2 Unix SMB/CIFS implementation.
4 Copyright (C) Andrew Tridgell 1992-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "system/passwd.h"
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../librpc/gen_ndr/netlogon.h"
25 #include "libcli/security/security.h"
26 #include "passdb/lookup_sid.h"
29 /* what user is current? */
30 extern struct current_user current_user
;
32 /****************************************************************************
33 Become the guest user without changing the security context stack.
34 ****************************************************************************/
36 bool change_to_guest(void)
40 pass
= Get_Pwnam_alloc(talloc_tos(), lp_guestaccount());
46 /* MWW: From AIX FAQ patch to WU-ftpd: call initgroups before
48 initgroups(pass
->pw_name
, pass
->pw_gid
);
51 set_sec_ctx(pass
->pw_uid
, pass
->pw_gid
, 0, NULL
, NULL
);
53 current_user
.conn
= NULL
;
54 current_user
.vuid
= UID_FIELD_INVALID
;
61 /****************************************************************************
62 talloc free the conn->session_info if not used in the vuid cache.
63 ****************************************************************************/
65 static void free_conn_session_info_if_unused(connection_struct
*conn
)
69 for (i
= 0; i
< VUID_CACHE_SIZE
; i
++) {
70 struct vuid_cache_entry
*ent
;
71 ent
= &conn
->vuid_cache
->array
[i
];
72 if (ent
->vuid
!= UID_FIELD_INVALID
&&
73 conn
->session_info
== ent
->session_info
) {
77 /* Not used, safe to free. */
78 TALLOC_FREE(conn
->session_info
);
81 /****************************************************************************
82 Setup the share access mask for a connection.
83 ****************************************************************************/
85 static uint32_t create_share_access_mask(int snum
,
87 const struct security_token
*token
)
89 uint32_t share_access
= 0;
91 share_access_check(token
,
92 lp_servicename(talloc_tos(), snum
),
93 MAXIMUM_ALLOWED_ACCESS
,
98 ~(SEC_FILE_WRITE_DATA
| SEC_FILE_APPEND_DATA
|
99 SEC_FILE_WRITE_EA
| SEC_FILE_WRITE_ATTRIBUTE
|
100 SEC_DIR_DELETE_CHILD
);
103 if (security_token_has_privilege(token
, SEC_PRIV_SECURITY
)) {
104 share_access
|= SEC_FLAG_SYSTEM_SECURITY
;
106 if (security_token_has_privilege(token
, SEC_PRIV_RESTORE
)) {
107 share_access
|= SEC_RIGHTS_PRIV_RESTORE
;
109 if (security_token_has_privilege(token
, SEC_PRIV_BACKUP
)) {
110 share_access
|= SEC_RIGHTS_PRIV_BACKUP
;
112 if (security_token_has_privilege(token
, SEC_PRIV_TAKE_OWNERSHIP
)) {
113 share_access
|= SEC_STD_WRITE_OWNER
;
119 /*******************************************************************
120 Calculate access mask and if this user can access this share.
121 ********************************************************************/
123 NTSTATUS
check_user_share_access(connection_struct
*conn
,
124 const struct auth_session_info
*session_info
,
125 uint32_t *p_share_access
,
126 bool *p_readonly_share
)
128 int snum
= SNUM(conn
);
129 uint32_t share_access
= 0;
130 bool readonly_share
= false;
132 if (!user_ok_token(session_info
->unix_info
->unix_name
,
133 session_info
->info
->domain_name
,
134 session_info
->security_token
, snum
)) {
135 return NT_STATUS_ACCESS_DENIED
;
138 readonly_share
= is_share_read_only_for_token(
139 session_info
->unix_info
->unix_name
,
140 session_info
->info
->domain_name
,
141 session_info
->security_token
,
144 share_access
= create_share_access_mask(snum
,
146 session_info
->security_token
);
148 if ((share_access
& (FILE_READ_DATA
|FILE_WRITE_DATA
)) == 0) {
149 /* No access, read or write. */
150 DEBUG(0,("user %s connection to %s denied due to share "
151 "security descriptor.\n",
152 session_info
->unix_info
->unix_name
,
153 lp_servicename(talloc_tos(), snum
)));
154 return NT_STATUS_ACCESS_DENIED
;
157 if (!readonly_share
&&
158 !(share_access
& FILE_WRITE_DATA
)) {
159 /* smb.conf allows r/w, but the security descriptor denies
160 * write. Fall back to looking at readonly. */
161 readonly_share
= True
;
162 DEBUG(5,("falling back to read-only access-evaluation due to "
163 "security descriptor\n"));
166 *p_share_access
= share_access
;
167 *p_readonly_share
= readonly_share
;
