source3/smbd/uid.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    uid/user handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/passwd.h"
  22 #include "smbd/smbd.h"
  23 #include "smbd/globals.h"
  24 #include "../librpc/gen_ndr/netlogon.h"
  25 #include "libcli/security/security.h"
  26 #include "passdb/lookup_sid.h"
  27 #include "auth.h"
  28
  29 /* what user is current? */
  30 extern struct current_user current_user;
  31
  32 /****************************************************************************
  33  Become the guest user without changing the security context stack.
  34 ****************************************************************************/
  35
  36 bool change_to_guest(void)
  37 {
  38         struct passwd *pass;
  39
  40         pass = Get_Pwnam_alloc(talloc_tos(), lp_guestaccount());
  41         if (!pass) {
  42                 return false;
  43         }
  44
  45 #ifdef AIX
  46         /* MWW: From AIX FAQ patch to WU-ftpd: call initgroups before
  47            setting IDs */
  48         initgroups(pass->pw_name, pass->pw_gid);
  49 #endif
  50
  51         set_sec_ctx(pass->pw_uid, pass->pw_gid, 0, NULL, NULL);
  52
  53         current_user.conn = NULL;
  54         current_user.vuid = UID_FIELD_INVALID;
  55
  56         TALLOC_FREE(pass);
  57
  58         return true;
  59 }
  60
  61 /****************************************************************************
  62  talloc free the conn->session_info if not used in the vuid cache.
  63 ****************************************************************************/
  64
  65 static void free_conn_session_info_if_unused(connection_struct *conn)
  66 {
  67         unsigned int i;
  68
  69         for (i = 0; i < VUID_CACHE_SIZE; i++) {
  70                 struct vuid_cache_entry *ent;
  71                 ent = &conn->vuid_cache.array[i];
  72                 if (ent->vuid != UID_FIELD_INVALID &&
  73                                 conn->session_info == ent->session_info) {
  74                         return;
  75                 }
  76         }
  77         /* Not used, safe to free. */
  78         TALLOC_FREE(conn->session_info);
  79 }
  80
  81 /*******************************************************************
  82  Check if a username is OK.
  83
  84  This sets up conn->session_info with a copy related to this vuser that
  85  later code can then mess with.
  86 ********************************************************************/
  87
  88 static bool check_user_ok(connection_struct *conn,
  89                         uint64_t vuid,
  90                         const struct auth_session_info *session_info,
  91                         int snum)
  92 {
  93         unsigned int i;
  94         bool readonly_share;
  95         bool admin_user;
  96         struct vuid_cache_entry *ent = NULL;
  97
  98         for (i=0; i<VUID_CACHE_SIZE; i++) {
  99                 ent = &conn->vuid_cache.array[i];
 100                 if (ent->vuid == vuid) {
 101                         free_conn_session_info_if_unused(conn);
 102                         conn->session_info = ent->session_info;
 103                         conn->read_only = ent->read_only;
 104                         return(True);
 105                 }
 106         }
 107
 108         if (!user_ok_token(session_info->unix_info->unix_name,
 109                            session_info->info->domain_name,
 110                            session_info->security_token, snum))
 111                 return(False);
 112
 113         readonly_share = is_share_read_only_for_token(
 114                 session_info->unix_info->unix_name,
 115                 session_info->info->domain_name,
 116                 session_info->security_token,
 117                 conn);
 118
 119         if (!readonly_share &&
 120             !share_access_check(session_info->security_token,
 121                                 lp_servicename(talloc_tos(), snum),
 122                                 FILE_WRITE_DATA,
 123                                 NULL)) {
 124                 /* smb.conf allows r/w, but the security descriptor denies
 125                  * write. Fall back to looking at readonly. */
 126                 readonly_share = True;
 127                 DEBUG(5,("falling back to read-only access-evaluation due to "
 128                          "security descriptor\n"));
 129         }
 130
 131         if (!share_access_check(session_info->security_token,
 132                                 lp_servicename(talloc_tos(), snum),
 133                                 readonly_share ?
 134                                 FILE_READ_DATA : FILE_WRITE_DATA,
 135                                 NULL)) {
 136                 return False;
 137         }
 138
 139         admin_user = token_contains_name_in_list(
 140                 session_info->unix_info->unix_name,
 141                 session_info->info->domain_name,
 142                 NULL, session_info->security_token, lp_admin_users(snum));
 143
 144         ent = &conn->vuid_cache.array[conn->vuid_cache.next_entry];
 145
 146         conn->vuid_cache.next_entry =
 147                 (conn->vuid_cache.next_entry + 1) % VUID_CACHE_SIZE;
 148
 149         TALLOC_FREE(ent->session_info);
 150
 151         /*
 152          * If force_user was set, all session_info's are based on the same
 153          * username-based faked one.
