Changeset 988 for vendor/current/libcli/security

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/libcli/security

Files:

• access_check.c (modified) (8 diffs)
• access_check.h (modified) (2 diffs)
• create_descriptor.c (modified) (12 diffs)
• display_sec.c (modified) (3 diffs)
• dom_sid.c (modified) (8 diffs)
• dom_sid.h (modified) (4 diffs)
• object_tree.c (modified) (2 diffs)
• privileges.c (modified) (1 diff)
• privileges.h (modified) (1 diff)
• pysecurity.c (modified) (1 diff)
• sddl.c (modified) (1 diff)
• secace.c (modified) (1 diff)
• secace.h (modified) (1 diff)
• secacl.c (modified) (5 diffs)
• secacl.h (modified) (1 diff)
• secdesc.c (added)
• secdesc.h (added)
• security.h (modified) (2 diffs)
• security_descriptor.c (modified) (5 diffs)
• security_descriptor.h (modified) (2 diffs)
• security_token.c (modified) (2 diffs)
• security_token.h (modified) (1 diff)
• session.c (modified) (1 diff)
• session.h (modified) (2 diffs)
• util_sid.c (modified) (11 diffs)
• wscript_build (modified) (1 diff)

vendor/current/libcli/security/access_check.c

@@ -160 +160 @@
         uint32_t bits_remaining;
         uint32_t explicitly_denied_bits = 0;
+        /*
+         * Up until Windows Server 2008, owner always had these rights. Now
+         * we have to use Owner Rights perms if they are on the file.
+         *
+         * In addition we have to accumulate these bits and apply them
+         * correctly. See bug #8795
+         */
+        uint32_t owner_rights_allowed = 0;
+        uint32_t owner_rights_denied = 0;
+        bool owner_rights_default = true;
 
         *access_granted = access_desired;
@@ -179 +189 @@
         }
 
-        /* the owner always gets SEC_STD_WRITE_DAC and SEC_STD_READ_CONTROL */
-        if ((bits_remaining & (SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL)) &&
-            security_token_has_sid(token, sd->owner_sid)) {
-                bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL);
-        }
-
         /* a NULL dacl allows access */
         if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
@@ -203 +207 @@
                 }
 
+                /*
+                 * We need the Owner Rights permissions to ensure we
+                 * give or deny the correct permissions to the owner. Replace
+                 * owner_rights with the perms here if it is present.
+                 *
+                 * We don't care if we are not the owner because that is taken
+                 * care of below when we check if our token has the owner SID.
+                 *
+                 */
+                if (dom_sid_equal(&ace->trustee, &global_sid_Owner_Rights)) {
+                        if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED) {
+                                owner_rights_allowed |= ace->access_mask;
+                                owner_rights_default = false;
+                        } else if (ace->type == SEC_ACE_TYPE_ACCESS_DENIED) {
+                                owner_rights_denied |= ace->access_mask;
+                                owner_rights_default = false;
+                        }
+                        continue;
+                }
+
                 if (!security_token_has_sid(token, &ace->trustee)) {
                         continue;
@@ -220 +244 @@
         }
 
+        /* Explicitly denied bits always override */
         bits_remaining |= explicitly_denied_bits;
+
+        /* The owner always gets owner rights as defined above. */
+        if (security_token_has_sid(token, sd->owner_sid)) {
+                if (owner_rights_default) {
+                        /*
+                         * Just remove them, no need to check if they are
+                         * there.
+                         */
+                        bits_remaining &= ~(SEC_STD_WRITE_DAC |
+                                                SEC_STD_READ_CONTROL);
+                } else {
+                        bits_remaining &= ~owner_rights_allowed;
+                        bits_remaining |= owner_rights_denied;
+                }
+        }
 
         /*
@@ -235 +275 @@
         }
 
-        /* TODO: remove this, as it is file server specific */
-        if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
-            security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
-                bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
-        }
-        if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
-            security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
-                bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
-        }
-
         if ((bits_remaining & SEC_STD_WRITE_OWNER) &&
              security_token_has_privilege(token, SEC_PRIV_TAKE_OWNERSHIP)) {
@@ -259 +289 @@
 }
 
+/*
+  The main entry point for access checking FOR THE FILE SERVER ONLY !
+  If returning ACCESS_DENIED this function returns the denied bits in
+  the uint32_t pointed to by the access_granted pointer.
+*/
+NTSTATUS se_file_access_check(const struct security_descriptor *sd,
+                          const struct security_token *token,
+                          bool priv_open_requested,
+                          uint32_t access_desired,
+                          uint32_t *access_granted)
+{
+        uint32_t bits_remaining;
+        NTSTATUS status;
+
+        if (!priv_open_requested) {
+                /* Fall back to generic se_access_check(). */
+                return se_access_check(sd,
+                                token,
+                                access_desired,
+                                access_granted);
+        }
+
+        /*
+         * We need to handle the maximum allowed flag
+         * outside of se_access_check(), as we need to
+         * add in the access allowed by the privileges
+         * as well.
+         */
+
+        if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
+                uint32_t orig_access_desired = access_desired;
+
+                access_desired |= access_check_max_allowed(sd, token);
+                access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
+
+                if (security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
+                        access_desired |= SEC_RIGHTS_PRIV_BACKUP;
+                }
+
+                if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
+                        access_desired |= SEC_RIGHTS_PRIV_RESTORE;
+                }
+
+                DEBUG(10,("se_file_access_check: MAX desired = 0x%x "
+                        "mapped to 0x%x\n",
+                        orig_access_desired,
+                        access_desired));
+        }
+
+        status = se_access_check(sd,
+                                token,
+                                access_desired,
+                                access_granted);
+
+        if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
+                return status;
+        }
+
+        bits_remaining = *access_granted;
+
+        /* Check if we should override with privileges. */
+        if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
+            security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
+                bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
+        }
+        if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
+            security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
+                bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
+        }
+        if (bits_remaining != 0) {
+                *access_granted = bits_remaining;
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        return NT_STATUS_OK;
+}
 