172 /*******************************************************************
173 Check if a username is OK.
175 This sets up conn->session_info with a copy related to this vuser that
176 later code can then mess with.
177 ********************************************************************/
179 static bool check_user_ok(connection_struct
*conn
,
181 const struct auth_session_info
*session_info
,
185 bool readonly_share
= false;
186 bool admin_user
= false;
187 struct vuid_cache_entry
*ent
= NULL
;
188 uint32_t share_access
= 0;
191 for (i
=0; i
<VUID_CACHE_SIZE
; i
++) {
192 ent
= &conn
->vuid_cache
->array
[i
];
193 if (ent
->vuid
== vuid
) {
194 free_conn_session_info_if_unused(conn
);
195 conn
->session_info
= ent
->session_info
;
196 conn
->read_only
= ent
->read_only
;
197 conn
->share_access
= ent
->share_access
;
202 status
= check_user_share_access(conn
,
206 if (!NT_STATUS_IS_OK(status
)) {
210 admin_user
= token_contains_name_in_list(
211 session_info
->unix_info
->unix_name
,
212 session_info
->info
->domain_name
,
213 NULL
, session_info
->security_token
, lp_admin_users(snum
));
215 ent
= &conn
->vuid_cache
->array
[conn
->vuid_cache
->next_entry
];
217 conn
->vuid_cache
->next_entry
=
218 (conn
->vuid_cache
->next_entry
+ 1) % VUID_CACHE_SIZE
;
220 TALLOC_FREE(ent
->session_info
);
223 * If force_user was set, all session_info's are based on the same
224 * username-based faked one.
227 ent
->session_info
= copy_session_info(
228 conn
, conn
->force_user
? conn
->session_info
: session_info
);
230 if (ent
->session_info
== NULL
) {
231 ent
->vuid
= UID_FIELD_INVALID
;
236 ent
->read_only
= readonly_share
;
237 ent
->share_access
= share_access
;
238 free_conn_session_info_if_unused(conn
);
239 conn
->session_info
= ent
->session_info
;
241 conn
->read_only
= readonly_share
;
242 conn
->share_access
= share_access
;
245 DEBUG(2,("check_user_ok: user %s is an admin user. "
246 "Setting uid as %d\n",
247 conn
->session_info
->unix_info
->unix_name
,
248 sec_initial_uid() ));
249 conn
->session_info
->unix_token
->uid
= sec_initial_uid();
255 /****************************************************************************
256 Become the user of a connection number without changing the security context
257 stack, but modify the current_user entries.
258 ****************************************************************************/
260 static bool change_to_user_internal(connection_struct
*conn
,
261 const struct auth_session_info
*session_info
,
269 gid_t
*group_list
= NULL
;
274 ok
= check_user_ok(conn
, vuid
, session_info
, snum
);
276 DEBUG(2,("SMB user %s (unix user %s) "
277 "not permitted access to share %s.\n",
278 session_info
->unix_info
->sanitized_username
,
279 session_info
->unix_info
->unix_name
,
280 lp_servicename(talloc_tos(), snum
)));
284 uid
= conn
->session_info
->unix_token
->uid
;
285 gid
= conn
->session_info
->unix_token
->gid
;
286 num_groups
= conn
->session_info
->unix_token
->ngroups
;
287 group_list
= conn
->session_info
->unix_token
->groups
;
290 * See if we should force group for this service. If so this overrides
291 * any group set in the force user code.
