[SCM] Samba Shared Repository - branch master updated
Jeremy Allison
jra at samba.org
Mon Oct 12 23:15:05 UTC 2015
The branch, master has been updated
via 0ef9c67 s3:locking: initialize lease pointer in share_mode_traverse_fn()
via cd0c2a5 s3:smbstatus: add stream name to share_entry_forall()
via d643aaf s3:smbd: remove unused arg oplock_request
via 3c00e8d pam_smbpass: REMOVE this PAM module
from 8807ad1 dynconfig: Fix deps, no talloc required
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 0ef9c67b56a0b493ed06f9a64ac2bc2233041aee
Author: Ralph Boehme <slow at samba.org>
Date: Mon Oct 12 12:28:04 2015 +0200
s3:locking: initialize lease pointer in share_mode_traverse_fn()
Initialize lease pointer to point to the share_mode_data leases array
entry at index lease_idx.
This fixes a bug in smbstatus where the lease info is not printed.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11549
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
Autobuild-User(master): Jeremy Allison <jra at samba.org>
Autobuild-Date(master): Tue Oct 13 01:14:09 CEST 2015 on sn-devel-104
commit cd0c2a5eca43cea76491ae0d820414287c234c1a
Author: Ralph Boehme <slow at samba.org>
Date: Sun Oct 11 09:38:18 2015 +0200
s3:smbstatus: add stream name to share_entry_forall()
Add stream name argument to share_entry_forall machinery so smbstatus
can print the stream name of a file.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11550
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit d643aafe59738890cb8b71e2e865c56ea1fe6539
Author: Ralph Boehme <slow at samba.org>
Date: Wed Oct 7 14:28:32 2015 +0200
s3:smbd: remove unused arg oplock_request
The use of oplock_request in calculate_open_access_flags() was removed
in 196da5925.
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit 3c00e8d76a2ef6194a8ce522c15853e5b8e9262b
Author: Andrew Bartlett <abartlet at samba.org>
Date: Sat Oct 10 08:45:41 2015 +1300
pam_smbpass: REMOVE this PAM module
This pam module causes GPLv3, thread-unsafe Samba code to be directly loaded
into the address space of many system services. The code in question was not
expected to run in this context, and while using the Samba, rather than the system
password file is a admirable goal, this needs to be done over inter-process
communication, such as is done by pam_winbind.
pam_winbind is not a total replacement, as the migrate functionality used
to keep the Samba password up to date with the system password is not
present, but otherwise can provide essentially the same services.
Andrew Bartlett
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
-----------------------------------------------------------------------
Summary of changes:
source3/locking/proto.h | 3 +-
source3/locking/share_mode_lock.c | 21 +-
source3/pam_smbpass/CHANGELOG | 31 --
source3/pam_smbpass/INSTALL | 64 ---
source3/pam_smbpass/README | 68 ---
source3/pam_smbpass/TODO | 7 -
source3/pam_smbpass/general.h | 134 -----
source3/pam_smbpass/pam_smb_acct.c | 150 ------
source3/pam_smbpass/pam_smb_auth.c | 264 ----------
source3/pam_smbpass/pam_smb_passwd.c | 365 -------------
source3/pam_smbpass/samples/README | 3 -
source3/pam_smbpass/samples/kdc-pdc | 15 -
source3/pam_smbpass/samples/password-mature | 14 -
source3/pam_smbpass/samples/password-migration | 18 -
source3/pam_smbpass/samples/password-sync | 15 -
source3/pam_smbpass/support.c | 698 -------------------------
source3/pam_smbpass/support.h | 57 --
source3/pam_smbpass/wscript_build | 16 -
source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 21 +-
source3/smbd/open.c | 4 +-
source3/utils/status.c | 6 +-
source3/wscript_build | 1 -