 154          */
 155
 156         ent->session_info = copy_session_info(
 157                 conn, conn->force_user ? conn->session_info : session_info);
 158
 159         if (ent->session_info == NULL) {
 160                 ent->vuid = UID_FIELD_INVALID;
 161                 return false;
 162         }
 163
 164         ent->vuid = vuid;
 165         ent->read_only = readonly_share;
 166         free_conn_session_info_if_unused(conn);
 167         conn->session_info = ent->session_info;
 168
 169         conn->read_only = readonly_share;
 170         if (admin_user) {
 171                 DEBUG(2,("check_user_ok: user %s is an admin user. "
 172                         "Setting uid as %d\n",
 173                         conn->session_info->unix_info->unix_name,
 174                         sec_initial_uid() ));
 175                 conn->session_info->unix_token->uid = sec_initial_uid();
 176         }
 177
 178         return(True);
 179 }
 180
 181 /****************************************************************************
 182  Become the user of a connection number without changing the security context
 183  stack, but modify the current_user entries.
 184 ****************************************************************************/
 185
 186 static bool change_to_user_internal(connection_struct *conn,
 187                                     const struct auth_session_info *session_info,
 188                                     uint64_t vuid)
 189 {
 190         int snum;
 191         gid_t gid;
 192         uid_t uid;
 193         char group_c;
 194         int num_groups = 0;
 195         gid_t *group_list = NULL;
 196         bool ok;
 197
 198         snum = SNUM(conn);
 199
 200         ok = check_user_ok(conn, vuid, session_info, snum);
 201         if (!ok) {
 202                 DEBUG(2,("SMB user %s (unix user %s) "
 203                          "not permitted access to share %s.\n",
 204                          session_info->unix_info->sanitized_username,
 205                          session_info->unix_info->unix_name,
 206                          lp_servicename(talloc_tos(), snum)));
 207                 return false;
 208         }
 209
 210         uid = conn->session_info->unix_token->uid;
 211         gid = conn->session_info->unix_token->gid;
 212         num_groups = conn->session_info->unix_token->ngroups;
 213         group_list  = conn->session_info->unix_token->groups;
 214
 215         /*
 216          * See if we should force group for this service. If so this overrides
 217          * any group set in the force user code.
 218          */
 219         if((group_c = *lp_force_group(talloc_tos(), snum))) {
 220
 221                 SMB_ASSERT(conn->force_group_gid != (gid_t)-1);
 222
 223                 if (group_c == '+') {
 224                         int i;
 225
 226                         /*
 227                          * Only force group if the user is a member of the
 228                          * service group. Check the group memberships for this
 229                          * user (we already have this) to see if we should force
 230                          * the group.
 231                          */
 232                         for (i = 0; i < num_groups; i++) {
 233                                 if (group_list[i] == conn->force_group_gid) {
 234                                         conn->session_info->unix_token->gid =
 235                                                 conn->force_group_gid;
 236                                         gid = conn->force_group_gid;
 237                                         gid_to_sid(&conn->session_info->security_token
 238                                                    ->sids[1], gid);
 239                                         break;
 240                                 }
 241                         }
 242                 } else {
 243                         conn->session_info->unix_token->gid = conn->force_group_gid;
 244                         gid = conn->force_group_gid;
 245                         gid_to_sid(&conn->session_info->security_token->sids[1],
 246                                    gid);
 247                 }
 248         }
 249
 250         /*Set current_user since we will immediately also call set_sec_ctx() */
 251         current_user.ut.ngroups = num_groups;
 252         current_user.ut.groups  = group_list;
 253
 254         set_sec_ctx(uid,
 255                     gid,