293 if((group_c
= *lp_force_group(talloc_tos(), snum
))) {
295 SMB_ASSERT(conn
->force_group_gid
!= (gid_t
)-1);
297 if (group_c
== '+') {
301 * Only force group if the user is a member of the
302 * service group. Check the group memberships for this
303 * user (we already have this) to see if we should force
306 for (i
= 0; i
< num_groups
; i
++) {
307 if (group_list
[i
] == conn
->force_group_gid
) {
308 conn
->session_info
->unix_token
->gid
=
309 conn
->force_group_gid
;
310 gid
= conn
->force_group_gid
;
311 gid_to_sid(&conn
->session_info
->security_token
317 conn
->session_info
->unix_token
->gid
= conn
->force_group_gid
;
318 gid
= conn
->force_group_gid
;
319 gid_to_sid(&conn
->session_info
->security_token
->sids
[1],
324 /*Set current_user since we will immediately also call set_sec_ctx() */
325 current_user
.ut
.ngroups
= num_groups
;
326 current_user
.ut
.groups
= group_list
;
330 current_user
.ut
.ngroups
,
331 current_user
.ut
.groups
,
332 conn
->session_info
->security_token
);
334 current_user
.conn
= conn
;
335 current_user
.vuid
= vuid
;
337 DEBUG(5, ("Impersonated user: uid=(%d,%d), gid=(%d,%d)\n",
346 bool change_to_user(connection_struct
*conn
, uint64_t vuid
)
348 struct user_struct
*vuser
;
349 int snum
= SNUM(conn
);
352 DEBUG(2,("Connection not open\n"));
356 vuser
= get_valid_user_struct(conn
->sconn
, vuid
);
358 if ((current_user
.conn
== conn
) &&
359 (vuser
!= NULL
) && (current_user
.vuid
== vuid
) &&
360 (current_user
.ut
.uid
== vuser
->session_info
->unix_token
->uid
)) {
361 DEBUG(4,("Skipping user change - already "
367 /* Invalid vuid sent */
368 DEBUG(2,("Invalid vuid %llu used on share %s.\n",
369 (unsigned long long)vuid
, lp_servicename(talloc_tos(),
374 return change_to_user_internal(conn
, vuser
->session_info
, vuid
);
377 static bool change_to_user_by_session(connection_struct
*conn
,
378 const struct auth_session_info
*session_info
)
380 SMB_ASSERT(conn
!= NULL
);
381 SMB_ASSERT(session_info
!= NULL
);
383 if ((current_user
.conn
== conn
) &&
384 (current_user
.ut
.uid
== session_info
->unix_token
->uid
)) {
385 DEBUG(7, ("Skipping user change - already user\n"));
390 return change_to_user_internal(conn
, session_info
, UID_FIELD_INVALID
);
393 /****************************************************************************
394 Go back to being root without changing the security context stack,
395 but modify the current_user entries.
396 ****************************************************************************/
398 bool smbd_change_to_root_user(void)
402 DEBUG(5,("change_to_root_user: now uid=(%d,%d) gid=(%d,%d)\n",
403 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
405 current_user
.conn
= NULL
;
406 current_user
.vuid
= UID_FIELD_INVALID
;
411 /****************************************************************************
412 Become the user of an authenticated connected named pipe.
413 When this is called we are currently running as the connection
414 user. Doesn't modify current_user.
415 ****************************************************************************/
417 bool become_authenticated_pipe_user(struct auth_session_info
*session_info
)
422 set_sec_ctx(session_info
->unix_token
->uid
, session_info
->unix_token
->gid
,
423 session_info
->unix_token
->ngroups
, session_info
->unix_token
->groups
,
424 session_info
->security_token
);
429 /****************************************************************************
430 Unbecome the user of an authenticated connected named pipe.
431 When this is called we are running as the authenticated pipe
432 user and need to go back to being the connection user. Doesn't modify
434 ****************************************************************************/
436 bool unbecome_authenticated_pipe_user(void)
438 return pop_sec_ctx();
441 /****************************************************************************