22 files changed, 38 insertions(+), 1937 deletions(-)
delete mode 100644 source3/pam_smbpass/CHANGELOG
delete mode 100644 source3/pam_smbpass/INSTALL
delete mode 100644 source3/pam_smbpass/README
delete mode 100644 source3/pam_smbpass/TODO
delete mode 100644 source3/pam_smbpass/general.h
delete mode 100644 source3/pam_smbpass/pam_smb_acct.c
delete mode 100644 source3/pam_smbpass/pam_smb_auth.c
delete mode 100644 source3/pam_smbpass/pam_smb_passwd.c
delete mode 100644 source3/pam_smbpass/samples/README
delete mode 100644 source3/pam_smbpass/samples/kdc-pdc
delete mode 100644 source3/pam_smbpass/samples/password-mature
delete mode 100644 source3/pam_smbpass/samples/password-migration
delete mode 100644 source3/pam_smbpass/samples/password-sync
delete mode 100644 source3/pam_smbpass/support.c
delete mode 100644 source3/pam_smbpass/support.h
delete mode 100644 source3/pam_smbpass/wscript_build
Changeset truncated at 500 lines:
diff --git a/source3/locking/proto.h b/source3/locking/proto.h
index 652ec2a..8ff1c7c 100644
--- a/source3/locking/proto.h
+++ b/source3/locking/proto.h
@@ -202,7 +202,8 @@ int share_mode_forall(int (*fn)(struct file_id fid,
const struct share_mode_data *data,
void *private_data),
void *private_data);
-int share_entry_forall(int (*fn)(const struct share_mode_entry *, const char *,
+int share_entry_forall(int (*fn)(const struct share_mode_entry *,
+ const char *, const char *,
const char *, void *),
void *private_data);
bool share_mode_cleanup_disconnected(struct file_id id,
diff --git a/source3/locking/share_mode_lock.c b/source3/locking/share_mode_lock.c
index 5eedcc5..fe105e3 100644
--- a/source3/locking/share_mode_lock.c
+++ b/source3/locking/share_mode_lock.c
@@ -687,13 +687,17 @@ static int share_mode_traverse_fn(struct db_record *rec, void *_state)
DEBUG(1, ("ndr_pull_share_mode_lock failed\n"));
return 0;
}
+
+ for (i=0; i<d->num_share_modes; i++) {
+ struct share_mode_entry *entry = &d->share_modes[i];
+ entry->stale = false; /* [skip] in idl */
+ entry->lease = &d->leases[entry->lease_idx];
+ }
+
if (DEBUGLEVEL > 10) {
DEBUG(11, ("parse_share_modes:\n"));
NDR_PRINT_DEBUG(share_mode_data, d);
}
- for (i=0; i<d->num_share_modes; i++) {
- d->share_modes[i].stale = false; /* [skip] in idl */
- }
ret = state->fn(fid, d, state->private_data);
@@ -728,7 +732,9 @@ int share_mode_forall(int (*fn)(struct file_id fid,
struct share_entry_forall_state {
int (*fn)(const struct share_mode_entry *e,
- const char *service_path, const char *base_name,
+ const char *service_path,
+ const char *base_name,
+ const char *stream_name,
void *private_data);
void *private_data;
};
@@ -744,7 +750,9 @@ static int share_entry_traverse_fn(struct file_id fid,
int ret;
ret = state->fn(&data->share_modes[i],
- data->servicepath, data->base_name,
+ data->servicepath,
+ data->base_name,
+ data->stream_name,
state->private_data);
if (ret != 0) {
return ret;
@@ -760,7 +768,8 @@ static int share_entry_traverse_fn(struct file_id fid,
********************************************************************/
int share_entry_forall(int (*fn)(const struct share_mode_entry *,
- const char *, const char *, void *),
+ const char *, const char *,
+ const char *, void *),
void *private_data)
{
struct share_entry_forall_state state = {
diff --git a/source3/pam_smbpass/CHANGELOG b/source3/pam_smbpass/CHANGELOG
deleted file mode 100644
index 96ef784..0000000
--- a/source3/pam_smbpass/CHANGELOG
+++ /dev/null
@@ -1,31 +0,0 @@
-version 0.7.5 25 Mar 2001
- - Use Samba 2.2.0 (alpha) as the target codebase, since it doesn't look
- like Samba will be offering shared libraries in the near future.