 256                     current_user.ut.ngroups,
 257                     current_user.ut.groups,
 258                     conn->session_info->security_token);
 259
 260         current_user.conn = conn;
 261         current_user.vuid = vuid;
 262
 263         DEBUG(5, ("Impersonated user: uid=(%d,%d), gid=(%d,%d)\n",
 264                  (int)getuid(),
 265                  (int)geteuid(),
 266                  (int)getgid(),
 267                  (int)getegid()));
 268
 269         return true;
 270 }
 271
 272 bool change_to_user(connection_struct *conn, uint64_t vuid)
 273 {
 274         const struct auth_session_info *session_info = NULL;
 275         struct user_struct *vuser;
 276         int snum = SNUM(conn);
 277
 278         if (!conn) {
 279                 DEBUG(2,("Connection not open\n"));
 280                 return(False);
 281         }
 282
 283         vuser = get_valid_user_struct(conn->sconn, vuid);
 284
 285         if ((current_user.conn == conn) &&
 286                    (vuser != NULL) && (current_user.vuid == vuid) &&
 287                    (current_user.ut.uid == vuser->session_info->unix_token->uid)) {
 288                 DEBUG(4,("Skipping user change - already "
 289                          "user\n"));
 290                 return(True);
 291         }
 292
 293         if (vuser == NULL) {
 294                 /* Invalid vuid sent */
 295                 DEBUG(2,("Invalid vuid %llu used on share %s.\n",
 296                          (unsigned long long)vuid, lp_servicename(talloc_tos(),
 297                                                                   snum)));
 298                 return false;
 299         }
 300
 301         session_info = vuser->session_info;
 302         return change_to_user_internal(conn, session_info, vuid);
 303 }
 304
 305 static bool change_to_user_by_session(connection_struct *conn,
 306                                       const struct auth_session_info *session_info)
 307 {
 308         SMB_ASSERT(conn != NULL);
 309         SMB_ASSERT(session_info != NULL);
 310
 311         if ((current_user.conn == conn) &&
 312             (current_user.ut.uid == session_info->unix_token->uid)) {
 313                 DEBUG(7, ("Skipping user change - already user\n"));
 314
 315                 return true;
 316         }
 317
 318         return change_to_user_internal(conn, session_info, UID_FIELD_INVALID);
 319 }
 320
 321 /****************************************************************************
 322  Go back to being root without changing the security context stack,
 323  but modify the current_user entries.
 324 ****************************************************************************/
 325
 326 bool smbd_change_to_root_user(void)
 327 {
 328         set_root_sec_ctx();
 329
 330         DEBUG(5,("change_to_root_user: now uid=(%d,%d) gid=(%d,%d)\n",
 331                 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
 332
 333         current_user.conn = NULL;
 334         current_user.vuid = UID_FIELD_INVALID;
 335
 336         return(True);
 337 }
 338
 339 /****************************************************************************
 340  Become the user of an authenticated connected named pipe.
 341  When this is called we are currently running as the connection
 342  user. Doesn't modify current_user.
 343 ****************************************************************************/
 344
 345 bool become_authenticated_pipe_user(struct auth_session_info *session_info)
 346 {
 347         if (!push_sec_ctx())
 348                 return False;
 349
 350         set_sec_ctx(session_info->unix_token->uid, session_info->unix_token->gid,
 351                     session_info->unix_token->ngroups, session_info->unix_token->groups,
 352                     session_info->security_token);
 353
 354         return True;
 355 }
 356
 357 /****************************************************************************
 358  Unbecome the user of an authenticated connected named pipe.
 359  When this is called we are running as the authenticated pipe
 360  user and need to go back to being the connection user. Doesn't modify
 361  current_user.
 362 ****************************************************************************/
 363
 364 bool unbecome_authenticated_pipe_user(void)
 365 {
 366         return pop_sec_ctx();
 367 }
 368
 369 /****************************************************************************