 static const struct GUID *get_ace_object_type(struct security_ace *ace)
 {
-        struct GUID *type;
-
-        if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT)
-                type = &ace->object.object.type.type;
-        else if (ace->object.object.flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)
-                type = &ace->object.object.inherited_type.inherited_type; /* This doesn't look right. Is something wrong with the IDL? */
-        else
-                type = NULL;
-
-        return type;
-
-}
-
-/* modified access check for the purposes of DS security
+        if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
+                return &ace->object.object.type.type;
+        }
+
+        return NULL;
+}
+
+/**
+ * @brief Perform directoryservice (DS) related access checks for a given user
+ *
+ * Perform DS access checks for the user represented by its security_token, on
+ * the provided security descriptor. If an tree associating GUID and access
+ * required is provided then object access (OA) are checked as well. *
+ * @param[in]   sd             The security descritor against which the required
+ *                             access are requested
+ *
+ * @param[in]   token          The security_token associated with the user to
+ *                             test
+ *
+ * @param[in]   access_desired A bitfield of rights that must be granted for the
+ *                             given user in the specified SD.
+ *
+ * If one
+ * of the entry in the tree grants all the requested rights for the given GUID
+ * FIXME
+ * tree can be null if not null it's the
  * Lots of code duplication, it will ve united in just one
  * function eventually */
@@ -286 +404 @@
                              struct dom_sid *replace_sid)
 {
-        uint32_t i;
-        uint32_t bits_remaining;
-        struct object_tree *node;
-        const struct GUID *type;
-        struct dom_sid *ps_sid = dom_sid_parse_talloc(NULL, SID_NT_SELF);
-
-        *access_granted = access_desired;
-        bits_remaining = access_desired;
-
-        /* handle the maximum allowed flag */
-        if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
-                access_desired |= access_check_max_allowed(sd, token);
-                access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
-                *access_granted = access_desired;
+        uint32_t i;
+        uint32_t bits_remaining;
+        struct object_tree *node;
+        const struct GUID *type;
+        struct dom_sid self_sid;
+
+        dom_sid_parse(SID_NT_SELF, &self_sid);
+
+        *access_granted = access_desired;
+        bits_remaining = access_desired;
+
+        /* handle the maximum allowed flag */
+        if (access_desired & SEC_FLAG_MAXIMUM_ALLOWED) {
+                access_desired |= access_check_max_allowed(sd, token);
+                access_desired &= ~SEC_FLAG_MAXIMUM_ALLOWED;
+                *access_granted = access_desired;
                 bits_remaining = access_desired;
-        }
-
-        if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
-                if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
-                        bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
-                } else {
-                        talloc_free(ps_sid);
-                        return NT_STATUS_PRIVILEGE_NOT_HELD;
-                }
-        }
+        }
+
+        if (access_desired & SEC_FLAG_SYSTEM_SECURITY) {
+                if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
+                        bits_remaining &= ~SEC_FLAG_SYSTEM_SECURITY;
+                } else {
+                        return NT_STATUS_PRIVILEGE_NOT_HELD;
+                }
+        }
 
         /* the owner always gets SEC_STD_WRITE_DAC and SEC_STD_READ_CONTROL */
@@ -318 +437 @@
         }
 
-        /* TODO: remove this, as it is file server specific */
-        if ((bits_remaining & SEC_RIGHTS_PRIV_RESTORE) &&
-            security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
-                bits_remaining &= ~(SEC_RIGHTS_PRIV_RESTORE);
-        }
-        if ((bits_remaining & SEC_RIGHTS_PRIV_BACKUP) &&
-            security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
-                bits_remaining &= ~(SEC_RIGHTS_PRIV_BACKUP);
-        }
-
-        /* a NULL dacl allows access */
-        if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
-                *access_granted = access_desired;
-                talloc_free(ps_sid);
-                return NT_STATUS_OK;
-        }
-
-        if (sd->dacl == NULL) {
-                goto done;
-        }
-
-        /* check each ace in turn. */
-        for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
+        /* SEC_PRIV_TAKE_OWNERSHIP grants SEC_STD_WRITE_OWNER */
+        if ((bits_remaining & (SEC_STD_WRITE_OWNER)) &&
+            security_token_has_privilege(token, SEC_PRIV_TAKE_OWNERSHIP)) {
+                bits_remaining &= ~(SEC_STD_WRITE_OWNER);
+        }
+
+        /* a NULL dacl allows access */
+        if ((sd->type & SEC_DESC_DACL_PRESENT) && sd->dacl == NULL) {
+                *access_granted = access_desired;
+                return NT_STATUS_OK;
+        }
+
+        if (sd->dacl == NULL) {
+                goto done;
+        }
+
+        /* check each ace in turn. */
+        for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
                 struct dom_sid *trustee;
                 struct security_ace *ace = &sd->dacl->aces[i];
 
