2 Unix SMB/CIFS implementation.
4 Copyright (C) Andrew Tridgell 1992-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "smbd/globals.h"
23 /* what user is current? */
24 extern struct current_user current_user
;
26 /****************************************************************************
27 Become the guest user without changing the security context stack.
28 ****************************************************************************/
30 bool change_to_guest(void)
34 pass
= getpwnam_alloc(talloc_autofree_context(), lp_guestaccount());
40 /* MWW: From AIX FAQ patch to WU-ftpd: call initgroups before
42 initgroups(pass
->pw_name
, pass
->pw_gid
);
45 set_sec_ctx(pass
->pw_uid
, pass
->pw_gid
, 0, NULL
, NULL
);
47 current_user
.conn
= NULL
;
48 current_user
.vuid
= UID_FIELD_INVALID
;
55 /****************************************************************************
56 talloc free the conn->server_info if not used in the vuid cache.
57 ****************************************************************************/
59 static void free_conn_server_info_if_unused(connection_struct
*conn
)
63 for (i
= 0; i
< VUID_CACHE_SIZE
; i
++) {
64 struct vuid_cache_entry
*ent
;
65 ent
= &conn
->vuid_cache
.array
[i
];
66 if (ent
->vuid
!= UID_FIELD_INVALID
&&
67 conn
->server_info
== ent
->server_info
) {
71 /* Not used, safe to free. */
72 TALLOC_FREE(conn
->server_info
);
75 /*******************************************************************
76 Check if a username is OK.
78 This sets up conn->server_info with a copy related to this vuser that
79 later code can then mess with.
80 ********************************************************************/
82 static bool check_user_ok(connection_struct
*conn
,
84 const struct auth_serversupplied_info
*server_info
,
85 int snum
, bool recheck
, NTSTATUS
*pstatus
)
87 bool valid_vuid
= (vuid
!= UID_FIELD_INVALID
);
91 struct vuid_cache_entry
*ent0
;
94 *pstatus
= NT_STATUS_OK
;
98 struct vuid_cache_entry
*ent
;
100 for (i
=0; i
<VUID_CACHE_SIZE
; i
++) {
101 ent
= &conn
->vuid_cache
.array
[i
];
102 if (ent
->vuid
== vuid
) {
103 free_conn_server_info_if_unused(conn
);
106 conn
->server_info
= ent
->server_info
;
107 conn
->read_only
= ent
->read_only
;
108 conn
->admin_user
= ent
->admin_user
;
117 if (!user_ok_token(server_info
->unix_name
,
118 pdb_get_domain(server_info
->sam_account
),
119 server_info
->ptok
, snum
)) {
121 *pstatus
= NT_STATUS_ACCESS_DENIED
;
126 readonly_share
= is_share_read_only_for_token(
127 server_info
->unix_name
,
128 pdb_get_domain(server_info
->sam_account
),
132 if (!readonly_share
&&
133 !share_access_check(server_info
->ptok
, lp_servicename(snum
),
135 /* smb.conf allows r/w, but the security descriptor denies
136 * write. Fall back to looking at readonly. */
137 readonly_share
= True
;
138 DEBUG(5,("falling back to read-only access-evaluation due to "
139 "security descriptor\n"));
142 if (!share_access_check(server_info
->ptok
, lp_servicename(snum
),
144 FILE_READ_DATA
: FILE_WRITE_DATA
)) {
146 *pstatus
= NT_STATUS_ACCESS_DENIED
;
151 admin_user
= token_contains_name_in_list(
152 server_info
->unix_name
,
153 pdb_get_domain(server_info
->sam_account
),
154 NULL
, server_info
->ptok
, lp_admin_users(snum
));
157 struct vuid_cache_entry
*ent
= NULL
;
159 if (!recheck
|| i
== VUID_CACHE_SIZE
) {
160 /* find a new entry and fill it. */
161 ent
= &conn
->vuid_cache
.array
[conn
->vuid_cache
.next_entry
];
163 conn
->vuid_cache
.next_entry
=
164 (conn
->vuid_cache
.next_entry
+ 1) % VUID_CACHE_SIZE
;
166 TALLOC_FREE(ent
->server_info
);
167 } else if (recheck
&& (i
< VUID_CACHE_SIZE
) && (ent0
->vuid
== vuid
)) {
168 /* she perform forced recheck, replace the old one. */
171 /* must not happen */
172 DEBUG(0, ("check_user_ok: recheck %s\n", recheck
? "true" : "false"));
173 DEBUG(0, ("check_user_ok: vuid cache %d -- %d\n", i
, VUID_CACHE_SIZE
));
174 DEBUG(0, ("check_user_ok: vuid %d -- %d\n", ent0
->vuid
, vuid
));
175 smb_panic("should not happen");
179 * If force_user was set, all server_info's are based on the same
180 * username-based faked one.
