2 Unix SMB/CIFS implementation.
4 Deal with unix elements in the security token
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett 2011
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "auth/auth.h"
25 #include "libcli/wbclient/wbclient.h"
26 #include "param/param.h"
29 form a security_unix_token from the current security_token
31 NTSTATUS
security_token_to_unix_token(TALLOC_CTX
*mem_ctx
,
32 struct wbc_context
*wbc_ctx
,
33 struct security_token
*token
,
34 struct security_unix_token
**sec
)
39 struct composite_context
*ctx
;
41 /* we can't do unix security without a user and group */
42 if (token
->num_sids
< 2) {
43 return NT_STATUS_ACCESS_DENIED
;
46 *sec
= talloc_zero(mem_ctx
, struct security_unix_token
);
48 return NT_STATUS_NO_MEMORY
;
51 ids
= talloc_zero_array(mem_ctx
, struct id_map
, token
->num_sids
);
52 NT_STATUS_HAVE_NO_MEMORY(ids
);
54 for (s
=0; s
< token
->num_sids
; s
++) {
55 ids
[s
].sid
= &token
->sids
[s
];
56 ids
[s
].status
= ID_UNKNOWN
;
59 ctx
= wbc_sids_to_xids_send(wbc_ctx
, ids
, token
->num_sids
, ids
);
60 NT_STATUS_HAVE_NO_MEMORY(ctx
);
62 status
= wbc_sids_to_xids_recv(ctx
, &ids
);
63 NT_STATUS_NOT_OK_RETURN(status
);
66 if (ids
[0].xid
.type
!= ID_TYPE_BOTH
) {
70 (*sec
)->groups
= talloc_array(*sec
, gid_t
, (*sec
)->ngroups
);
71 NT_STATUS_HAVE_NO_MEMORY((*sec
)->groups
);
74 if (ids
[0].xid
.type
== ID_TYPE_BOTH
) {
75 (*sec
)->uid
= ids
[0].xid
.id
;
76 (*sec
)->groups
[g
] = ids
[0].xid
.id
;
78 } else if (ids
[0].xid
.type
== ID_TYPE_UID
) {
79 (*sec
)->uid
= ids
[0].xid
.id
;
81 return NT_STATUS_INVALID_SID
;
84 if (ids
[1].xid
.type
== ID_TYPE_BOTH
||
85 ids
[1].xid
.type
== ID_TYPE_GID
) {
86 (*sec
)->gid
= ids
[1].xid
.id
;
87 (*sec
)->groups
[g
] = ids
[1].xid
.id
;
90 return NT_STATUS_INVALID_SID
;
93 for (s
=2; s
< token
->num_sids
; s
++) {
94 if (ids
[s
].xid
.type
== ID_TYPE_BOTH
||
95 ids
[s
].xid
.type
== ID_TYPE_GID
) {
96 (*sec
)->groups
[g
] = ids
[s
].xid
.id
;
99 return NT_STATUS_INVALID_SID
;
109 Fill in the auth_user_info_unix and auth_unix_token elements in a struct session_info
111 NTSTATUS
auth_session_info_fill_unix( struct wbc_context
*wbc_ctx
,
112 struct loadparm_context
*lp_ctx
,
113 struct auth_session_info
*session_info
)
117 NTSTATUS status
= security_token_to_unix_token(session_info
, wbc_ctx
,
118 session_info
->security_token
,
119 &session_info
->unix_token
);
120 if (!NT_STATUS_IS_OK(status
)) {
124 session_info
->unix_info
= talloc_zero(session_info
, struct auth_user_info_unix
);
125 NT_STATUS_HAVE_NO_MEMORY(session_info
->unix_info
);
127 session_info
->unix_info
->system
= security_token_is_system(session_info
->security_token
);
129 session_info
->unix_info
->unix_name
= talloc_asprintf(session_info
->unix_info
,
130 "%s%s%s", session_info
->info
->domain_name
,
131 lpcfg_winbind_separator(lp_ctx
),
132 session_info
->info
->account_name
);
133 NT_STATUS_HAVE_NO_MEMORY(session_info
->unix_info
->unix_name
);
135 len
= strlen(session_info
->info
->account_name
) + 1;
136 session_info
->unix_info
->sanitized_username
= su
= talloc_array(session_info
->unix_info
, char, len
);
137 NT_STATUS_HAVE_NO_MEMORY(su
);
139 alpha_strcpy(su
, session_info
->info
->account_name
,