-                if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
-                        continue;
-                }
-                if (dom_sid_equal(&ace->trustee, ps_sid) && replace_sid) {
+                if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) {
+                        continue;
+                }
+
+                if (dom_sid_equal(&ace->trustee, &self_sid) && replace_sid) {
                         trustee = replace_sid;
-                }
-                else
-                {
+                } else {
                         trustee = &ace->trustee;
                 }
-                if (!security_token_has_sid(token, trustee)) {
-                        continue;
-                }
-
-                switch (ace->type) {
-                case SEC_ACE_TYPE_ACCESS_ALLOWED:
-                        if (tree)
-                                object_tree_modify_access(tree, ace->access_mask);
-
-                        bits_remaining &= ~ace->access_mask;
-                        break;
-                case SEC_ACE_TYPE_ACCESS_DENIED:
-                        if (bits_remaining & ace->access_mask) {
-                                talloc_free(ps_sid);
-                                return NT_STATUS_ACCESS_DENIED;
-                        }
-                        break;
-                case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
-                case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
-                        /* check only in case we have provided a tree,
-                         * the ACE has an object type and that type
-                         * is in the tree                           */
-                        type = get_ace_object_type(ace);
-
-                        if (!tree)
-                                continue;
-
-                        if (!type)
-                                node = tree;
-                        else
-                                if (!(node = get_object_tree_by_GUID(tree, type)))
-                                        continue;
-
-                        if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
-                                object_tree_modify_access(node, ace->access_mask);
-                                if (node->remaining_access == 0) {
-                                        talloc_free(ps_sid);
-                                        return NT_STATUS_OK;
-                                }
-                        } else {
-                                if (node->remaining_access & ace->access_mask){
-                                        talloc_free(ps_sid);
-                                        return NT_STATUS_ACCESS_DENIED;
-                                }
-                        }
-                        break;
-                default:        /* Other ACE types not handled/supported */
-                        break;
-                }
-        }
+
+                if (!security_token_has_sid(token, trustee)) {
+                        continue;
+                }
+
+                switch (ace->type) {
+                case SEC_ACE_TYPE_ACCESS_ALLOWED:
+                        if (tree) {
+                                object_tree_modify_access(tree, ace->access_mask);
+                        }
+
+                        bits_remaining &= ~ace->access_mask;
+                        break;
+                case SEC_ACE_TYPE_ACCESS_DENIED:
+                        if (bits_remaining & ace->access_mask) {
+                                return NT_STATUS_ACCESS_DENIED;
+                        }
+                        break;
+                case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
+                case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
+                        /*
+                         * check only in case we have provided a tree,
+                         * the ACE has an object type and that type
+                         * is in the tree
+                         */
+                        type = get_ace_object_type(ace);
+
+                        if (!tree) {
+                                continue;
+                        }
+
+                        if (!type) {
+                                node = tree;
+                        } else {
+                                if (!(node = get_object_tree_by_GUID(tree, type))) {
+                                        continue;
+                                }
+                        }
+
+                        if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT) {
+                                object_tree_modify_access(node, ace->access_mask);
+                                if (node->remaining_access == 0) {
+                                        return NT_STATUS_OK;
+                                }
+                        } else {
+                                if (node->remaining_access & ace->access_mask){
+                                        return NT_STATUS_ACCESS_DENIED;
+                                }
+                        }
+                        break;
+                default:        /* Other ACE types not handled/supported */
+                        break;
+                }
+        }
 
 done:
-        talloc_free(ps_sid);
-        if (bits_remaining != 0) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        return NT_STATUS_OK;
-}
+        if (bits_remaining != 0) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        return NT_STATUS_OK;
+}

vendor/current/libcli/security/access_check.h

@@ -55 +55 @@
                          uint32_t *access_granted);
 
+/*
+  The main entry point for access checking FOR THE FILE SERVER ONLY !
+  If returning ACCESS_DENIED this function returns the denied bits in
+  the uint32_t pointed to by the access_granted pointer.
+*/
+NTSTATUS se_file_access_check(const struct security_descriptor *sd,
+                         const struct security_token *token,
+                         bool priv_open_requested,
+                         uint32_t access_desired,
+                         uint32_t *access_granted);
+
 /* modified access check for the purposes of DS security
  * Lots of code duplication, it will ve united in just one
@@ -67 +78 @@
 
 bool insert_in_object_tree(TALLOC_CTX *mem_ctx,
-                          const struct GUID *guid,
-                          uint32_t init_access,
-                          struct object_tree **root,
-                           struct object_tree **new_node);
+                           const struct GUID *guid,
+                           uint32_t init_access,
+                           struct object_tree *root,
+                           struct object_tree **new_node_out);
 
