source: trunk/server/source4/ntvfs/unixuid/vfs_unixuid.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 18.2 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 a pass-thru NTVFS module to setup a security context using unix
5 uid/gid
6
7 Copyright (C) Andrew Tridgell 2004
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "system/filesys.h"
25#include "system/passwd.h"
26#include "auth/auth.h"
27#include "ntvfs/ntvfs.h"
28#include "libcli/wbclient/wbclient.h"
29#define TEVENT_DEPRECATED
30#include <tevent.h>
31
32#if defined(UID_WRAPPER)
33#if !defined(UID_WRAPPER_REPLACE) && !defined(UID_WRAPPER_NOT_REPLACE)
34#define UID_WRAPPER_REPLACE
35#include "../uid_wrapper/uid_wrapper.h"
36#endif
37#else
38#define uwrap_enabled() 0
39#endif
40
41
42struct unixuid_private {
43 struct wbc_context *wbc_ctx;
44 struct unix_sec_ctx *last_sec_ctx;
45 struct security_token *last_token;
46};
47
48
49
50struct unix_sec_ctx {
51 uid_t uid;
52 gid_t gid;
53 unsigned int ngroups;
54 gid_t *groups;
55};
56
57/*
58 pull the current security context into a unix_sec_ctx
59*/
60static struct unix_sec_ctx *save_unix_security(TALLOC_CTX *mem_ctx)
61{
62 struct unix_sec_ctx *sec = talloc(mem_ctx, struct unix_sec_ctx);
63 if (sec == NULL) {
64 return NULL;
65 }
66 sec->uid = geteuid();
67 sec->gid = getegid();
68 sec->ngroups = getgroups(0, NULL);
69 if (sec->ngroups == -1) {
70 talloc_free(sec);
71 return NULL;
72 }
73 sec->groups = talloc_array(sec, gid_t, sec->ngroups);
74 if (sec->groups == NULL) {
75 talloc_free(sec);
76 return NULL;
77 }
78
79 if (getgroups(sec->ngroups, sec->groups) != sec->ngroups) {
80 talloc_free(sec);
81 return NULL;
82 }
83
84 return sec;
85}
86
87/*
88 set the current security context from a unix_sec_ctx
89*/
90static NTSTATUS set_unix_security(struct unix_sec_ctx *sec)
91{
92 seteuid(0);
93
94 if (setgroups(sec->ngroups, sec->groups) != 0) {
95 return NT_STATUS_ACCESS_DENIED;
96 }
97 if (setegid(sec->gid) != 0) {
98 return NT_STATUS_ACCESS_DENIED;
99 }
100 if (seteuid(sec->uid) != 0) {
101 return NT_STATUS_ACCESS_DENIED;
102 }
103 return NT_STATUS_OK;
104}
105
106static int unixuid_nesting_level;
107
108/*
109 called at the start and end of a tevent nesting loop. Needs to save/restore
110 unix security context
111 */
112static int unixuid_event_nesting_hook(struct tevent_context *ev,
113 void *private_data,
114 uint32_t level,
115 bool begin,
116 void *stack_ptr,
117 const char *location)
118{
119 struct unix_sec_ctx *sec_ctx;
120
121 if (unixuid_nesting_level == 0) {
122 /* we don't need to do anything unless we are nested
123 inside of a call in this module */
124 return 0;
125 }
126
127 if (begin) {
128 sec_ctx = save_unix_security(ev);
129 if (sec_ctx == NULL) {
130 DEBUG(0,("%s: Failed to save security context\n", location));
131 return -1;
132 }
133 *(struct unix_sec_ctx **)stack_ptr = sec_ctx;
134 if (seteuid(0) != 0 || setegid(0) != 0) {
135 DEBUG(0,("%s: Failed to change to root\n", location));
136 return -1;
137 }
138 } else {
139 /* called when we come out of a nesting level */
140 NTSTATUS status;
141
142 sec_ctx = *(struct unix_sec_ctx **)stack_ptr;
143 if (sec_ctx == NULL) {
144 /* this happens the first time this function