- - added a Makefile and support scripts to make the build process easier.
- - imported some Solaris fixes that I've been sitting on.
-
-version 0.7.4 20 Jan 2000
- - added a 'migrate' option to the authentication code which makes no
- effort to authenticate the user, or even to ask for a password, but
- it can be useful for filling in an SMB password db.
-
-version 0.7.3 19 Jan 2000
- - updated to use the SAMBA_TNG Samba branch, allowing us to dynamically
- link against Luke's new shared libs (libsamba, libsmb).
-
-version 0.7.2 20 Jul 1999
- - miscellaneous bugfixes. Cleanup of legacy pam_pwdb code.
- - fixed return value of pam_sm_setcred function.
- - fix to autoconf support
- - clarified some of the messages being logged
-
-version 0.6, 15 Jul 1999
- - updated to use the new Samba (2.0) password database API.
- - added autoconf support. May now theoretically compile on more
- platforms than PAM itself does.
- - added support for account management functions (i.e., disabled
- accounts)
-
-version 0.5, 4 Apr 1998
- - added support for hashed passwords as input. Now capable of serving
- as an authentication agent for encrypted network transactions.
diff --git a/source3/pam_smbpass/INSTALL b/source3/pam_smbpass/INSTALL
deleted file mode 100644
index ae2ba02..0000000
--- a/source3/pam_smbpass/INSTALL
+++ /dev/null
@@ -1,64 +0,0 @@
-
-Because pam_smbpass is derived from the Samba smbpasswd utility, recent
-versions of pam_smbpass require a copy of the Samba source code to be
-available on the build system. Version 0.7.5 has been tested against
-Samba 2.2.0-alpha3, and this is the recommended version of Samba to use
-for building pam_smbpass. This only affects /building/ pam_smbpass; you
-can still run any version of the Samba server that you want, although
-clearly it saves some disk space to have only one copy of the source
-code on your system (Samba 2.2.0-alpha3 takes roughly 32MB of disk space
-to build pam_smbpass).
-
-Version 0.7.5 features a new build system to make it easier to build
-pam_smbpass.
-
-
-Using the new build system
-==========================
-
-If you don't have a copy of the Samba source code on your machine, and you
-don't have a preferred Samba version (or mirror site), you can build
-pam_smbpass by just typing 'make'.
-
-If you want to use a version other than 2.2.0-alpha3, or you want to
-download the source code from a faster Samba mirror (see
-<http://us1.samba.org/samba/> for a list of mirror sites), please download
-the source code and unpack it before running make. The build scripts will
-attempt to autodetect your Samba source directory, and if it can't be
-found automatically, you will be given the opportunity to specify an
-alternate directory for the Samba sources.
-
-Feedback is welcome if you try (or succeed!) to build pam_smbpass with
-other versions of Samba.
-
-
-Options to 'make'
-=================
-
-By default, pam_smbpass will configure the Samba build tree with the
-options
-
- --with-fhs --with-privatedir=/etc --with-configdir=/etc
-
-This will configure pam_smbpass to look for the smbpasswd file as
-/etc/smbpasswd (or /etc/smbpasswd.tdb), and the smb.conf file as
-/etc/smb.conf. You can override these options by setting CONFIGOPTS when
-calling make. E.g., if you have your smb.conf file in /usr/etc and your
-smbpasswd file in /usr/etc/private, you might run
-
- make CONFIGOPTS="--with-privatedir=/usr/etc/private --with-configdir=/usr/etc"
-
-For a complete list of available configuration options, see
-'./samba/configure --help'
-
-
-Installing the module
-=====================
-
-If all goes well in the build process, the file pam_smbpass.so will be
-created in the current directory. Simply install the module into your
-system's PAM module directory:
-
- install -m 755 -s bin/pam_smbpass.so /lib/security
-
-and you're all set.
diff --git a/source3/pam_smbpass/README b/source3/pam_smbpass/README
deleted file mode 100644
index a5bde25..0000000
--- a/source3/pam_smbpass/README
+++ /dev/null
@@ -1,68 +0,0 @@
-23 Jan 2015
-
-=== WARNING ===
-
-This PAM module is deprecated and will be removed from the Samba source code
-with the release of Samba 4.3. If you are still using this module please
-migrate to pam_winbind or another suiteable solution.