 /* search by GUID */

vendor/current/libcli/security/create_descriptor.c

@@ -81 +81 @@
 static bool object_in_list(struct GUID *object_list, struct GUID *object)
 {
-        return true;
-}
- 
+        size_t i;
+
+        if (object_list == NULL) {
+                return true;
+        }
+
+        if (GUID_all_zero(object)) {
+                return true;
+        }
+
+        for (i=0; ; i++) {
+                if (GUID_all_zero(&object_list[i])) {
+                        return false;
+                }
+                if (!GUID_equal(&object_list[i], object)) {
+                        continue;
+                }
+
+                return true;
+        }
+
+        return false;
+}
+
 /* returns true if the ACE gontains generic information
  * that needs to be processed additionally */
  
-static bool desc_ace_has_generic(TALLOC_CTX *mem_ctx,
-                             struct security_ace *ace)
-{
-        struct dom_sid *co, *cg;
-        co = dom_sid_parse_talloc(mem_ctx,  SID_CREATOR_OWNER);
-        cg = dom_sid_parse_talloc(mem_ctx,  SID_CREATOR_GROUP);
+static bool desc_ace_has_generic(struct security_ace *ace)
+{
         if (ace->access_mask & SEC_GENERIC_ALL || ace->access_mask & SEC_GENERIC_READ ||
             ace->access_mask & SEC_GENERIC_WRITE || ace->access_mask & SEC_GENERIC_EXECUTE) {
                 return true;
         }
-        if (dom_sid_equal(&ace->trustee, co) || dom_sid_equal(&ace->trustee, cg)) {
+        if (dom_sid_equal(&ace->trustee, &global_sid_Creator_Owner) ||
+            dom_sid_equal(&ace->trustee, &global_sid_Creator_Group)) {
                 return true;
         }
@@ -105 +123 @@
 /* creates an ace in which the generic information is expanded */
 
-static void desc_expand_generic(TALLOC_CTX *mem_ctx,
-                                struct security_ace *new_ace,
+static void desc_expand_generic(struct security_ace *new_ace,
                                 struct dom_sid *owner,
                                 struct dom_sid *group)
 {
-        struct dom_sid *co, *cg;
-        co = dom_sid_parse_talloc(mem_ctx,  SID_CREATOR_OWNER);
-        cg = dom_sid_parse_talloc(mem_ctx,  SID_CREATOR_GROUP);
         new_ace->access_mask = map_generic_rights_ds(new_ace->access_mask);
-        if (dom_sid_equal(&new_ace->trustee, co)) {
+        if (dom_sid_equal(&new_ace->trustee, &global_sid_Creator_Owner)) {
                 new_ace->trustee = *owner;
         }
-        if (dom_sid_equal(&new_ace->trustee, cg)) {
+        if (dom_sid_equal(&new_ace->trustee, &global_sid_Creator_Group)) {
                 new_ace->trustee = *group;
         }
@@ -133 +147 @@
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
         struct security_acl *tmp_acl = talloc_zero(mem_ctx, struct security_acl);
-        struct dom_sid *co, *cg;
         if (!tmp_acl) {
                 return NULL;
@@ -141 +154 @@
                 return NULL;
         }
-        co = dom_sid_parse_talloc(tmp_ctx,  SID_CREATOR_OWNER);
-        cg = dom_sid_parse_talloc(tmp_ctx,  SID_CREATOR_GROUP);
 
         for (i=0; i < acl->num_aces; i++) {
@@ -148 +159 @@
                 if ((ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) ||
                     (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
+                        struct GUID inherited_object = GUID_zero();
+
                         tmp_acl->aces = talloc_realloc(tmp_acl, tmp_acl->aces,
                                                        struct security_ace,
@@ -160 +173 @@
                         /* remove IO flag from the child's ace */
                         if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY &&
-                            !desc_ace_has_generic(tmp_ctx, ace)) {
+                            !desc_ace_has_generic(ace)) {
                                 tmp_acl->aces[tmp_acl->num_aces].flags &= ~SEC_ACE_FLAG_INHERIT_ONLY;
                         }
@@ -167 +180 @@
                             tmp_acl->aces[tmp_acl->num_aces].flags |= SEC_ACE_FLAG_INHERIT_ONLY;
 
-                        if (ace->type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT ||
-                            ace->type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT) {
-                                if (!object_in_list(object_list, &ace->object.object.type.type)) {
+                        switch (ace->type) {
+                        case SEC_ACE_TYPE_ACCESS_ALLOWED:
+                        case SEC_ACE_TYPE_ACCESS_DENIED:
+                        case SEC_ACE_TYPE_SYSTEM_AUDIT:
+                        case SEC_ACE_TYPE_SYSTEM_ALARM:
+                        case SEC_ACE_TYPE_ALLOWED_COMPOUND:
+                                break;
+
+                        case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
+                        case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
+                        case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
+                        case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
+                                if (ace->object.object.flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT) {
+                                        inherited_object = ace->object.object.inherited_type.inherited_type;
+                                }
+
+                                if (!object_in_list(object_list, &inherited_object)) {
                                         tmp_acl->aces[tmp_acl->num_aces].flags |= SEC_ACE_FLAG_INHERIT_ONLY;
                                 }
 
