source: vendor/current/source4/auth/unix_token.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 4.7 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Deal with unix elements in the security token
5
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett 2011
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "auth/auth.h"
25#include "libcli/wbclient/wbclient.h"
26#include "param/param.h"
27
28/*
29 form a security_unix_token from the current security_token
30*/
31NTSTATUS security_token_to_unix_token(TALLOC_CTX *mem_ctx,
32 struct tevent_context *ev,
33 struct security_token *token,
34 struct security_unix_token **sec)
35{
36 uint32_t s, g;
37 NTSTATUS status;
38 struct id_map *ids;
39
40 /* we can't do unix security without a user and group */
41 if (token->num_sids < 2) {
42 return NT_STATUS_ACCESS_DENIED;
43 }
44
45 *sec = talloc_zero(mem_ctx, struct security_unix_token);
46 if (*sec == NULL) {
47 return NT_STATUS_NO_MEMORY;
48 }
49
50 ids = talloc_zero_array(mem_ctx, struct id_map, token->num_sids);
51 NT_STATUS_HAVE_NO_MEMORY(ids);
52
53 for (s=0; s < token->num_sids; s++) {
54 ids[s].sid = &token->sids[s];
55 ids[s].status = ID_UNKNOWN;
56 }
57
58 status = wbc_sids_to_xids(ev, ids, token->num_sids);
59 NT_STATUS_NOT_OK_RETURN(status);
60
61 g = token->num_sids;
62 if (ids[0].xid.type != ID_TYPE_BOTH) {
63 g--;
64 }
65 (*sec)->ngroups = g;
66 (*sec)->groups = talloc_array(*sec, gid_t, (*sec)->ngroups);
67 NT_STATUS_HAVE_NO_MEMORY((*sec)->groups);
68
69 g=0;
70 if (ids[0].xid.type == ID_TYPE_BOTH) {
71 (*sec)->uid = ids[0].xid.id;
72 (*sec)->groups[g] = ids[0].xid.id;
73 g++;
74 } else if (ids[0].xid.type == ID_TYPE_UID) {
75 (*sec)->uid = ids[0].xid.id;
76 } else {
77 char *sid_str = dom_sid_string(mem_ctx, ids[0].sid);
78 DEBUG(0, ("Unable to convert first SID (%s) in user token to a UID. Conversion was returned as type %d, full token:\n",
79 sid_str, (int)ids[0].xid.type));
80 security_token_debug(0, 0, token);
81 talloc_free(sid_str);
82 return NT_STATUS_INVALID_SID;
83 }
84
85 if (ids[1].xid.type == ID_TYPE_BOTH ||
86 ids[1].xid.type == ID_TYPE_GID) {
87 (*sec)->gid = ids[1].xid.id;
88 (*sec)->groups[g] = ids[1].xid.id;
89 g++;
90 } else {
91 char *sid_str = dom_sid_string(mem_ctx, ids[1].sid);
92 DEBUG(0, ("Unable to convert second SID (%s) in user token to a GID. Conversion was returned as type %d, full token:\n",
93 sid_str, (int)ids[1].xid.type));
94 security_token_debug(0, 0, token);
95 talloc_free(sid_str);
96 return NT_STATUS_INVALID_SID;
97 }
98
99 for (s=2; s < token->num_sids; s++) {
100 if (ids[s].xid.type == ID_TYPE_BOTH ||
101 ids[s].xid.type == ID_TYPE_GID) {
102 (*sec)->groups[g] = ids[s].xid.id;
103 g++;
104 } else {
105 char *sid_str = dom_sid_string(mem_ctx, ids[s].sid);
106 DEBUG(0, ("Unable to convert SID (%s) at index %u in user token to a GID. Conversion was returned as type %d, full token:\n",
107 sid_str, (unsigned int)s, (int)ids[s].xid.type));
108 security_token_debug(0, 0, token);
109 talloc_free(sid_str);
110 return NT_STATUS_INVALID_SID;
111 }
112 }
113
114 DEBUG(5, ("Successfully converted security token to a unix token:"));
115 security_token_debug(0, 5, token);
116 TALLOC_FREE(ids);
117
118 return NT_STATUS_OK;
119}
120
121/*
122 Fill in the auth_user_info_unix and auth_unix_token elements in a struct session_info
123*/
124NTSTATUS auth_session_info_fill_unix(struct tevent_context *ev,
125 struct loadparm_context *lp_ctx,
126 const char *original_user_name,
127 struct auth_session_info *session_info)
128{
129 char *su;
130 size_t len;
131 NTSTATUS status = security_token_to_unix_token(session_info, ev,
132 session_info->security_token,
133 &session_info->unix_token);
134 if (!NT_STATUS_IS_OK(status)) {
135 return status;
136 }
137
138 session_info->unix_info = talloc_zero(session_info, struct auth_user_info_unix);
139 NT_STATUS_HAVE_NO_MEMORY(session_info->unix_info);
140
141 session_info->unix_info->unix_name = talloc_asprintf(session_info->unix_info,
142 "%s%s%s", session_info->info->domain_name,
143 lpcfg_winbind_separator(lp_ctx),
144 session_info->info->account_name);
145 NT_STATUS_HAVE_NO_MEMORY(session_info->unix_info->unix_name);
146
147 len = strlen(original_user_name) + 1;
148 session_info->unix_info->sanitized_username = su = talloc_array(session_info->unix_info, char, len);
149 NT_STATUS_HAVE_NO_MEMORY(su);
150
151 alpha_strcpy(su, original_user_name,
152 ". _-$", len);
153
154 return NT_STATUS_OK;
155}
Note: See TracBrowser for help on using the repository browser.