-
-25 Mar 2001
-
-pam_smbpass is a PAM module which can be used on conforming systems to
-keep the smbpasswd (Samba password) database in sync with the unix
-password file. PAM (Pluggable Authentication Modules) is an API supported
-under some Unices, such as Solaris, HPUX and Linux, that provides a
-generic interface to authentication mechanisms.
-
-For more information on PAM, see http://ftp.kernel.org/pub/linux/libs/pam/
-
-This module authenticates a local smbpasswd user database. If you require
-support for authenticating against a remote SMB server, or if you're
-concerned about the presence of suid root binaries on your system, it is
-recommended that you use pam_winbind instead.
-
-Options recognized by this module are as follows:
-
- debug - log more debugging info
- audit - like debug, but also logs unknown usernames
- use_first_pass - don't prompt the user for passwords;
- take them from PAM_ items instead
- try_first_pass - try to get the password from a previous
- PAM module, fall back to prompting the user
- use_authtok - like try_first_pass, but *fail* if the new
- PAM_AUTHTOK has not been previously set.
- (intended for stacking password modules only)
- not_set_pass - don't make passwords used by this module
- available to other modules.
- nodelay - don't insert ~1 second delays on authentication
- failure.
- nullok - null passwords are allowed.
- nonull - null passwords are not allowed. Used to
- override the Samba configuration.
- migrate - only meaningful in an "auth" context;
- used to update smbpasswd file with a
- password used for successful authentication.
- smbconf=<file> - specify an alternate path to the smb.conf
- file.
-
-See the samples/ directory for example PAM configurations using this
-module.
-
-Thanks go to the following people:
-
-* Andrew Morgan <morgan at transmeta.com>, for providing the Linux-PAM
-framework, without which none of this would have happened
-
-* Christian Gafton <gafton at redhat.com> and Andrew Morgan again, for the
-pam_pwdb module upon which pam_smbpass was originally based
-
-* Luke Leighton <lkcl at switchboard.net> for being receptive to the idea,
-and for the occasional good-natured complaint about the project's status
-that keep me working on it :)
-
-* and of course, all the other members of the Samba team
-<http://www.samba.org/samba/team.html>, for creating a great product
-and for giving this project a purpose
-
----------------------
-Stephen Langasek <vorlon at netexpress.net>
diff --git a/source3/pam_smbpass/TODO b/source3/pam_smbpass/TODO
deleted file mode 100644
index 20cf4fb..0000000
--- a/source3/pam_smbpass/TODO
+++ /dev/null
@@ -1,7 +0,0 @@
-This is a tentative TODO file which will probably get much longer before
-it gets much shorter.
-
-- Recognizing (and overriding) debug options in the smb.conf file
-- Support for 'name=value' parameters in the PAM config
-- Compliant handling of unrecognized PAM parameters (i.e., fail on error)
--
diff --git a/source3/pam_smbpass/general.h b/source3/pam_smbpass/general.h
deleted file mode 100644
index c3e4b8b..0000000
--- a/source3/pam_smbpass/general.h
+++ /dev/null
@@ -1,134 +0,0 @@
-#include "../librpc/gen_ndr/samr.h"
-#include "../libcli/auth/pam_errors.h"
-#include "passdb.h"
-
-#ifndef LINUX
-/* This is only needed by modules in the Sun implementation. */
-#if defined(HAVE_SECURITY_PAM_APPL_H)
-#include <security/pam_appl.h>
-#elif defined(HAVE_PAM_PAM_APPL_H)
-#include <pam/pam_appl.h>
-#endif
-#endif /* LINUX */
-
-#if defined(HAVE_SECURITY_PAM_MODULES_H)
-#include <security/pam_modules.h>
-#elif defined(HAVE_PAM_PAM_MODULES_H)
-#include <pam/pam_modules.h>
-#endif
-
-#ifndef PAM_AUTHTOK_RECOVER_ERR
-#define PAM_AUTHTOK_RECOVER_ERR PAM_AUTHTOK_RECOVERY_ERR
-#endif
-
-#include "replace.h"
-#include "system/filesys.h"
-#include "system/wait.h"
-#include "system/syslog.h"
-
-/*
- * here is the string to inform the user that the new passwords they
- * typed were not the same.