-                        }
+                                break;
+                        }
+
                         tmp_acl->num_aces++;
                         if (is_container) {
                                 if (!(ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) &&
-                                    (desc_ace_has_generic(tmp_ctx, ace))) {
+                                    (desc_ace_has_generic(ace))) {
                                             tmp_acl->aces = talloc_realloc(tmp_acl,
                                                                            tmp_acl->aces,
@@ -187 +216 @@
                                             }
                                             tmp_acl->aces[tmp_acl->num_aces] = *ace;
-                                            desc_expand_generic(tmp_ctx,
-                                                                &tmp_acl->aces[tmp_acl->num_aces],
+                                            desc_expand_generic(&tmp_acl->aces[tmp_acl->num_aces],
                                                                 owner,
                                                                 group);
@@ -218 +246 @@
         struct security_acl *tmp_acl = talloc_zero(tmp_ctx, struct security_acl);
         struct security_acl *new_acl;
-        struct dom_sid *co, *cg;
 
         if (!acl)
@@ -228 +255 @@
         tmp_acl->revision = acl->revision;
         DEBUG(6,(__location__ ": acl revision %d\n", acl->revision));
-
-        co = dom_sid_parse_talloc(tmp_ctx,  SID_CREATOR_OWNER);
-        cg = dom_sid_parse_talloc(tmp_ctx,  SID_CREATOR_GROUP);
 
         for (i=0; i < acl->num_aces; i++){
@@ -261 +285 @@
                  * it has to be expanded to two aces, the original as IO,
                  * and another one where these are translated */
-                if (desc_ace_has_generic(tmp_ctx, ace)) {
+                if (desc_ace_has_generic(ace)) {
                         if (!(ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
-                                desc_expand_generic(tmp_ctx,
-                                                    &tmp_acl->aces[tmp_acl->num_aces-1],
+                                desc_expand_generic(&tmp_acl->aces[tmp_acl->num_aces-1],
                                                     owner,
                                                     group);
@@ -275 +298 @@
                                 /* add a new ACE with expanded generic info */
                                 tmp_acl->aces[tmp_acl->num_aces] = *ace;
-                                desc_expand_generic(tmp_ctx,
-                                                    &tmp_acl->aces[tmp_acl->num_aces],
+                                desc_expand_generic(&tmp_acl->aces[tmp_acl->num_aces],
                                                     owner,
                                                     group);

vendor/current/libcli/security/display_sec.c

@@ -1 @@
-/* 
+/*
    Unix SMB/CIFS implementation.
    Samba utility functions
    Copyright (C) Andrew Tridgell 1992-1999
    Copyright (C) Luke Kenneth Casson Leighton 1996 - 1999
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful, 
+
+   This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
@@ -238 +238 @@
 
         printf("\tACL\tNum ACEs:\t%u\trevision:\t%x\n",
-                         sec_acl->num_aces, sec_acl->revision); 
+               sec_acl->num_aces, sec_acl->revision);
         printf("\t---\n");
 
@@ -284 +284 @@
         if (type & SEC_DESC_SELF_RELATIVE)      /* 0x8000 */
                 printf("SEC_DESC_SELF_RELATIVE ");
-        
+
         printf("\n");
 }

vendor/current/libcli/security/dom_sid.c

@@ -121 +121 @@
  Return the first character not parsed in endp.
 *****************************************************************/
+#define AUTHORITY_MASK (~(0xffffffffffffULL))
 
 bool dom_sid_parse_endp(const char *sidstr,struct dom_sid *sidout,
@@ -128 +129 @@
         char *q;
         /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
-        uint32_t conv;
+        uint64_t conv;
 
         ZERO_STRUCTP(sidout);
@@ -143 +144 @@
         }
 
-        conv = (uint32_t) strtoul(p, &q, 10);
-        if (!q || (*q != '-')) {
+        conv = strtoul(p, &q, 10);
+        if (!q || (*q != '-') || conv > UINT8_MAX) {
                 goto format_error;
         }
@@ -155 +156 @@
 
         /* get identauth */
-        conv = (uint32_t) strtoul(q, &q, 10);
-        if (!q) {
+        conv = strtoull(q, &q, 0);
+        if (!q || conv & AUTHORITY_MASK) {
                 goto format_error;
         }
 
-        /* identauth in decimal should be <  2^32 */
+        /* When identauth >= UINT32_MAX, it's in hex with a leading 0x */
         /* NOTE - the conv value is in big-endian format. */
-        sidout->id_auth[0] = 0;
-        sidout->id_auth[1] = 0;
-        sidout->id_auth[2] = (conv & 0xff000000) >> 24;
-        sidout->id_auth[3] = (conv & 0x00ff0000) >> 16;
-        sidout->id_auth[4] = (conv & 0x0000ff00) >> 8;
-        sidout->id_auth[5] = (conv & 0x000000ff);
+        sidout->id_auth[0] = (conv & 0xff0000000000ULL) >> 40;
+        sidout->id_auth[1] = (conv & 0x00ff00000000ULL) >> 32;
+        sidout->id_auth[2] = (conv & 0x0000ff000000ULL) >> 24;
+        sidout->id_auth[3] = (conv & 0x000000ff0000ULL) >> 16;
+        sidout->id_auth[4] = (conv & 0x00000000ff00ULL) >> 8;
+        sidout->id_auth[5] = (conv & 0x0000000000ffULL);
 