145 is called, as we install the hook while
146 inside an event in unixuid_connect() */
147 return 0;
148 }
149
150 sec_ctx = talloc_get_type_abort(sec_ctx, struct unix_sec_ctx);
151 status = set_unix_security(sec_ctx);
152 talloc_free(sec_ctx);
153 if (!NT_STATUS_IS_OK(status)) {
154 DEBUG(0,("%s: Failed to revert security context (%s)\n",
155 location, nt_errstr(status)));
156 return -1;
157 }
158 }
159
160 return 0;
161}
162
163
164/*
165 form a unix_sec_ctx from the current security_token
166*/
167static NTSTATUS nt_token_to_unix_security(struct ntvfs_module_context *ntvfs,
168 struct ntvfs_request *req,
169 struct security_token *token,
170 struct unix_sec_ctx **sec)
171{
172 struct unixuid_private *priv = ntvfs->private_data;
173 int i;
174 NTSTATUS status;
175 struct id_map *ids;
176 struct composite_context *ctx;
177 *sec = talloc(req, struct unix_sec_ctx);
178
179 /* we can't do unix security without a user and group */
180 if (token->num_sids < 2) {
181 return NT_STATUS_ACCESS_DENIED;
182 }
183
184 ids = talloc_array(req, struct id_map, token->num_sids);
185 NT_STATUS_HAVE_NO_MEMORY(ids);
186
187 (*sec)->ngroups = token->num_sids - 2;
188 (*sec)->groups = talloc_array(*sec, gid_t, (*sec)->ngroups);
189 NT_STATUS_HAVE_NO_MEMORY((*sec)->groups);
190
191 for (i=0;i<token->num_sids;i++) {
192 ZERO_STRUCT(ids[i].xid);
193 ids[i].sid = &token->sids[i];
194 ids[i].status = ID_UNKNOWN;
195 }
196
197 ctx = wbc_sids_to_xids_send(priv->wbc_ctx, ids, token->num_sids, ids);
198 NT_STATUS_HAVE_NO_MEMORY(ctx);
199
200 status = wbc_sids_to_xids_recv(ctx, &ids);
201 NT_STATUS_NOT_OK_RETURN(status);
202
203 if (ids[0].xid.type == ID_TYPE_BOTH ||
204 ids[0].xid.type == ID_TYPE_UID) {
205 (*sec)->uid = ids[0].xid.id;
206 } else {
207 return NT_STATUS_INVALID_SID;
208 }
209
210 if (ids[1].xid.type == ID_TYPE_BOTH ||
211 ids[1].xid.type == ID_TYPE_GID) {
212 (*sec)->gid = ids[1].xid.id;
213 } else {
214 return NT_STATUS_INVALID_SID;
215 }
216
217 for (i=0;i<(*sec)->ngroups;i++) {
218 if (ids[i+2].xid.type == ID_TYPE_BOTH ||
219 ids[i+2].xid.type == ID_TYPE_GID) {
220 (*sec)->groups[i] = ids[i+2].xid.id;
221 } else {
222 return NT_STATUS_INVALID_SID;
223 }
224 }
225
226 return NT_STATUS_OK;
227}
228
229/*
230 setup our unix security context according to the session authentication info
231*/
232static NTSTATUS unixuid_setup_security(struct ntvfs_module_context *ntvfs,
233 struct ntvfs_request *req, struct unix_sec_ctx **sec)
234{
235 struct unixuid_private *priv = ntvfs->private_data;
236 struct security_token *token;
237 struct unix_sec_ctx *newsec;
238 NTSTATUS status;
239
240 /* If we are asked to set up, but have not had a successful
241 * session setup or tree connect, then these may not be filled
242 * in. ACCESS_DENIED is the right error code here */
243 if (req->session_info == NULL || priv == NULL) {
244 return NT_STATUS_ACCESS_DENIED;
245 }
246
247 token = req->session_info->security_token;
248
249 *sec = save_unix_security(ntvfs);
250 if (*sec == NULL) {
251 return NT_STATUS_NO_MEMORY;
252 }
253
254 if (token == priv->last_token) {
255 newsec = priv->last_sec_ctx;
256 } else {