- */
-
-#define MISTYPED_PASS "Sorry, passwords do not match"
-
-/* type definition for the control options */
-
-typedef struct {
- const char *token;
- unsigned int mask; /* shall assume 32 bits of flags */
- unsigned int flag;
-} SMB_Ctrls;
-
-#ifndef False
-#define False (0)
-#endif
-
-#ifndef True
-#define True (1)
-#endif
-
-/* macro to determine if a given flag is on */
-#define on(x,ctrl) (smb_args[x].flag & ctrl)
-
-/* macro to determine that a given flag is NOT on */
-#define off(x,ctrl) (!on(x,ctrl))
-
-/* macro to turn on/off a ctrl flag manually */
-#define set(x,ctrl) (ctrl = ((ctrl)&smb_args[x].mask)|smb_args[x].flag)
-#define unset(x,ctrl) (ctrl &= ~(smb_args[x].flag))
-
-/* the generic mask */
-#define _ALL_ON_ (~0U)
-
-/* end of macro definitions definitions for the control flags */
-
-/*
- * These are the options supported by the smb password module, very
- * similar to the pwdb options
- */
-
-#define SMB__OLD_PASSWD 0 /* internal */
-#define SMB__VERIFY_PASSWD 1 /* internal */
-
-#define SMB_AUDIT 2 /* print more things than debug..
- some information may be sensitive */
-#define SMB_USE_FIRST_PASS 3
-#define SMB_TRY_FIRST_PASS 4
-#define SMB_NOT_SET_PASS 5 /* don't set the AUTHTOK items */
-
-#define SMB__NONULL 6 /* internal */
-#define SMB__QUIET 7 /* internal */
-#define SMB_USE_AUTHTOK 8 /* insist on reading PAM_AUTHTOK */
-#define SMB__NULLOK 9 /* Null token ok */
-#define SMB_DEBUG 10 /* send more info to syslog(3) */
-#define SMB_NODELAY 11 /* admin does not want a fail-delay */
-#define SMB_MIGRATE 12 /* Does no authentication, just
- updates the smb database. */
-#define SMB_CONF_FILE 13 /* Alternate location of smb.conf */
-
-#define SMB_CTRLS_ 14 /* number of ctrl arguments defined */
-
-static const SMB_Ctrls smb_args[SMB_CTRLS_] = {
-/* symbol token name ctrl mask ctrl *
- * ------------------ ------------------ -------------- ---------- */
-
-/* SMB__OLD_PASSWD */ { NULL, _ALL_ON_, 01 },
-/* SMB__VERIFY_PASSWD */ { NULL, _ALL_ON_, 02 },
-/* SMB_AUDIT */ { "audit", _ALL_ON_, 04 },
-/* SMB_USE_FIRST_PASS */ { "use_first_pass", _ALL_ON_^(030), 010 },
-/* SMB_TRY_FIRST_PASS */ { "try_first_pass", _ALL_ON_^(030), 020 },
-/* SMB_NOT_SET_PASS */ { "not_set_pass", _ALL_ON_, 040 },
-/* SMB__NONULL */ { "nonull", _ALL_ON_, 0100 },
-/* SMB__QUIET */ { NULL, _ALL_ON_, 0200 },
-/* SMB_USE_AUTHTOK */ { "use_authtok", _ALL_ON_, 0400 },
-/* SMB__NULLOK */ { "nullok", _ALL_ON_^(0100), 0 },
-/* SMB_DEBUG */ { "debug", _ALL_ON_, 01000 },
-/* SMB_NODELAY */ { "nodelay", _ALL_ON_, 02000 },
-/* SMB_MIGRATE */ { "migrate", _ALL_ON_^(0100), 04000 },
-/* SMB_CONF_FILE */ { "smbconf=", _ALL_ON_, 0 },
-};
-
-#define SMB_DEFAULTS (smb_args[SMB__NONULL].flag)
-
-/*
- * the following is used to keep track of the number of times a user fails
- * to authenticate themself.