183 ent
->server_info
= copy_serverinfo(
184 conn
, conn
->force_user
? conn
->server_info
: server_info
);
186 if (ent
->server_info
== NULL
) {
187 ent
->vuid
= UID_FIELD_INVALID
;
189 *pstatus
= NT_STATUS_NO_MEMORY
;
195 ent
->read_only
= readonly_share
;
196 ent
->admin_user
= admin_user
;
197 free_conn_server_info_if_unused(conn
);
198 conn
->server_info
= ent
->server_info
;
201 conn
->read_only
= readonly_share
;
202 conn
->admin_user
= admin_user
;
207 /****************************************************************************
208 Clear a vuid out of the connection's vuid cache
209 This is only called on SMBulogoff.
210 ****************************************************************************/
212 void conn_clear_vuid_cache(connection_struct
*conn
, uint16_t vuid
)
216 for (i
=0; i
<VUID_CACHE_SIZE
; i
++) {
217 struct vuid_cache_entry
*ent
;
219 ent
= &conn
->vuid_cache
.array
[i
];
221 if (ent
->vuid
== vuid
) {
222 ent
->vuid
= UID_FIELD_INVALID
;
224 * We need to keep conn->server_info around
225 * if it's equal to ent->server_info as a SMBulogoff
226 * is often followed by a SMBtdis (with an invalid
227 * vuid). The debug code (or regular code in
228 * vfs_full_audit) wants to refer to the
229 * conn->server_info pointer to print debug
230 * statements. Theoretically this is a bug,
231 * as once the vuid is gone the server_info
232 * on the conn struct isn't valid any more,
233 * but there's enough code that assumes
234 * conn->server_info is never null that
235 * it's easier to hold onto the old pointer
236 * until we get a new sessionsetupX.
237 * As everything is hung off the
238 * conn pointer as a talloc context we're not
239 * leaking memory here. See bug #6315. JRA.
241 if (conn
->server_info
== ent
->server_info
) {
242 ent
->server_info
= NULL
;
244 TALLOC_FREE(ent
->server_info
);
246 ent
->read_only
= False
;
247 ent
->admin_user
= False
;
252 /****************************************************************************
253 Become the user of a connection number without changing the security context
254 stack, but modify the current_user entries.
255 ****************************************************************************/
257 bool change_to_user_force_recheck(connection_struct
*conn
, uint16 vuid
,
258 bool recheck
, NTSTATUS
*pstatus
)
260 const struct auth_serversupplied_info
*server_info
= NULL
;
261 struct smbd_server_connection
*sconn
= smbd_server_conn
;
262 user_struct
*vuser
= get_valid_user_struct(sconn
, vuid
);
268 gid_t
*group_list
= NULL
;
271 DEBUG(2,("change_to_user: Connection not open\n"));
273 *pstatus
= NT_STATUS_INVALID_HANDLE
;
279 * We need a separate check in security=share mode due to vuid
280 * always being UID_FIELD_INVALID. If we don't do this then
281 * in share mode security we are *always* changing uid's between
282 * SMB's - this hurts performance - Badly.
286 if((lp_security() == SEC_SHARE
) && (current_user
.conn
== conn
) &&
287 (current_user
.ut
.uid
== conn
->server_info
->utok
.uid
)) {
288 DEBUG(4,("change_to_user: Skipping user change - already "
291 } else if ((current_user
.conn
== conn
) &&
292 (vuser
!= NULL
) && (current_user
.vuid
== vuid
) &&
293 (current_user
.ut
.uid
== vuser
->server_info
->utok
.uid
)) {
294 DEBUG(4,("change_to_user: Skipping user change - already "
302 server_info
= vuser
? vuser
->server_info
: conn
->server_info
;
305 /* Invalid vuid sent - even with security = share. */
306 DEBUG(2,("change_to_user: Invalid vuid %d used on "
307 "share %s.\n",vuid
, lp_servicename(snum
) ));
309 *pstatus
= NT_STATUS_ACCESS_VIOLATION
;
314 if (!check_user_ok(conn
, vuid
, server_info
, snum
, recheck
, pstatus
)) {
315 DEBUG(2,("change_to_user: SMB user %s (unix user %s, vuid %d) "
316 "not permitted access to share %s.\n",
317 server_info
->sanitized_username
,
318 server_info
->unix_name
, vuid
,
319 lp_servicename(snum
)));
324 * conn->server_info is now correctly set up with a copy we can mess
325 * with for force_group etc.
328 if (conn
->force_user
) /* security = share sets this too */ {
329 uid
= conn
->server_info
->utok
.uid
;
330 gid
= conn
->server_info
->utok
.gid
;
331 group_list
= conn
->server_info
->utok
.groups
;
332 num_groups
= conn
->server_info
->utok
.ngroups
;
334 uid
= conn
->admin_user
? 0 : vuser
->server_info
->utok
.uid
;
335 gid
= conn
->server_info
->utok
.gid
;
336 num_groups
= conn
->server_info
->utok
.ngroups
;
337 group_list
= conn
->server_info
->utok
.groups
;
339 DEBUG(2,("change_to_user: Invalid vuid used %d in accessing "
340 "share %s.\n",vuid
, lp_servicename(snum
) ));
342 *pstatus
= NT_STATUS_DOS(ERRSRV
, ERRbaduid
);
348 * See if we should force group for this service.