         sidout->num_auths = 0;
@@ -184 +185 @@
                 }
 
-                conv = strtoul(q, &end, 10);
-                if (end == q) {
+                conv = strtoull(q, &end, 10);
+                if (end == q || conv > UINT32_MAX) {
                         goto format_error;
                 }
@@ -243 +244 @@
 struct dom_sid *dom_sid_parse_length(TALLOC_CTX *mem_ctx, const DATA_BLOB *sid)
 {
-        struct dom_sid *ret;
-        char *p = talloc_strndup(mem_ctx, (char *)sid->data, sid->length);
-        if (!p) {
-                return NULL;
-        }
-        ret = dom_sid_parse_talloc(mem_ctx, p);
-        talloc_free(p);
-        return ret;
+        char p[sid->length+1];
+        memcpy(p, sid->data, sid->length);
+        p[sid->length] = '\0';
+        return dom_sid_parse_talloc(mem_ctx, p);
 }
 
@@ -365 +362 @@
 {
         int i, ofs;
-        uint32_t ia;
+        uint64_t ia;
 
         if (!sid) {
-                strlcpy(buf, "(NULL SID)", buflen);
-                return 10;      /* strlen("(NULL SID)") */
-        }
-
-        ia = (sid->id_auth[5]) +
-                (sid->id_auth[4] << 8 ) +
-                (sid->id_auth[3] << 16) +
-                (sid->id_auth[2] << 24);
-
-        ofs = snprintf(buf, buflen, "S-%u-%lu",
-                       (unsigned int)sid->sid_rev_num, (unsigned long)ia);
+                return strlcpy(buf, "(NULL SID)", buflen);
+        }
+
+        ia = ((uint64_t)sid->id_auth[5]) +
+                ((uint64_t)sid->id_auth[4] << 8 ) +
+                ((uint64_t)sid->id_auth[3] << 16) +
+                ((uint64_t)sid->id_auth[2] << 24) +
+                ((uint64_t)sid->id_auth[1] << 32) +
+                ((uint64_t)sid->id_auth[0] << 40);
+
+        ofs = snprintf(buf, buflen, "S-%hhu-", (unsigned char)sid->sid_rev_num);
+        if (ia >= UINT32_MAX) {
+                ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "0x%llx",
+                                (unsigned long long)ia);
+        } else {
+                ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "%llu",
+                                (unsigned long long)ia);
+        }
 
         for (i = 0; i < sid->num_auths; i++) {
-                ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "-%lu",
-                                (unsigned long)sid->sub_auths[i]);
+                ofs += snprintf(buf + ofs, MAX(buflen - ofs, 0), "-%u",
+                                (unsigned int)sid->sub_auths[i]);
         }
         return ofs;
@@ -407 +411 @@
          */
         result = (char *)talloc_memdup(mem_ctx, buf, len+1);
+        if (result == NULL) {
+                return NULL;
+        }
 
         /*

vendor/current/libcli/security/dom_sid.h

@@ -29 +29 @@
 extern const struct dom_sid global_sid_World_Domain;
 extern const struct dom_sid global_sid_World;
+extern const struct dom_sid global_sid_Local_Authority;
 extern const struct dom_sid global_sid_Creator_Owner_Domain;
 extern const struct dom_sid global_sid_NT_Authority;
@@ -36 +37 @@
 extern const struct dom_sid global_sid_Authenticated_Users;
 extern const struct dom_sid global_sid_Network;
+extern const struct dom_sid global_sid_Asserted_Identity;
+extern const struct dom_sid global_sid_Asserted_Identity_Service;
+extern const struct dom_sid global_sid_Asserted_Identity_Authentication_Authority;
 extern const struct dom_sid global_sid_Creator_Owner;
 extern const struct dom_sid global_sid_Creator_Group;
+extern const struct dom_sid global_sid_Owner_Rights;
 extern const struct dom_sid global_sid_Anonymous;
 extern const struct dom_sid global_sid_Builtin;
@@ -52 +57 @@
 extern const struct dom_sid global_sid_Unix_Users;
 extern const struct dom_sid global_sid_Unix_Groups;
+extern const struct dom_sid global_sid_Unix_NFS;
+extern const struct dom_sid global_sid_Unix_NFS_Users;
+extern const struct dom_sid global_sid_Unix_NFS_Groups;
+extern const struct dom_sid global_sid_Unix_NFS_Mode;
+extern const struct dom_sid global_sid_Unix_NFS_Other;
 
 int dom_sid_compare_auth(const struct dom_sid *sid1,
@@ -87 +97 @@
 bool sid_peek_check_rid(const struct dom_sid *exp_dom_sid, const struct dom_sid *sid, uint32_t *rid);
 void sid_copy(struct dom_sid *dst, const struct dom_sid *src);
-bool sid_blob_parse(DATA_BLOB in, struct dom_sid *sid);
-bool sid_parse(const char *inbuf, size_t len, struct dom_sid *sid);
+bool sid_parse(const uint8_t *inbuf, size_t len, struct dom_sid *sid);
 int sid_compare_domain(const struct dom_sid *sid1, const struct dom_sid *sid2);
-bool sid_equal(const struct dom_sid *sid1, const struct dom_sid *sid2);
 NTSTATUS add_sid_to_array(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
                           struct dom_sid **sids, uint32_t *num);

