);
  272.          if (!status) {
  273. -            eprintf("map_name_2_sid: LookupAccountName for %s failed "
  274. -                    "with %d\n", name, GetLastError());
  275. +            eprintf("map_name_2_sid(query=%x,name='%s'): LookupAccountName failed "
  276. +                    "with %d\n", query, name, GetLastError());
  277.              goto out_free_sid;
  278.          } else {
  279.  #ifdef DEBUG_ACLS
  280. @@ -140,15 +352,23 @@ static int map_name_2_sid(DWORD *sid_len, PSID *sid, LPCSTR name)
  281.          status = ERROR_SUCCESS;
  282.          break;
  283.      case ERROR_NONE_MAPPED:
  284. +        dprintf(1, "map_name_2_sid(query=%x,name='%s'): none mapped, using WinNullSid mapping\n",
  285. +           query, name);
  286.          status = create_unknownsid(WinNullSid, sid, sid_len);
  287.          if (status)
  288.              goto out_free_sid;
  289. +       break;
  290. +    default:
  291. +        dprintf(1, "map_name_2_sid(query=%x,name='%s'): error %d not handled\n",
  292. +           query, name, GetLastError());
  293. +       break;
  294.      }
  295.  out:
  296.      return status;
  297.  out_free_sid:
  298.      status = GetLastError();
  299.      free(*sid);
  300. +    *sid = NULL;
  301.      goto out;
  302.  }
  303.  
  304. @@ -208,7 +428,8 @@ static int convert_nfs4acl_2_dacl(nfsacl41 *acl, int file_type,
  305.              goto out;
  306.          }
  307.          if (!flag) {
  308. -            status = map_name_2_sid(&sid_len, &sids[i], acl->aces[i].who);
  309. +            status = map_name_2_sid(0xFFFF /* fixme: Unknown whether user or group */,
  310. +               &sid_len, &sids[i], acl->aces[i].who);
  311.              if (status) {
  312.                  free_sids(sids, i);
  313.                  goto out;
  314. @@ -322,7 +543,7 @@ static int handle_getacl(nfs41_upcall *upcall)
  315.          dprintf(ACLLVL, "handle_getacl: OWNER_SECURITY_INFORMATION: for user=%s "
  316.                  "domain=%s\n", info.owner, domain?domain:"<null>");
  317.          sid_len = 0;
  318. -        status = map_name_2_sid(&sid_len, &osid, info.owner);
  319. +        status = map_name_2_sid(OWNER_SECURITY_INFORMATION, &sid_len, &osid, info.owner);
  320.          if (status)
  321.              goto out;
  322.          status = SetSecurityDescriptorOwner(&sec_desc, osid, TRUE);
  323. @@ -333,12 +554,13 @@ static int handle_getacl(nfs41_upcall *upcall)
  324.              goto out;
  325.          }
  326.      }
  327. +
  328.      if (args->query & GROUP_SECURITY_INFORMATION) {
  329.          convert_nfs4name_2_user_domain(info.owner_group, &domain);
  330.          dprintf(ACLLVL, "handle_getacl: GROUP_SECURITY_INFORMATION: for %s "
  331.                  "domain=%s\n", info.owner_group, domain?domain:"<null>");
  332.          sid_len = 0;
  333. -        status = map_name_2_sid(&sid_len, &gsid, info.owner_group);
  334. +        status = map_name_2_sid(GROUP_SECURITY_INFORMATION, &sid_len, &gsid, info.owner_group);
  335.          if (status)
  336.              goto out;
  337.          status = SetSecurityDescriptorGroup(&sec_desc, gsid, TRUE);
  338. @@ -798,4 +1020,4 @@ const nfs41_upcall_op nfs41_op_setacl = {
  339.      parse_setacl,
  340.      handle_setacl,
  341.      marshall_setacl
  342. -};
  343. \ No newline at end of file
  344. +};

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at