349 * If so this overrides any group set in the force
353 if((group_c
= *lp_force_group(snum
))) {
355 SMB_ASSERT(conn
->force_group_gid
!= (gid_t
)-1);
360 * Only force group if the user is a member of
361 * the service group. Check the group memberships for
362 * this user (we already have this) to
363 * see if we should force the group.
367 for (i
= 0; i
< num_groups
; i
++) {
369 == conn
->force_group_gid
) {
370 conn
->server_info
->utok
.gid
=
371 conn
->force_group_gid
;
372 gid
= conn
->force_group_gid
;
373 gid_to_sid(&conn
->server_info
->ptok
374 ->user_sids
[1], gid
);
379 conn
->server_info
->utok
.gid
= conn
->force_group_gid
;
380 gid
= conn
->force_group_gid
;
381 gid_to_sid(&conn
->server_info
->ptok
->user_sids
[1],
386 /* Now set current_user since we will immediately also call
389 current_user
.ut
.ngroups
= num_groups
;
390 current_user
.ut
.groups
= group_list
;
392 set_sec_ctx(uid
, gid
, current_user
.ut
.ngroups
, current_user
.ut
.groups
,
393 conn
->server_info
->ptok
);
395 current_user
.conn
= conn
;
396 current_user
.vuid
= vuid
;
398 DEBUG(5,("change_to_user uid=(%d,%d) gid=(%d,%d)\n",
399 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
402 *pstatus
= NT_STATUS_OK
;
407 /****************************************************************************
408 Go back to being root without changing the security context stack,
409 but modify the current_user entries.
410 ****************************************************************************/
412 bool change_to_root_user(void)
416 DEBUG(5,("change_to_root_user: now uid=(%d,%d) gid=(%d,%d)\n",
417 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
419 current_user
.conn
= NULL
;
420 current_user
.vuid
= UID_FIELD_INVALID
;
425 /****************************************************************************
426 Become the user of an authenticated connected named pipe.
427 When this is called we are currently running as the connection
428 user. Doesn't modify current_user.
429 ****************************************************************************/
431 bool become_authenticated_pipe_user(pipes_struct
*p
)
436 set_sec_ctx(p
->server_info
->utok
.uid
, p
->server_info
->utok
.gid
,
437 p
->server_info
->utok
.ngroups
, p
->server_info
->utok
.groups
,
438 p
->server_info
->ptok
);
443 /****************************************************************************
444 Unbecome the user of an authenticated connected named pipe.
445 When this is called we are running as the authenticated pipe
446 user and need to go back to being the connection user. Doesn't modify
448 ****************************************************************************/
450 bool unbecome_authenticated_pipe_user(void)
452 return pop_sec_ctx();
455 /****************************************************************************
456 Utility functions used by become_xxx/unbecome_xxx.
457 ****************************************************************************/
459 static void push_conn_ctx(void)
461 struct conn_ctx
*ctx_p
;
463 /* Check we don't overflow our stack */
465 if (conn_ctx_stack_ndx
== MAX_SEC_CTX_DEPTH
) {
466 DEBUG(0, ("Connection context stack overflow!\n"));
467 smb_panic("Connection context stack overflow!\n");
470 /* Store previous user context */
471 ctx_p
= &conn_ctx_stack
[conn_ctx_stack_ndx
];
473 ctx_p
->conn
= current_user
.conn
;
474 ctx_p
->vuid
= current_user
.vuid
;
476 DEBUG(3, ("push_conn_ctx(%u) : conn_ctx_stack_ndx = %d\n",
477 (unsigned int)ctx_p
->vuid
, conn_ctx_stack_ndx
));
479 conn_ctx_stack_ndx
++;
482 static void pop_conn_ctx(void)
484 struct conn_ctx
*ctx_p
;
486 /* Check for stack underflow. */
488 if (conn_ctx_stack_ndx
== 0) {
489 DEBUG(0, ("Connection context stack underflow!\n"));
490 smb_panic("Connection context stack underflow!\n");
493 conn_ctx_stack_ndx
--;
494 ctx_p
= &conn_ctx_stack
[conn_ctx_stack_ndx
];
496 current_user
.conn
= ctx_p
->conn
;
497 current_user
.vuid
= ctx_p
->vuid
;
500 ctx_p
->vuid
= UID_FIELD_INVALID
;
503 /****************************************************************************
504 Temporarily become a root user. Must match with unbecome_root(). Saves and
505 restores the connection context.
506 ****************************************************************************/
508 void become_root(void)
511 * no good way to handle push_sec_ctx() failing without changing
512 * the prototype of become_root()
514 if (!push_sec_ctx()) {
515 smb_panic("become_root: push_sec_ctx failed");
521 /* Unbecome the root user */
523 void unbecome_root(void)
529 /****************************************************************************
530 Push the current security context then force a change via change_to_user().
531 Saves and restores the connection context.
532 ****************************************************************************/
534 bool become_user(connection_struct
*conn
, uint16 vuid
)
541 if (!change_to_user(conn
, vuid
)) {
550 bool unbecome_user(void)