257 status = nt_token_to_unix_security(ntvfs, req, token, &newsec);
258 if (!NT_STATUS_IS_OK(status)) {
259 talloc_free(*sec);
260 return status;
261 }
262 if (priv->last_sec_ctx) {
263 talloc_free(priv->last_sec_ctx);
264 }
265 priv->last_sec_ctx = newsec;
266 priv->last_token = token;
267 talloc_steal(priv, newsec);
268 }
269
270 status = set_unix_security(newsec);
271 if (!NT_STATUS_IS_OK(status)) {
272 talloc_free(*sec);
273 return status;
274 }
275
276 return NT_STATUS_OK;
277}
278
279/*
280 this pass through macro operates on request contexts
281*/
282#define PASS_THRU_REQ(ntvfs, req, op, args) do { \
283 NTSTATUS status2; \
284 struct unix_sec_ctx *sec; \
285 status = unixuid_setup_security(ntvfs, req, &sec); \
286 NT_STATUS_NOT_OK_RETURN(status); \
287 unixuid_nesting_level++; \
288 status = ntvfs_next_##op args; \
289 unixuid_nesting_level--; \
290 status2 = set_unix_security(sec); \
291 talloc_free(sec); \
292 if (!NT_STATUS_IS_OK(status2)) smb_panic("Unable to reset security context"); \
293} while (0)
294
295
296
297/*
298 connect to a share - used when a tree_connect operation comes in.
299*/
300static NTSTATUS unixuid_connect(struct ntvfs_module_context *ntvfs,
301 struct ntvfs_request *req, union smb_tcon *tcon)
302{
303 struct unixuid_private *priv;
304 NTSTATUS status;
305
306 priv = talloc(ntvfs, struct unixuid_private);
307 if (!priv) {
308 return NT_STATUS_NO_MEMORY;
309 }
310
311 priv->wbc_ctx = wbc_init(priv, ntvfs->ctx->msg_ctx,
312 ntvfs->ctx->event_ctx);
313 if (priv->wbc_ctx == NULL) {
314 talloc_free(priv);
315 return NT_STATUS_INTERNAL_ERROR;
316 }
317
318 priv->last_sec_ctx = NULL;
319 priv->last_token = NULL;
320 ntvfs->private_data = priv;
321
322 tevent_loop_set_nesting_hook(ntvfs->ctx->event_ctx,
323 unixuid_event_nesting_hook,
324 &unixuid_nesting_level);
325
326 /* we don't use PASS_THRU_REQ here, as the connect operation runs with
327 root privileges. This allows the backends to setup any database
328 links they might need during the connect. */
329 status = ntvfs_next_connect(ntvfs, req, tcon);
330
331 return status;
332}
333
334/*
335 disconnect from a share
336*/
337static NTSTATUS unixuid_disconnect(struct ntvfs_module_context *ntvfs)
338{
339 struct unixuid_private *priv = ntvfs->private_data;
340 NTSTATUS status;
341
342 talloc_free(priv);
343 ntvfs->private_data = NULL;
344
345 status = ntvfs_next_disconnect(ntvfs);
346
347 return status;
348}
349
350
351/*
352 delete a file
353*/
354static NTSTATUS unixuid_unlink(struct ntvfs_module_context *ntvfs,
355 struct ntvfs_request *req,
356 union smb_unlink *unl)
357{
358 NTSTATUS status;
359
360 PASS_THRU_REQ(ntvfs, req, unlink, (ntvfs, req, unl));
361
362 return status;
363}
364
365/*
366 ioctl interface
367*/
368static NTSTATUS unixuid_ioctl(struct ntvfs_module_context *ntvfs,
369 struct ntvfs_request *req, union smb_ioctl *io)
370{
371 NTSTATUS status;
372
373 PASS_THRU_REQ(ntvfs, req, ioctl, (ntvfs, req, io));
374
375 return status;
376}
377
378/*
379 check if a directory exists
380*/
381static NTSTATUS unixuid_chkpath(struct ntvfs_module_context *ntvfs,
382 struct ntvfs_request *req,
383 union smb_chkpath *cp)
384{
385 NTSTATUS status;
386