 370  Utility functions used by become_xxx/unbecome_xxx.
 371 ****************************************************************************/
 372
 373 static void push_conn_ctx(void)
 374 {
 375         struct conn_ctx *ctx_p;
 376
 377         /* Check we don't overflow our stack */
 378
 379         if (conn_ctx_stack_ndx == MAX_SEC_CTX_DEPTH) {
 380                 DEBUG(0, ("Connection context stack overflow!\n"));
 381                 smb_panic("Connection context stack overflow!\n");
 382         }
 383
 384         /* Store previous user context */
 385         ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 386
 387         ctx_p->conn = current_user.conn;
 388         ctx_p->vuid = current_user.vuid;
 389
 390         DEBUG(4, ("push_conn_ctx(%llu) : conn_ctx_stack_ndx = %d\n",
 391                 (unsigned long long)ctx_p->vuid, conn_ctx_stack_ndx));
 392
 393         conn_ctx_stack_ndx++;
 394 }
 395
 396 static void pop_conn_ctx(void)
 397 {
 398         struct conn_ctx *ctx_p;
 399
 400         /* Check for stack underflow. */
 401
 402         if (conn_ctx_stack_ndx == 0) {
 403                 DEBUG(0, ("Connection context stack underflow!\n"));
 404                 smb_panic("Connection context stack underflow!\n");
 405         }
 406
 407         conn_ctx_stack_ndx--;
 408         ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 409
 410         current_user.conn = ctx_p->conn;
 411         current_user.vuid = ctx_p->vuid;
 412
 413         ctx_p->conn = NULL;
 414         ctx_p->vuid = UID_FIELD_INVALID;
 415 }
 416
 417 /****************************************************************************
 418  Temporarily become a root user.  Must match with unbecome_root(). Saves and
 419  restores the connection context.
 420 ****************************************************************************/
 421
 422 void smbd_become_root(void)
 423 {
 424          /*
 425           * no good way to handle push_sec_ctx() failing without changing
 426           * the prototype of become_root()
 427           */
 428         if (!push_sec_ctx()) {
 429                 smb_panic("become_root: push_sec_ctx failed");
 430         }
 431         push_conn_ctx();
 432         set_root_sec_ctx();
 433 }
 434
 435 /* Unbecome the root user */
 436
 437 void smbd_unbecome_root(void)
 438 {
 439         pop_sec_ctx();
 440         pop_conn_ctx();
 441 }
 442
 443 /****************************************************************************
 444  Push the current security context then force a change via change_to_user().
 445  Saves and restores the connection context.
 446 ****************************************************************************/
 447
 448 bool become_user(connection_struct *conn, uint64_t vuid)
 449 {
 450         if (!push_sec_ctx())
 451                 return False;
 452
 453         push_conn_ctx();
 454
 455         if (!change_to_user(conn, vuid)) {
 456                 pop_sec_ctx();
 457                 pop_conn_ctx();
 458                 return False;
 459         }
 460
 461         return True;
 462 }
 463
 464 bool become_user_by_session(connection_struct *conn,
 465                             const struct auth_session_info *session_info)
 466 {
 467         if (!push_sec_ctx())
 468                 return false;
 469
 470         push_conn_ctx();
 471
 472         if (!change_to_user_by_session(conn, session_info)) {
 473                 pop_sec_ctx();
 474                 pop_conn_ctx();
 475                 return false;
 476         }
 477
 478         return true;
 479 }
 480
 481 bool unbecome_user(void)
 482 {
 483         pop_sec_ctx();
 484         pop_conn_ctx();
 485         return True;
 486 }
 487
 488 /****************************************************************************
 489  Return the current user we are running effectively as on this connection.
 490  I'd like to make this return conn->session_info->unix_token->uid, but become_root()
 491  doesn't alter this value.
 492 ****************************************************************************/
 493
 494 uid_t get_current_uid(connection_struct *conn)
 495 {
 496         return current_user.ut.uid;
 497 }
 498
 499 /****************************************************************************
 500  Return the current group we are running effectively as on this connection.
 501  I'd like to make this return conn->session_info->unix_token->gid, but become_root()
 502  doesn't alter this value.
 503 ****************************************************************************/
 504
 505 gid_t get_current_gid(connection_struct *conn)
 506 {
 507         return current_user.ut.gid;
 508 }
 509
 510 /****************************************************************************
 511  Return the UNIX token we are running effectively as on this connection.
 512  I'd like to make this return &conn->session_info->unix_token-> but become_root()
 513  doesn't alter this value.
 514 ****************************************************************************/
 515
 516 const struct security_unix_token *get_current_utok(connection_struct *conn)
 517 {
 518         return &current_user.ut;
 519 }
 520
 521 /****************************************************************************
 522  Return the Windows token we are running effectively as on this connection.
 523  If this is currently a NULL token as we're inside become_root() - a temporary
 524  UNIX security override, then we search up the stack for the previous active
 525  token.
 526 ****************************************************************************/
 527
 528 const struct security_token *get_current_nttok(connection_struct *conn)
 529 {
 530         if (current_user.nt_user_token) {
 531                 return current_user.nt_user_token;
 532         }
 533         return sec_ctx_active_token();
 534 }
 535
 536 uint64_t get_current_vuid(connection_struct *conn)
 537 {
 538         return current_user.vuid;
 539 }