[SCM] Samba Shared Repository - branch master updated
Jeremy Allison
jra at samba.org
Fri Oct 22 12:16:02 MDT 2010
The branch, master has been updated
via a8b9568 Wrap security_token_has_privilege() with a check for lp_enable_privileges(). Needed to maintain compatibility with smb.conf manpage.
via 3e79cd6 Fix const warning. Allocate off NULL as we always talloc_free().
from 2a00138 s4-dsdb/schema_syntax: Separate validation for numericoid OID values
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit a8b95686a7bde3f96f141b6938e24e101567ef54
Author: Jeremy Allison <jra at samba.org>
Date: Fri Oct 22 10:31:06 2010 -0700
Wrap security_token_has_privilege() with a check for lp_enable_privileges(). Needed
to maintain compatibility with smb.conf manpage.
Jeremy.
Autobuild-User: Jeremy Allison <jra at samba.org>
Autobuild-Date: Fri Oct 22 18:15:48 UTC 2010 on sn-devel-104
commit 3e79cd6856e5c76cc39ad2be68b40534a524cecd
Author: Jeremy Allison <jra at samba.org>
Date: Thu Oct 21 12:50:33 2010 -0700
Fix const warning. Allocate off NULL as we always talloc_free().
-----------------------------------------------------------------------
Summary of changes:
libcli/security/access_check.c | 2 +-
source3/include/proto.h | 1 +
source3/param/loadparm.c | 8 ++++++++
source3/printing/nt_printing.c | 2 +-
source3/registry/reg_backend_smbconf.c | 2 +-
source3/rpc_server/srv_samr_nt.c | 10 +++++-----
source3/rpc_server/srv_spoolss_nt.c | 18 +++++++++---------
source3/rpc_server/srv_srvsvc_nt.c | 8 ++++----
source3/rpc_server/srv_winreg_nt.c | 6 +++---
source3/rpc_server/srv_wkssvc_nt.c | 4 ++--
source3/smbd/open.c | 4 ++--
source3/smbd/posix_acls.c | 4 ++--
12 files changed, 39 insertions(+), 30 deletions(-)
Changeset truncated at 500 lines:
diff --git a/libcli/security/access_check.c b/libcli/security/access_check.c
index b0d4f4a..c5f89af 100644
--- a/libcli/security/access_check.c
+++ b/libcli/security/access_check.c
@@ -285,7 +285,7 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
uint32_t bits_remaining;
struct object_tree *node;
const struct GUID *type;
- struct dom_sid *ps_sid = dom_sid_parse_talloc(sd, SID_NT_SELF);
+ struct dom_sid *ps_sid = dom_sid_parse_talloc(NULL, SID_NT_SELF);
*access_granted = access_desired;
bits_remaining = access_desired;
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 6ce27b8..304fdb4 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -3586,6 +3586,7 @@ char* lp_perfcount_module(void);
void lp_set_passdb_backend(const char *backend);
void widelinks_warning(int snum);
char *lp_ncalrpc_dir(void);
+bool s3_security_token_has_privilege(const struct security_token *token, enum sec_privilege privilege);
/* The following definitions come from param/loadparm_server_role.c */
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 8dadebf..b11effd 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -10132,3 +10132,11 @@ bool lp_readraw(void)
}
return _lp_readraw();
}
+
+bool s3_security_token_has_privilege(const struct security_token *token, enum sec_privilege privilege)
+{
+ if (!lp_enable_privileges()) {
+ return false;
+ }
+ return security_token_has_privilege(token, privilege);
+}
diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index 84de565..026161b 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -2082,7 +2082,7 @@ bool print_access_check(const struct auth_serversupplied_info *server_info,
/* Always allow root or SE_PRINT_OPERATROR to do anything */
if (server_info->utok.uid == sec_initial_uid()
- || security_token_has_privilege(server_info->ptok, SEC_PRIV_PRINT_OPERATOR)) {
+ || s3_security_token_has_privilege(server_info->ptok, SEC_PRIV_PRINT_OPERATOR)) {
return True;
}
diff --git a/source3/registry/reg_backend_smbconf.c b/source3/registry/reg_backend_smbconf.c
index b96c73b..f638223 100644
--- a/source3/registry/reg_backend_smbconf.c
+++ b/source3/registry/reg_backend_smbconf.c
@@ -60,7 +60,7 @@ static bool smbconf_reg_access_check(const char *keyname, uint32 requested,
uint32 *granted,
const struct security_token *token)
{
- if (!security_token_has_privilege(token, SEC_PRIV_DISK_OPERATOR)) {
+ if (!s3_security_token_has_privilege(token, SEC_PRIV_DISK_OPERATOR)) {
return False;
}
diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index a04584e..c2bf13e 100644
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -200,8 +200,8 @@ NTSTATUS access_check_object( struct security_descriptor *psd, struct security_t
by privileges (mostly having to do with creating/modifying/deleting
users and groups) */
- if ((needed_priv_1 != SEC_PRIV_INVALID && security_token_has_privilege(token, needed_priv_1)) ||
- (needed_priv_2 != SEC_PRIV_INVALID && security_token_has_privilege(token, needed_priv_2))) {
+ if ((needed_priv_1 != SEC_PRIV_INVALID && s3_security_token_has_privilege(token, needed_priv_1)) ||
+ (needed_priv_2 != SEC_PRIV_INVALID && s3_security_token_has_privilege(token, needed_priv_2))) {
saved_mask = (des_access & rights_mask);
des_access &= ~saved_mask;
@@ -572,7 +572,7 @@ NTSTATUS _samr_OpenDomain(struct pipes_struct *p,
* Users with SeAddUser get the ability to manipulate groups
* and aliases.