387 PASS_THRU_REQ(ntvfs, req, chkpath, (ntvfs, req, cp));
388
389 return status;
390}
391
392/*
393 return info on a pathname
394*/
395static NTSTATUS unixuid_qpathinfo(struct ntvfs_module_context *ntvfs,
396 struct ntvfs_request *req, union smb_fileinfo *info)
397{
398 NTSTATUS status;
399
400 PASS_THRU_REQ(ntvfs, req, qpathinfo, (ntvfs, req, info));
401
402 return status;
403}
404
405/*
406 query info on a open file
407*/
408static NTSTATUS unixuid_qfileinfo(struct ntvfs_module_context *ntvfs,
409 struct ntvfs_request *req, union smb_fileinfo *info)
410{
411 NTSTATUS status;
412
413 PASS_THRU_REQ(ntvfs, req, qfileinfo, (ntvfs, req, info));
414
415 return status;
416}
417
418
419/*
420 set info on a pathname
421*/
422static NTSTATUS unixuid_setpathinfo(struct ntvfs_module_context *ntvfs,
423 struct ntvfs_request *req, union smb_setfileinfo *st)
424{
425 NTSTATUS status;
426
427 PASS_THRU_REQ(ntvfs, req, setpathinfo, (ntvfs, req, st));
428
429 return status;
430}
431
432/*
433 open a file
434*/
435static NTSTATUS unixuid_open(struct ntvfs_module_context *ntvfs,
436 struct ntvfs_request *req, union smb_open *io)
437{
438 NTSTATUS status;
439
440 PASS_THRU_REQ(ntvfs, req, open, (ntvfs, req, io));
441
442 return status;
443}
444
445/*
446 create a directory
447*/
448static NTSTATUS unixuid_mkdir(struct ntvfs_module_context *ntvfs,
449 struct ntvfs_request *req, union smb_mkdir *md)
450{
451 NTSTATUS status;
452
453 PASS_THRU_REQ(ntvfs, req, mkdir, (ntvfs, req, md));
454
455 return status;
456}
457
458/*
459 remove a directory
460*/
461static NTSTATUS unixuid_rmdir(struct ntvfs_module_context *ntvfs,
462 struct ntvfs_request *req, struct smb_rmdir *rd)
463{
464 NTSTATUS status;
465
466 PASS_THRU_REQ(ntvfs, req, rmdir, (ntvfs, req, rd));
467
468 return status;
469}
470
471/*
472 rename a set of files
473*/
474static NTSTATUS unixuid_rename(struct ntvfs_module_context *ntvfs,
475 struct ntvfs_request *req, union smb_rename *ren)
476{
477 NTSTATUS status;
478
479 PASS_THRU_REQ(ntvfs, req, rename, (ntvfs, req, ren));
480
481 return status;
482}
483
484/*
485 copy a set of files
486*/
487static NTSTATUS unixuid_copy(struct ntvfs_module_context *ntvfs,
488 struct ntvfs_request *req, struct smb_copy *cp)
489{
490 NTSTATUS status;
491
492 PASS_THRU_REQ(ntvfs, req, copy, (ntvfs, req, cp));
493
494 return status;
495}
496
497/*
498 read from a file
499*/
500static NTSTATUS unixuid_read(struct ntvfs_module_context *ntvfs,
501 struct ntvfs_request *req, union smb_read *rd)
502{
503 NTSTATUS status;
504
505 PASS_THRU_REQ(ntvfs, req, read, (ntvfs, req, rd));
506
507 return status;
508}
509
510/*
511 write to a file
512*/
513static NTSTATUS unixuid_write(struct ntvfs_module_context *ntvfs,
514 struct ntvfs_request *req, union smb_write *wr)
515{
516 NTSTATUS status;
517
518 PASS_THRU_REQ(ntvfs, req, write, (ntvfs, req, wr));
519
520 return status;
521}
522
523/*
524 seek in a file
525*/
526static NTSTATUS unixuid_seek(struct ntvfs_module_context *ntvfs,
527 struct ntvfs_request *req,
528 union smb_seek *io)
529{
530 NTSTATUS status;
531
532 PASS_THRU_REQ(ntvfs, req, seek, (ntvfs, req, io));
533
534 return status;
535}
536
537/*
538 flush a file
539*/
