rovema.kpaste.net RSS
Difference between
modified post 3dcc1b6 by Anonymous on Fri 6th Oct 2023 11:40
original post 20c803b87 by Anonymous on Thu 5th Oct 2023 13:32
Download diff
Show
old version |
new version |
both versions
| 1 | 1 | diff --git a/daemon/acl.c b/daemon/acl.c | |
| 2 | - | index 3a86735..1145011 100644 | |
| 2 | + | index 3a86735..80287e1 100644 | |
| 3 | 3 | --- a/daemon/acl.c | |
| 4 | 4 | +++ b/daemon/acl.c | |
| 5 | - | @@ -60,11 +60,16 @@ static int create_unknownsid(WELL_KNOWN_SID_TYPE type, PSID *sid, | |
| 5 | + | @@ -60,19 +60,28 @@ static int create_unknownsid(WELL_KNOWN_SID_TYPE type, PSID *sid, | |
| 6 | 6 | dprintf(ACLLVL, "create_unknownsid: CreateWellKnownSid type %d returned %d " | |
| 7 | 7 | "GetLastError %d sid len %d needed\n", type, status, | |
| 8 | 8 | GetLastError(), *sid_len); | |
| 9 | 9 | - if (status) | |
| 10 | 10 | - return ERROR_INTERNAL_ERROR; | |
| 11 | 11 | + if (status) { | |
| 12 | 12 | + status = ERROR_INTERNAL_ERROR; | |
| 13 | 13 | + goto err; | |
| 14 | 14 | + } | |
| 15 | 15 | status = GetLastError(); | |
| 16 | - | if (status != ERROR_INSUFFICIENT_BUFFER) | |
| 16 | + | - if (status != ERROR_INSUFFICIENT_BUFFER) | |
| 17 | 17 | - return status; | |
| 18 | - | + goto err; | |
| 18 | + | + if (status != ERROR_INSUFFICIENT_BUFFER) | |
| 19 | + | + goto err; | |
| 19 | 20 | +#if 1 | |
| 20 | 21 | +(*sid_len) += 128; | |
| 21 | 22 | +#endif | |
| 22 | 23 | *sid = malloc(*sid_len); | |
| 23 | - | if (*sid == NULL) | |
| 24 | + | - if (*sid == NULL) | |
| 24 | - | return ERROR_INSUFFICIENT_BUFFER; | |
| 25 | + | - return ERROR_INSUFFICIENT_BUFFER; | |
| 25 | - | @@ -73,6 +78,7 @@ static int create_unknownsid(WELL_KNOWN_SID_TYPE type, PSID *sid, | |
| 26 | + | + if (*sid == NULL) { | |
| 27 | + | + status = ERROR_INSUFFICIENT_BUFFER; | |
| 26 | 33 | return ERROR_SUCCESS; | |
| 27 | 34 | free(*sid); | |
| 35 | + | + *sid = NULL; | |
| 28 | 36 | status = GetLastError(); | |
| 29 | 37 | +err: | |
| 30 | 38 | eprintf("create_unknownsid: CreateWellKnownSid failed with %d\n", status); | |
| 31 | 39 | return status; | |
| 32 | 40 | } | |
| 33 | - | @@ -90,20 +96,131 @@ static void convert_nfs4name_2_user_domain(LPSTR nfs4name, | |
| 41 | + | @@ -90,20 +99,223 @@ static void convert_nfs4name_2_user_domain(LPSTR nfs4name, | |
| 34 | 42 | } | |
| 35 | 43 | } | |
| 36 | 44 | ||
| 45 | + | -static int map_name_2_sid(DWORD *sid_len, PSID *sid, LPCSTR name) | |
| 37 | 46 | +/* | |
| 38 | 47 | + * Allocate a SID from SECURITY_SAMBA_UNIX_AUTHORITY, which encodes an | |
| 39 | 48 | + * UNIX/POSIX uid directly into a SID. | |
| 40 | 49 | + * | |
| 41 | - | + * Example: | |
| 50 | + | + * Examples: | |
| 42 | 51 | + * UID 1616 gets mapped to "Unix_User+1616", encoding the UID into the | |
| 43 | - | + * SID as "S-1-22-1-1616" | |
| 52 | + | + * SID as "S-1-22-1-1616": | |
| 44 | 53 | + * $ getent passwd Unix_User+1616 | |
| 45 | 54 | + * Unix_User+1616:*:4278191696:4278191696:U-Unix_User\1616,S-1-22-1-1616:/:/sbin/nologin | |
| 46 | 55 | + * | |
| 56 | + | + * GID 1984 gets mapped to "Unix_Group+1984", encoding the GID into the | |
| 47 | 61 | + */ | |
| 48 | 62 | + | |
| 50 | 63 | +#define SECURITY_SAMBA_UNIX_AUTHORITY { { 0,0,0,0,0,22 } } | |
| 51 | 64 | +SID_IDENTIFIER_AUTHORITY sid_id_auth = SECURITY_SAMBA_UNIX_AUTHORITY; | |
| 52 | 65 | + | |
| 53 | - | +BOOL AllocateUnixUserSID(unsigned long uid, PSID *pSid) | |
| 66 | + | +static | |
| 67 | + | +BOOL allocate_unixuser_sid(unsigned long uid, PSID *pSid) | |