- */
-
-#define SMB_MAX_RETRIES 3
-
-struct _pam_failed_auth {
- char *user; /* user that's failed to be authenticated */
- uid_t id; /* uid of requested user */
- char *agent; /* attempt from user with name */
- int count; /* number of failures so far */
-};
-
-/*
- * General use functions go here
- */
-
-/* from support.c */
-int make_remark(pam_handle_t *, unsigned int, int, const char *);
diff --git a/source3/pam_smbpass/pam_smb_acct.c b/source3/pam_smbpass/pam_smb_acct.c
deleted file mode 100644
index 8dbbf3a..0000000
--- a/source3/pam_smbpass/pam_smb_acct.c
+++ /dev/null
@@ -1,150 +0,0 @@
-/* Unix NT password database implementation, version 0.7.5.
- *
- * This program is free software; you can redistribute it and/or modify it under
- * the terms of the GNU General Public License as published by the Free
- * Software Foundation; either version 3 of the License, or (at your option)
- * any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
-*/
-
-/* indicate the following groups are defined */
-#define PAM_SM_ACCT
-
-#include "includes.h"
-
-#ifndef LINUX
-
-/* This is only used in the Sun implementation. */
-#if defined(HAVE_SECURITY_PAM_APPL_H)
-#include <security/pam_appl.h>
-#elif defined(HAVE_PAM_PAM_APPL_H)
-#include <pam/pam_appl.h>
-#endif
-
-#endif /* LINUX */
-
-#if defined(HAVE_SECURITY_PAM_MODULES_H)
-#include <security/pam_modules.h>
-#elif defined(HAVE_PAM_PAM_MODULES_H)
-#include <pam/pam_modules.h>
-#endif
-
-#include "general.h"
-
-#include "support.h"
-
-
-/*
- * pam_sm_acct_mgmt() verifies whether or not the account is disabled.
- *
- */
-
-int pam_sm_acct_mgmt( pam_handle_t *pamh, int flags,
- int argc, const char **argv )
-{
- unsigned int ctrl;
- int retval;
-
- const char *name;
- struct samu *sampass = NULL;
- void (*oldsig_handler)(int);
- TALLOC_CTX *frame = talloc_stackframe();
-
- /* Samba initialization. */
-
- ctrl = set_ctrl(pamh, flags, argc, argv );
-
- /* get the username */
-
- retval = pam_get_user( pamh, &name, "Username: " );
- if (retval != PAM_SUCCESS) {
- if (on( SMB_DEBUG, ctrl )) {
- _log_err(pamh, LOG_DEBUG, "acct: could not identify user" );
- }
- TALLOC_FREE(frame);
- return retval;
- }
- if (on( SMB_DEBUG, ctrl )) {
- _log_err(pamh, LOG_DEBUG, "acct: username [%s] obtained", name );
- }
-
- if (geteuid() != 0) {
- _log_err(pamh, LOG_DEBUG, "Cannot access samba password database, not running as root.");
- TALLOC_FREE(frame);
- return PAM_AUTHINFO_UNAVAIL;
- }
-
- /* Getting into places that might use LDAP -- protect the app
- from a SIGPIPE it's not expecting */
- oldsig_handler = CatchSignal(SIGPIPE, SIG_IGN);
- if (!initialize_password_db(True, NULL)) {
- _log_err(pamh, LOG_ALERT, "Cannot access samba password database" );
- CatchSignal(SIGPIPE, oldsig_handler);
--
Samba Shared Repository
More information about the samba-cvs
mailing list