vendor/current/libcli/security/object_tree.c

@@ -39 +39 @@
 
 bool insert_in_object_tree(TALLOC_CTX *mem_ctx,
-                          const struct GUID *guid,
-                          uint32_t init_access,
-                          struct object_tree **root,
-                          struct object_tree **new_node)
+                           const struct GUID *guid,
+                           uint32_t init_access,
+                           struct object_tree *root,
+                           struct object_tree **new_node_out)
 {
+        struct object_tree *new_node;
+
         if (!guid || GUID_all_zero(guid)){
                 return true;
         }
 
-        if (!*root){
-                *root = talloc_zero(mem_ctx, struct object_tree);
-                if (!*root) {
+        if (!root) {
+                root = talloc_zero(mem_ctx, struct object_tree);
+                if (!root) {
                         return false;
                 }
-                (*root)->guid = *guid;
-                *new_node = *root;
-                return true;
-        }
+                new_node = root;
+        } else {
+                int i;
 
-        if (!(*root)->children) {
-                (*root)->children = talloc_array(mem_ctx, struct object_tree, 1);
-                (*root)->children[0].guid = *guid;
-                (*root)->children[0].num_of_children = 0;
-                (*root)->children[0].children = NULL;
-                (*root)->num_of_children++;
-                (*root)->children[0].remaining_access = init_access;
-                *new_node = &((*root)->children[0]);
-                return true;
-        }
-        else {
-                int i;
-                for (i = 0; i < (*root)->num_of_children; i++) {
-                        if (GUID_equal(&((*root)->children[i].guid), guid)) {
-                                *new_node = &((*root)->children[i]);
+                for (i = 0; i < root->num_of_children; i++) {
+                        if (GUID_equal(&root->children[i].guid, guid)) {
+                                new_node = &root->children[i];
+                                new_node->remaining_access |= init_access;
+                                *new_node_out = new_node;
                                 return true;
                         }
                 }
-                (*root)->children = talloc_realloc(mem_ctx, (*root)->children, struct object_tree,
-                                                   (*root)->num_of_children +1);
-                (*root)->children[(*root)->num_of_children].guid = *guid;
-                (*root)->children[(*root)->num_of_children].remaining_access = init_access;
-                *new_node = &((*root)->children[(*root)->num_of_children]);
-                (*root)->num_of_children++;
-                return true;
+
+                root->children = talloc_realloc(mem_ctx, root->children,
+                                                struct object_tree,
+                                                root->num_of_children + 1);
+                if (!root->children) {
+                        return false;
+                }
+                new_node = &root->children[root->num_of_children];
+                root->num_of_children++;
         }
+
+        new_node->children = NULL;
+        new_node->guid = *guid;
+        new_node->remaining_access = init_access;
+        new_node->num_of_children = 0;
+
+        *new_node_out = new_node;
+        return true;
 }
 
@@ -97 +98 @@
                 return result;
         }
-        else if (root->num_of_children > 0) {
-                for (i = 0; i < root->num_of_children; i++) {
+        for (i = 0; i < root->num_of_children; i++) {
                 if ((result = get_object_tree_by_GUID(&root->children[i], guid)))
                         break;
-                }
         }
         return result;
 }
 
-/* Change the granted access per each ACE */
-
+/**
+ * @brief Modify the tree to mark specified access rights as granted
+ *
+ * This function will modify the root and the child of the tree pointed by
+ * root, so that for each tree element the bits set in access_mask are
+ * marked as granted.
+ *
+ * @param[in]  root        An object_tree structure that we want to modify
+ *
+ * @param[in]  access_mask A bitfield of access right that we want to mark as
+ *                         granted in the whole tree.
+ */
 void object_tree_modify_access(struct object_tree *root,
                                uint32_t access_mask)
 {
+        int i;
         root->remaining_access &= ~access_mask;
-        if (root->num_of_children > 0) {
-                int i;
-                for (i = 0; i < root->num_of_children; i++) {
-                        object_tree_modify_access(&root->children[i], access_mask);
-                }
+        for (i = 0; i < root->num_of_children; i++) {
+                object_tree_modify_access(&root->children[i], access_mask);
         }
 }

vendor/current/libcli/security/privileges.c

@@ -423 +423 @@
 }
 
+bool security_token_system_privilege(const struct security_token *token)
+{
+        if (token == NULL) {
+                return false;
+        }
+
+        if (token->privilege_mask == (uint64_t)~0) {
+                return true;
+        }
+
+        return false;
+}
+
 /*
   set a bit in the privilege mask

vendor/current/libcli/security/privileges.h

@@ -90 +90 @@
 bool security_token_has_privilege(const struct security_token *token, enum sec_privilege privilege);
 