*/
- if (security_token_has_privilege(p->server_info->ptok, SEC_PRIV_ADD_USERS)) {
+ if (s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_ADD_USERS)) {
extra_access |= (SAMR_DOMAIN_ACCESS_CREATE_GROUP |
SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
@@ -3845,13 +3845,13 @@ NTSTATUS _samr_CreateUser2(struct pipes_struct *p,
can_add_account = true;
} else if (acb_info & ACB_WSTRUST) {
needed_priv = SEC_PRIV_MACHINE_ACCOUNT;
- can_add_account = security_token_has_privilege(p->server_info->ptok, SEC_PRIV_MACHINE_ACCOUNT);
+ can_add_account = s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_MACHINE_ACCOUNT);
} else if (acb_info & ACB_NORMAL &&
(account[strlen(account)-1] != '$')) {
/* usrmgr.exe (and net rpc trustdom grant) creates a normal user
account for domain trusts and changes the ACB flags later */
needed_priv = SEC_PRIV_ADD_USERS;
- can_add_account = security_token_has_privilege(p->server_info->ptok, SEC_PRIV_ADD_USERS);
+ can_add_account = s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_ADD_USERS);
} else if (lp_enable_privileges()) {
/* implicit assumption of a BDC or domain trust account here
* (we already check the flags earlier) */
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 62725ee..a409a75 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -379,7 +379,7 @@ static WERROR delete_printer_hook(TALLOC_CTX *ctx, struct security_token *token,
return WERR_NOMEM;
}
if ( token )
- is_print_op = security_token_has_privilege(token, SEC_PRIV_PRINT_OPERATOR);
+ is_print_op = s3_security_token_has_privilege(token, SEC_PRIV_PRINT_OPERATOR);
DEBUG(10,("Running [%s]\n", command));
@@ -1790,7 +1790,7 @@ WERROR _spoolss_OpenPrinterEx(struct pipes_struct *p,
and not a printer admin, then fail */
if ((p->server_info->utok.uid != sec_initial_uid()) &&
- !security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR) &&
+ !s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR) &&
!token_contains_name_in_list(
uidtoname(p->server_info->utok.uid),
p->server_info->info3->base.domain.string,
@@ -2033,7 +2033,7 @@ WERROR _spoolss_DeletePrinterDriver(struct pipes_struct *p,
and not a printer admin, then fail */
if ( (p->server_info->utok.uid != sec_initial_uid())
- && !security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR)
+ && !s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR)
&& !token_contains_name_in_list(
uidtoname(p->server_info->utok.uid),
p->server_info->info3->base.domain.string,
@@ -2138,7 +2138,7 @@ WERROR _spoolss_DeletePrinterDriverEx(struct pipes_struct *p,
and not a printer admin, then fail */
if ( (p->server_info->utok.uid != sec_initial_uid())
- && !security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR)
+ && !s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR)
&& !token_contains_name_in_list(
uidtoname(p->server_info->utok.uid),
p->server_info->info3->base.domain.string,
@@ -6023,7 +6023,7 @@ static WERROR add_port_hook(TALLOC_CTX *ctx, struct security_token *token, const
}
if ( token )
- is_print_op = security_token_has_privilege(token, SEC_PRIV_PRINT_OPERATOR);
+ is_print_op = s3_security_token_has_privilege(token, SEC_PRIV_PRINT_OPERATOR);
DEBUG(10,("Running [%s]\n", command));
@@ -6080,7 +6080,7 @@ static bool add_printer_hook(TALLOC_CTX *ctx, struct security_token *token,
}
if ( token )
- is_print_op = security_token_has_privilege(token, SEC_PRIV_PRINT_OPERATOR);
+ is_print_op = s3_security_token_has_privilege(token, SEC_PRIV_PRINT_OPERATOR);
DEBUG(10,("Running [%s]\n", command));