442 Utility functions used by become_xxx/unbecome_xxx.
443 ****************************************************************************/
445 static void push_conn_ctx(void)
447 struct conn_ctx
*ctx_p
;
449 /* Check we don't overflow our stack */
451 if (conn_ctx_stack_ndx
== MAX_SEC_CTX_DEPTH
) {
452 DEBUG(0, ("Connection context stack overflow!\n"));
453 smb_panic("Connection context stack overflow!\n");
456 /* Store previous user context */
457 ctx_p
= &conn_ctx_stack
[conn_ctx_stack_ndx
];
459 ctx_p
->conn
= current_user
.conn
;
460 ctx_p
->vuid
= current_user
.vuid
;
462 DEBUG(4, ("push_conn_ctx(%llu) : conn_ctx_stack_ndx = %d\n",
463 (unsigned long long)ctx_p
->vuid
, conn_ctx_stack_ndx
));
465 conn_ctx_stack_ndx
++;
468 static void pop_conn_ctx(void)
470 struct conn_ctx
*ctx_p
;
472 /* Check for stack underflow. */
474 if (conn_ctx_stack_ndx
== 0) {
475 DEBUG(0, ("Connection context stack underflow!\n"));
476 smb_panic("Connection context stack underflow!\n");
479 conn_ctx_stack_ndx
--;
480 ctx_p
= &conn_ctx_stack
[conn_ctx_stack_ndx
];
482 current_user
.conn
= ctx_p
->conn
;
483 current_user
.vuid
= ctx_p
->vuid
;
486 ctx_p
->vuid
= UID_FIELD_INVALID
;
489 /****************************************************************************
490 Temporarily become a root user. Must match with unbecome_root(). Saves and
491 restores the connection context.
492 ****************************************************************************/
494 void smbd_become_root(void)
497 * no good way to handle push_sec_ctx() failing without changing
498 * the prototype of become_root()
500 if (!push_sec_ctx()) {
501 smb_panic("become_root: push_sec_ctx failed");
507 /* Unbecome the root user */
509 void smbd_unbecome_root(void)
515 /****************************************************************************
516 Push the current security context then force a change via change_to_user().
517 Saves and restores the connection context.
518 ****************************************************************************/
520 bool become_user(connection_struct
*conn
, uint64_t vuid
)
527 if (!change_to_user(conn
, vuid
)) {
536 bool become_user_by_session(connection_struct
*conn
,
537 const struct auth_session_info
*session_info
)
544 if (!change_to_user_by_session(conn
, session_info
)) {
553 bool unbecome_user(void)
560 /****************************************************************************
561 Return the current user we are running effectively as on this connection.
562 I'd like to make this return conn->session_info->unix_token->uid, but become_root()
563 doesn't alter this value.
564 ****************************************************************************/
566 uid_t
get_current_uid(connection_struct
*conn
)
568 return current_user
.ut
.uid
;
571 /****************************************************************************
572 Return the current group we are running effectively as on this connection.
573 I'd like to make this return conn->session_info->unix_token->gid, but become_root()
574 doesn't alter this value.
575 ****************************************************************************/
577 gid_t
get_current_gid(connection_struct
*conn
)
579 return current_user
.ut
.gid
;
582 /****************************************************************************
583 Return the UNIX token we are running effectively as on this connection.
584 I'd like to make this return &conn->session_info->unix_token-> but become_root()
585 doesn't alter this value.
586 ****************************************************************************/
588 const struct security_unix_token
*get_current_utok(connection_struct
*conn
)
590 return ¤t_user
.ut
;
593 /****************************************************************************
594 Return the Windows token we are running effectively as on this connection.
595 If this is currently a NULL token as we're inside become_root() - a temporary
596 UNIX security override, then we search up the stack for the previous active
598 ****************************************************************************/
600 const struct security_token
*get_current_nttok(connection_struct
*conn
)
602 if (current_user
.nt_user_token
) {
603 return current_user
.nt_user_token
;
605 return sec_ctx_active_token();
608 uint64_t get_current_vuid(connection_struct
*conn
)
610 return current_user
.vuid
;