540static NTSTATUS unixuid_flush(struct ntvfs_module_context *ntvfs,
541 struct ntvfs_request *req,
542 union smb_flush *io)
543{
544 NTSTATUS status;
545
546 PASS_THRU_REQ(ntvfs, req, flush, (ntvfs, req, io));
547
548 return status;
549}
550
551/*
552 close a file
553*/
554static NTSTATUS unixuid_close(struct ntvfs_module_context *ntvfs,
555 struct ntvfs_request *req, union smb_close *io)
556{
557 NTSTATUS status;
558
559 PASS_THRU_REQ(ntvfs, req, close, (ntvfs, req, io));
560
561 return status;
562}
563
564/*
565 exit - closing files
566*/
567static NTSTATUS unixuid_exit(struct ntvfs_module_context *ntvfs,
568 struct ntvfs_request *req)
569{
570 NTSTATUS status;
571
572 PASS_THRU_REQ(ntvfs, req, exit, (ntvfs, req));
573
574 return status;
575}
576
577/*
578 logoff - closing files
579*/
580static NTSTATUS unixuid_logoff(struct ntvfs_module_context *ntvfs,
581 struct ntvfs_request *req)
582{
583 struct unixuid_private *priv = ntvfs->private_data;
584 NTSTATUS status;
585
586 PASS_THRU_REQ(ntvfs, req, logoff, (ntvfs, req));
587
588 priv->last_token = NULL;
589
590 return status;
591}
592
593/*
594 async setup
595*/
596static NTSTATUS unixuid_async_setup(struct ntvfs_module_context *ntvfs,
597 struct ntvfs_request *req,
598 void *private_data)
599{
600 NTSTATUS status;
601
602 PASS_THRU_REQ(ntvfs, req, async_setup, (ntvfs, req, private_data));
603
604 return status;
605}
606
607/*
608 cancel an async request
609*/
610static NTSTATUS unixuid_cancel(struct ntvfs_module_context *ntvfs,
611 struct ntvfs_request *req)
612{
613 NTSTATUS status;
614
615 PASS_THRU_REQ(ntvfs, req, cancel, (ntvfs, req));
616
617 return status;
618}
619
620/*
621 change notify
622*/
623static NTSTATUS unixuid_notify(struct ntvfs_module_context *ntvfs,
624 struct ntvfs_request *req, union smb_notify *info)
625{
626 NTSTATUS status;
627
628 PASS_THRU_REQ(ntvfs, req, notify, (ntvfs, req, info));
629
630 return status;
631}
632
633/*
634 lock a byte range
635*/
636static NTSTATUS unixuid_lock(struct ntvfs_module_context *ntvfs,
637 struct ntvfs_request *req, union smb_lock *lck)
638{
639 NTSTATUS status;
640
641 PASS_THRU_REQ(ntvfs, req, lock, (ntvfs, req, lck));
642
643 return status;
644}
645
646/*
647 set info on a open file
648*/
649static NTSTATUS unixuid_setfileinfo(struct ntvfs_module_context *ntvfs,
650 struct ntvfs_request *req,
651 union smb_setfileinfo *info)
652{
653 NTSTATUS status;
654
655 PASS_THRU_REQ(ntvfs, req, setfileinfo, (ntvfs, req, info));
656
657 return status;
658}
659
660
661/*
662 return filesystem space info
663*/
664static NTSTATUS unixuid_fsinfo(struct ntvfs_module_context *ntvfs,
665 struct ntvfs_request *req, union smb_fsinfo *fs)
666{
667 NTSTATUS status;
668
669 PASS_THRU_REQ(ntvfs, req, fsinfo, (ntvfs, req, fs));
670
671 return status;
672}
673
674/*
675 return print queue info
676*/
677static NTSTATUS unixuid_lpq(struct ntvfs_module_context *ntvfs,
678 struct ntvfs_request *req, union smb_lpq *lpq)
679{
680 NTSTATUS status;
681
682 PASS_THRU_REQ(ntvfs, req, lpq, (ntvfs, req, lpq));
683
684 return status;
685}
686
687/*
688 list files in a directory matching a wildcard pattern
689*/
690static NTSTATUS unixuid_search_first(struct ntvfs_module_context *ntvfs,
