Proposal for changes in become root

[Ralph Boehme]

On 4/22/24 12:46, Xavi Hernandez wrote:
> I've just started to take a look, but if I understand it correctly, the 
> user credentials will be set just before doing the system call.

exactly.

> I've not 
> seen any reference to become_root() (I may have missed something, 
> though),

that part is not implemented yet, so far there's only the root 
impersonation object in the struct samba_impersonation. This still needs 
to be fleshed out in samba_impersonation_create().

Iirc we'd then have a new function like samba_root_impersonation() then 
checks imp->is_become_root and either returns imp or imp->become_root.

In places were we currently call become_root(), we'd then call root_imp 
= samba_root_impersonation() and pass root_imp to the function we want 
to execute as root.

Note that we'll likely also have to bite the bullet and properly handle 
capabilities instead of using [set|drop]_effective_capability(). To do 
this we somehow need to track the current and modified set of 
capabilities in the impersonation objects.

> but I guess it needs to integrate with that and, in this case, 
> it won't issue any syscalls to change the current process owner, right ?
> 
> That approach could be very useful for what I really wanted to do. If I 
> see it correctly, the credentials switch happens in vfs_default, so 
> modules are free to implement the credentials as they want.

yes.

In the end you would cache your own impersonation tokens in a cache 
associated with the main impersonation object cache id 
(samba_impersonation_cache_id()), using a talloc destructor on an object 
that is a talloc child of the impersonation object and removes the VFS 
module token from the VFS module cache.

Makes sense?

Cheers!
-slow
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20240422/9f786817/OpenPGP_signature.sig>