2 Unix SMB/CIFS implementation.
4 Deal with unix elements in the security token
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett 2011
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "auth/auth.h"
25 #include "libcli/wbclient/wbclient.h"
26 #include "param/param.h"
29 form a security_unix_token from the current security_token
31 NTSTATUS
security_token_to_unix_token(TALLOC_CTX
*mem_ctx
,
32 struct wbc_context
*wbc_ctx
,
33 struct security_token
*token
,
34 struct security_unix_token
**sec
)
39 struct composite_context
*ctx
;
40 *sec
= talloc(mem_ctx
, struct security_unix_token
);
42 /* we can't do unix security without a user and group */
43 if (token
->num_sids
< 2) {
44 return NT_STATUS_ACCESS_DENIED
;
47 ids
= talloc_array(mem_ctx
, struct id_map
, token
->num_sids
);
48 NT_STATUS_HAVE_NO_MEMORY(ids
);
50 (*sec
)->ngroups
= token
->num_sids
- 2;
51 (*sec
)->groups
= talloc_array(*sec
, gid_t
, (*sec
)->ngroups
);
52 NT_STATUS_HAVE_NO_MEMORY((*sec
)->groups
);
54 for (i
=0;i
<token
->num_sids
;i
++) {
55 ZERO_STRUCT(ids
[i
].xid
);
56 ids
[i
].sid
= &token
->sids
[i
];
57 ids
[i
].status
= ID_UNKNOWN
;
60 ctx
= wbc_sids_to_xids_send(wbc_ctx
, ids
, token
->num_sids
, ids
);
61 NT_STATUS_HAVE_NO_MEMORY(ctx
);
63 status
= wbc_sids_to_xids_recv(ctx
, &ids
);
64 NT_STATUS_NOT_OK_RETURN(status
);
66 if (ids
[0].xid
.type
== ID_TYPE_BOTH
||
67 ids
[0].xid
.type
== ID_TYPE_UID
) {
68 (*sec
)->uid
= ids
[0].xid
.id
;
70 return NT_STATUS_INVALID_SID
;
73 if (ids
[1].xid
.type
== ID_TYPE_BOTH
||
74 ids
[1].xid
.type
== ID_TYPE_GID
) {
75 (*sec
)->gid
= ids
[1].xid
.id
;
77 return NT_STATUS_INVALID_SID
;
80 for (i
=0;i
<(*sec
)->ngroups
;i
++) {
81 if (ids
[i
+2].xid
.type
== ID_TYPE_BOTH
||
82 ids
[i
+2].xid
.type
== ID_TYPE_GID
) {
83 (*sec
)->groups
[i
] = ids
[i
+2].xid
.id
;
85 return NT_STATUS_INVALID_SID
;
95 Fill in the auth_user_info_unix and auth_unix_token elements in a struct session_info
97 NTSTATUS
auth_session_info_fill_unix( struct wbc_context
*wbc_ctx
,
98 struct loadparm_context
*lp_ctx
,
99 struct auth_session_info
*session_info
)
103 NTSTATUS status
= security_token_to_unix_token(session_info
, wbc_ctx
,
104 session_info
->security_token
,
105 &session_info
->unix_token
);
106 if (!NT_STATUS_IS_OK(status
)) {
110 session_info
->unix_info
= talloc_zero(session_info
, struct auth_user_info_unix
);
111 NT_STATUS_HAVE_NO_MEMORY(session_info
->unix_info
);
113 session_info
->unix_info
->system
= security_token_is_system(session_info
->security_token
);
115 session_info
->unix_info
->unix_name
= talloc_asprintf(session_info
->unix_info
,
116 "%s%s%s", session_info
->info
->domain_name
,
117 lpcfg_winbind_separator(lp_ctx
),
118 session_info
->info
->account_name
);
119 NT_STATUS_HAVE_NO_MEMORY(session_info
->unix_info
->unix_name
);
121 len
= strlen(session_info
->info
->account_name
) + 1;
122 session_info
->unix_info
->sanitized_username
= su
= talloc_array(session_info
->unix_info
, char, len
);
123 NT_STATUS_HAVE_NO_MEMORY(su
);
125 alpha_strcpy(su
, session_info
->info
->account_name
,