IPC User Problem (was Situational Deadlock)

[Esh, Andrew]

The "admin user" setting is not set in smb.conf. The "force group" setting is set globally to allow all users of all shares to belong to the same group. This allows some crossover functionality with NFS we needed to have. I suppose we could put "force group" in every share, but it would be a PITA.

Why can't we allow "force group" in the case of IPC? (Other shares, sure, but IPC? IPC should be open to anyone, or nothing works.) Remember, this will affect anyone who calls WNetAddConnection2 to connect to a share from NT. Our use of that call could be idiosyncratic, but I doubt it.

I was thinking of the following change:

	if ( !conn->ipc && (conn->force_user || conn->force_group) 
	    && (conn->vuid != vuser->vuid)) {
		return False;
	}
	

-----Original Message-----
From: Andrew Bartlett [mailto:abartlet at samba.org]
Sent: Wednesday, January 28, 2004 2:41 PM
To: Esh, Andrew
Cc: samba-technical at lists.samba.org
Subject: RE: IPC User Problem (was Situational Deadlock)


On Thu, 2004-01-29 at 07:34, Esh, Andrew wrote:
> It should be noted that the problem occurs in Samba 3.0.1 
> (CVS tag release_3_0_1), and  did not occur in Samba 2.2.8a. 
> The code snippet shown below was added to smbd/uid.c:check_user_ok 
> between those two releases.

What is in your smb.conf for 'force user', and 'admin users'?

This code was added to avoid insecurity surrounding 'force user' and
share access by multiple vuids.  You should never set either of these
options globally, or on IPC$ in particular.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet at pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet at samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net