@@ -8406,7 +8406,7 @@ WERROR _spoolss_AddForm(struct pipes_struct *p,
and not a printer admin, then fail */
if ((p->server_info->utok.uid != sec_initial_uid()) &&
- !security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR) &&
+ !s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR) &&
!token_contains_name_in_list(uidtoname(p->server_info->utok.uid),
p->server_info->info3->base.domain.string,
NULL,
@@ -8474,7 +8474,7 @@ WERROR _spoolss_DeleteForm(struct pipes_struct *p,
}
if ((p->server_info->utok.uid != sec_initial_uid()) &&
- !security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR) &&
+ !s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR) &&
!token_contains_name_in_list(uidtoname(p->server_info->utok.uid),
p->server_info->info3->base.domain.string,
NULL,
@@ -8538,7 +8538,7 @@ WERROR _spoolss_SetForm(struct pipes_struct *p,
and not a printer admin, then fail */
if ((p->server_info->utok.uid != sec_initial_uid()) &&
- !security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR) &&
+ !s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_PRINT_OPERATOR) &&
!token_contains_name_in_list(uidtoname(p->server_info->utok.uid),
p->server_info->info3->base.domain.string,
NULL,
diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c
index f59b972..fe557e9 100644
--- a/source3/rpc_server/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srv_srvsvc_nt.c
@@ -1572,7 +1572,7 @@ WERROR _srvsvc_NetShareSetInfo(struct pipes_struct *p,
if (lp_print_ok(snum))
return WERR_ACCESS_DENIED;
- is_disk_op = security_token_has_privilege(p->server_info->ptok, SEC_PRIV_DISK_OPERATOR);
+ is_disk_op = s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_DISK_OPERATOR);
/* fail out now if you are not root and not a disk op */
@@ -1774,7 +1774,7 @@ WERROR _srvsvc_NetShareAdd(struct pipes_struct *p,
*r->out.parm_error = 0;
}
- is_disk_op = security_token_has_privilege(p->server_info->ptok, SEC_PRIV_DISK_OPERATOR);
+ is_disk_op = s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_DISK_OPERATOR);
if (p->server_info->utok.uid != sec_initial_uid() && !is_disk_op )
return WERR_ACCESS_DENIED;
@@ -1967,7 +1967,7 @@ WERROR _srvsvc_NetShareDel(struct pipes_struct *p,
if (lp_print_ok(snum))
return WERR_ACCESS_DENIED;
- is_disk_op = security_token_has_privilege(p->server_info->ptok, SEC_PRIV_DISK_OPERATOR);
+ is_disk_op = s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_DISK_OPERATOR);
if (p->server_info->utok.uid != sec_initial_uid() && !is_disk_op )
return WERR_ACCESS_DENIED;
@@ -2519,7 +2519,7 @@ WERROR _srvsvc_NetFileClose(struct pipes_struct *p,
DEBUG(5,("_srvsvc_NetFileClose: %d\n", __LINE__));
- is_disk_op = security_token_has_privilege(p->server_info->ptok, SEC_PRIV_DISK_OPERATOR);
+ is_disk_op = s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_DISK_OPERATOR);
if (p->server_info->utok.uid != sec_initial_uid() && !is_disk_op) {
return WERR_ACCESS_DENIED;
diff --git a/source3/rpc_server/srv_winreg_nt.c b/source3/rpc_server/srv_winreg_nt.c
index 298f33a..44cdfcb 100644
--- a/source3/rpc_server/srv_winreg_nt.c
+++ b/source3/rpc_server/srv_winreg_nt.c
@@ -577,7 +577,7 @@ WERROR _winreg_InitiateSystemShutdownEx(struct pipes_struct *p,
return WERR_NOMEM;
}
- can_shutdown = security_token_has_privilege(p->server_info->ptok, SEC_PRIV_REMOTE_SHUTDOWN);
+ can_shutdown = s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_REMOTE_SHUTDOWN);
/* IF someone has privs, run the shutdown script as root. OTHERWISE run it as not root