| 54 | 68 | +{ | |
| 55 | 69 | + PSID sid = NULL; | |
| 56 | 70 | + PSID malloced_sid = NULL; | |
| 57 | 71 | + DWORD sid_len; | |
| 58 | 72 | + | |
| 59 | 73 | + if (AllocateAndInitializeSid(&sid_id_auth, 2, 1, (DWORD)uid, | |
| 60 | 74 | + 0, 0, 0, 0, 0, 0, &sid)) { | |
| 61 | 75 | + sid_len = GetLengthSid(sid); | |
| 62 | 76 | +#if 1 | |
| 63 | 77 | +sid_len += 128; | |
| 64 | 78 | +#endif | |
| 65 | 79 | + malloced_sid = malloc(sid_len); | |
| 66 | 80 | + | |
| 67 | 81 | + if (malloced_sid) { | |
| 68 | 82 | + /* | |
| 69 | 83 | + * |AllocateAndInitializeSid()| has an own memory | |
| 70 | 84 | + * allocator, but we need the sid in memory from | |
| 71 | 85 | + * |malloc()| | |
| 72 | 86 | + */ | |
| 73 | 87 | + if (CopySid(sid_len, malloced_sid, sid)) { | |
| 74 | 88 | + FreeSid(sid); | |
| 75 | 89 | + *pSid = malloced_sid; | |
| 76 | - | + dprintf(ACLLVL, "AllocateUnixUserSID(): Allocated " | |
| 90 | + | + dprintf(ACLLVL, "allocate_unixuser_sid(): Allocated " | |
| 77 | 91 | + "Unix_User+%lu: success, len=%ld\n", | |
| 78 | 92 | + uid, (long)sid_len); | |
| 79 | 93 | + return TRUE; | |
| 80 | 94 | + } | |
| 81 | 95 | + } | |
| 82 | 96 | + } | |
| 83 | 97 | + | |
| 84 | 98 | + FreeSid(sid); | |
| 85 | 99 | + free(malloced_sid); | |
| 86 | - | + dprintf(ACLLVL, "AllocateUnixUserSID(): Failed to allocate " | |
| 100 | + | + dprintf(ACLLVL, "allocate_unixuser_sid(): Failed to allocate " | |
| 87 | - | + "Unix_User+%lu: error code %d\n", | |
| 101 | + | + "SID for Unix_User+%lu: error code %d\n", | |
| 88 | 102 | + uid, GetLastError()); | |
| 89 | 103 | + return FALSE; | |
| 90 | 104 | +} | |
| 91 | 105 | + | |
| 92 | - | static int map_name_2_sid(DWORD *sid_len, PSID *sid, LPCSTR name) | |
| 106 | + | +static | |
| 93 | - | { | |
| 107 | + | +BOOL allocate_unixgroup_sid(unsigned long gid, PSID *pSid) | |
| 94 | - | int status = ERROR_INTERNAL_ERROR; | |
| 108 | + | +{ | |
| 95 | - | SID_NAME_USE sid_type; | |
| 109 | + | + PSID sid = NULL; | |
| 96 | - | LPSTR tmp_buf = NULL; | |
| 110 | + | + PSID malloced_sid = NULL; | |
| 97 | - | DWORD tmp = 0; | |
| 111 | + | + DWORD sid_len; | |
| 99 | 112 | + | |
| 100 | - | + if (isdigit(name[0])) { | |
| 113 | + | + if (AllocateAndInitializeSid(&sid_id_auth, 2, 2, (DWORD)gid, | |
| 101 | - | + /* fixme: |name| can be a group name, too */ | |
| 114 | + | + 0, 0, 0, 0, 0, 0, &sid)) { | |
| 102 | - | + name_uid = atol(name); | |
| 115 | + | + sid_len = GetLengthSid(sid); | |
| 103 | - | + } | |
| 116 | + | +#if 1 | |
| 104 | - | + else if(!strcmp(name, "nobody")) { | |
| 117 | + | +sid_len += 128; | |
| 105 | - | + name_uid = 65534; | |
| 118 | + | +#endif | |
| 106 | - | + } | |
| 119 | + | + malloced_sid = malloc(sid_len); | |
| 107 | - | + else if(!strcmp(name, "nogroup")) { | |
| 120 | + | + | |
| 108 | - | + name_uid = 65534; | |
| 121 | + | + if (malloced_sid) { | |
| 109 | - | + } | |
| 122 | + | + /* | |
| 110 | - | + else if(!strcmp(name, "root")) { | |
| 123 | + | + * |AllocateAndInitializeSid()| has an own memory | |
| 111 | - | + name_uid = 0; | |
| 124 | + | + * allocator, but we need the sid in memory from | |
| 112 | - | + } | |
| 125 | + | + * |malloc()| | |
| 113 | - | + else if(!strcmp(name, "rmainz")) { | |
| 126 | + | + */ | |
| 114 | - | + name_uid = 1616; | |
| 127 | + | + if (CopySid(sid_len, malloced_sid, sid)) { | |
| 128 | + | + FreeSid(sid); | |
| 115 | 136 | + } | |
| 124 | - | + } | |
| 137 | + | + |
Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.