691 struct ntvfs_request *req, union smb_search_first *io,
692 void *search_private,
693 bool (*callback)(void *, const union smb_search_data *))
694{
695 NTSTATUS status;
696
697 PASS_THRU_REQ(ntvfs, req, search_first, (ntvfs, req, io, search_private, callback));
698
699 return status;
700}
701
702/* continue a search */
703static NTSTATUS unixuid_search_next(struct ntvfs_module_context *ntvfs,
704 struct ntvfs_request *req, union smb_search_next *io,
705 void *search_private,
706 bool (*callback)(void *, const union smb_search_data *))
707{
708 NTSTATUS status;
709
710 PASS_THRU_REQ(ntvfs, req, search_next, (ntvfs, req, io, search_private, callback));
711
712 return status;
713}
714
715/* close a search */
716static NTSTATUS unixuid_search_close(struct ntvfs_module_context *ntvfs,
717 struct ntvfs_request *req, union smb_search_close *io)
718{
719 NTSTATUS status;
720
721 PASS_THRU_REQ(ntvfs, req, search_close, (ntvfs, req, io));
722
723 return status;
724}
725
726/* SMBtrans - not used on file shares */
727static NTSTATUS unixuid_trans(struct ntvfs_module_context *ntvfs,
728 struct ntvfs_request *req, struct smb_trans2 *trans2)
729{
730 NTSTATUS status;
731
732 PASS_THRU_REQ(ntvfs, req, trans, (ntvfs, req, trans2));
733
734 return status;
735}
736
737/*
738 initialise the unixuid backend, registering ourselves with the ntvfs subsystem
739 */
740NTSTATUS ntvfs_unixuid_init(void)
741{
742 NTSTATUS ret;
743 struct ntvfs_ops ops;
744 NTVFS_CURRENT_CRITICAL_SIZES(vers);
745
746 ZERO_STRUCT(ops);
747
748 /* fill in all the operations */
749 ops.connect = unixuid_connect;
750 ops.disconnect = unixuid_disconnect;
751 ops.unlink = unixuid_unlink;
752 ops.chkpath = unixuid_chkpath;
753 ops.qpathinfo = unixuid_qpathinfo;
754 ops.setpathinfo = unixuid_setpathinfo;
755 ops.open = unixuid_open;
756 ops.mkdir = unixuid_mkdir;
757 ops.rmdir = unixuid_rmdir;
758 ops.rename = unixuid_rename;
759 ops.copy = unixuid_copy;
760 ops.ioctl = unixuid_ioctl;
761 ops.read = unixuid_read;
762 ops.write = unixuid_write;
763 ops.seek = unixuid_seek;
764 ops.flush = unixuid_flush;
765 ops.close = unixuid_close;
766 ops.exit = unixuid_exit;
767 ops.lock = unixuid_lock;
768 ops.setfileinfo = unixuid_setfileinfo;
769 ops.qfileinfo = unixuid_qfileinfo;
770 ops.fsinfo = unixuid_fsinfo;
771 ops.lpq = unixuid_lpq;
772 ops.search_first = unixuid_search_first;
773 ops.search_next = unixuid_search_next;
774 ops.search_close = unixuid_search_close;
775 ops.trans = unixuid_trans;
776 ops.logoff = unixuid_logoff;
777 ops.async_setup = unixuid_async_setup;
778 ops.cancel = unixuid_cancel;
779 ops.notify = unixuid_notify;
780
781 ops.name = "unixuid";
782
783 /* we register under all 3 backend types, as we are not type specific */
784 ops.type = NTVFS_DISK;
785 ret = ntvfs_register(&ops, &vers);
786 if (!NT_STATUS_IS_OK(ret)) goto failed;
787
788 ops.type = NTVFS_PRINT;
789 ret = ntvfs_register(&ops, &vers);
790 if (!NT_STATUS_IS_OK(ret)) goto failed;
791
792 ops.type = NTVFS_IPC;
793 ret = ntvfs_register(&ops, &vers);
794 if (!NT_STATUS_IS_OK(ret)) goto failed;
795
796failed:
797 return ret;
798}
Note: See TracBrowser for help on using the repository browser.