Take the error return from the script and provide it as the Windows return code. */
@@ -614,7 +614,7 @@ WERROR _winreg_AbortSystemShutdown(struct pipes_struct *p,
if (!*abort_shutdown_script)
return WERR_ACCESS_DENIED;
- can_shutdown = security_token_has_privilege(p->server_info->ptok, SEC_PRIV_REMOTE_SHUTDOWN);
+ can_shutdown = s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_REMOTE_SHUTDOWN);
/********** BEGIN SeRemoteShutdownPrivilege BLOCK **********/
@@ -704,7 +704,7 @@ WERROR _winreg_RestoreKey(struct pipes_struct *p,
/* user must posses SeRestorePrivilege for this this proceed */
- if ( !security_token_has_privilege(p->server_info->ptok, SEC_PRIV_RESTORE)) {
+ if ( !s3_security_token_has_privilege(p->server_info->ptok, SEC_PRIV_RESTORE)) {
return WERR_ACCESS_DENIED;
}
diff --git a/source3/rpc_server/srv_wkssvc_nt.c b/source3/rpc_server/srv_wkssvc_nt.c
index 000b605..aa30d14 100644
--- a/source3/rpc_server/srv_wkssvc_nt.c
+++ b/source3/rpc_server/srv_wkssvc_nt.c
@@ -823,7 +823,7 @@ WERROR _wkssvc_NetrJoinDomain2(struct pipes_struct *p,
return WERR_INVALID_PARAM;
}
- if (!security_token_has_privilege(token, SEC_PRIV_MACHINE_ACCOUNT) &&
+ if (!s3_security_token_has_privilege(token, SEC_PRIV_MACHINE_ACCOUNT) &&
!nt_token_check_domain_rid(token, DOMAIN_RID_ADMINS) &&
!nt_token_check_sid(&global_sid_Builtin_Administrators, token)) {
DEBUG(5,("_wkssvc_NetrJoinDomain2: account doesn't have "
@@ -894,7 +894,7 @@ WERROR _wkssvc_NetrUnjoinDomain2(struct pipes_struct *p,
return WERR_INVALID_PARAM;
}
- if (!security_token_has_privilege(token, SEC_PRIV_MACHINE_ACCOUNT) &&
+ if (!s3_security_token_has_privilege(token, SEC_PRIV_MACHINE_ACCOUNT) &&
!nt_token_check_domain_rid(token, DOMAIN_RID_ADMINS) &&
!nt_token_check_sid(&global_sid_Builtin_Administrators, token)) {
DEBUG(5,("_wkssvc_NetrUnjoinDomain2: account doesn't have "
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index f5de607..b19aad9 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -2507,7 +2507,7 @@ static NTSTATUS open_directory(connection_struct *conn,
}
if ((access_mask & SEC_FLAG_SYSTEM_SECURITY) &
- !security_token_has_privilege(get_current_nttok(conn),
+ !s3_security_token_has_privilege(get_current_nttok(conn),
SEC_PRIV_SECURITY)) {
DEBUG(10, ("open_directory: open on %s "
"failed - SEC_FLAG_SYSTEM_SECURITY denied.\n",
@@ -3031,7 +3031,7 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
}
if ((access_mask & SEC_FLAG_SYSTEM_SECURITY) &&
- !security_token_has_privilege(get_current_nttok(conn),
+ !s3_security_token_has_privilege(get_current_nttok(conn),
SEC_PRIV_SECURITY)) {
DEBUG(10, ("create_file_unixpath: open on %s "
"failed - SEC_FLAG_SYSTEM_SECURITY denied.\n",
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 54fa5bf..4633b48 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -3556,8 +3556,8 @@ int try_chown(connection_struct *conn, struct smb_filename *smb_fname,
/* Case (2) / (3) */
if (lp_enable_privileges()) {
- bool has_take_ownership_priv = security_token_has_privilege(get_current_nttok(conn), SEC_PRIV_TAKE_OWNERSHIP);
- bool has_restore_priv = security_token_has_privilege(get_current_nttok(conn), SEC_PRIV_RESTORE);
+ bool has_take_ownership_priv = s3_security_token_has_privilege(get_current_nttok(conn), SEC_PRIV_TAKE_OWNERSHIP);
+ bool has_restore_priv = s3_security_token_has_privilege(get_current_nttok(conn), SEC_PRIV_RESTORE);
/* Case (2) */
if ( ( has_take_ownership_priv && ( uid == get_current_uid(conn) ) ) ||
--
Samba Shared Repository
More information about the samba-cvs
mailing list