+
+/**
+ * @brief Check if the security token has system privileges.
+ *
+ * @param[in]  token    The token to check.
+ *
+ * @return              True if the token has system privileges, false if not.
+ */
+bool security_token_system_privilege(const struct security_token *token);
+
 /*
   set a bit in the privilege mask

vendor/current/libcli/security/pysecurity.c

@@ -45 +45 @@
         }
 
-        security_descriptor = py_talloc_get_type(py_sec_desc, struct security_descriptor);
+        security_descriptor = pytalloc_get_type(py_sec_desc, struct security_descriptor);
         if (!security_descriptor) {
                 PyErr_Format(PyExc_TypeError,
                              "Expected dcerpc.security.descriptor for security_descriptor argument got  %s",
-                             talloc_get_name(py_talloc_get_ptr(py_sec_desc)));
+                             talloc_get_name(pytalloc_get_ptr(py_sec_desc)));
                 return NULL;
         }
 
-        security_token = py_talloc_get_type(py_security_token, struct security_token);
+        security_token = pytalloc_get_type(py_security_token, struct security_token);
         if (!security_token) {
                 PyErr_Format(PyExc_TypeError,
                              "Expected dcerpc.security.token for token argument, got %s",
-                             talloc_get_name(py_talloc_get_ptr(py_security_token)));
+                             talloc_get_name(pytalloc_get_ptr(py_security_token)));
                 return NULL;
         }

vendor/current/libcli/security/sddl.c

@@ -82 +82 @@
         { "LS", SID_NT_LOCAL_SERVICE },
         { "NS", SID_NT_NETWORK_SERVICE },
+        { "IS", SID_NT_IUSR },
 
         { "BA", SID_BUILTIN_ADMINISTRATORS },

vendor/current/libcli/security/secace.c

@@ -68 +68 @@
 
         t->trustee = *sid;
-}
-
-/*******************************************************************
- adds new SID with its permissions to ACE list
-********************************************************************/
-
-NTSTATUS sec_ace_add_sid(TALLOC_CTX *ctx, struct security_ace **pp_new, struct security_ace *old, unsigned *num, const struct dom_sid *sid, uint32_t mask)
-{
-        unsigned int i = 0;
-        
-        if (!ctx || !pp_new || !old || !sid || !num)  return NT_STATUS_INVALID_PARAMETER;
-
-        *num += 1;
-        
-        if((pp_new[0] = talloc_zero_array(ctx, struct security_ace, *num )) == 0)
-                return NT_STATUS_NO_MEMORY;
-
-        for (i = 0; i < *num - 1; i ++)
-                sec_ace_copy(&(*pp_new)[i], &old[i]);
-
-        (*pp_new)[i].type  = SEC_ACE_TYPE_ACCESS_ALLOWED;
-        (*pp_new)[i].flags = 0;
-        (*pp_new)[i].size  = SEC_ACE_HEADER_SIZE + ndr_size_dom_sid(sid, 0);
-        (*pp_new)[i].access_mask = mask;
-        (*pp_new)[i].trustee = *sid;
-        return NT_STATUS_OK;
-}
-
-/*******************************************************************
-  modify SID's permissions at ACL 
-********************************************************************/
-
-NTSTATUS sec_ace_mod_sid(struct security_ace *ace, size_t num, const struct dom_sid *sid, uint32_t mask)
-{
-        unsigned int i = 0;
-
-        if (!ace || !sid)  return NT_STATUS_INVALID_PARAMETER;
-
-        for (i = 0; i < num; i ++) {
-                if (dom_sid_equal(&ace[i].trustee, sid)) {
-                        ace[i].access_mask = mask;
-                        return NT_STATUS_OK;
-                }
-        }
-        return NT_STATUS_NOT_FOUND;
-}
-
-/*******************************************************************
- delete SID from ACL
-********************************************************************/
-
-NTSTATUS sec_ace_del_sid(TALLOC_CTX *ctx, struct security_ace **pp_new, struct security_ace *old, uint32_t *num, const struct dom_sid *sid)
-{
-        unsigned int i     = 0;
-        unsigned int n_del = 0;
-
-        if (!ctx || !pp_new || !old || !sid || !num)  return NT_STATUS_INVALID_PARAMETER;
-
-        if (*num) {
-                if((pp_new[0] = talloc_zero_array(ctx, struct security_ace, *num )) == 0)
-                        return NT_STATUS_NO_MEMORY;
-        } else {
-                pp_new[0] = NULL;
-        }
-
-        for (i = 0; i < *num; i ++) {
-                if (!dom_sid_equal(&old[i].trustee, sid))
-                        sec_ace_copy(&(*pp_new)[i], &old[i]);
-                else
-                        n_del ++;
-        }
-        if (n_del == 0)
-                return NT_STATUS_NOT_FOUND;
-        else {
-                *num -= n_del;
-                return NT_STATUS_OK;
-        }
-}
-
-/*******************************************************************
- Compares two struct security_ace structures
-********************************************************************/
-
-bool sec_ace_equal(const struct security_ace *s1, const struct security_ace *s2)
-{
-        /* Trivial case */
-
-        if (!s1 && !s2) {
-                return true;
-        }
-
-        if (!s1 || !s2) {
-                return false;
-        }
-
-        /* Check top level stuff */
-
-        if (s1->type != s2->type || s1->flags != s2->flags ||
-            s1->access_mask != s2->access_mask) {
-                return false;
-        }
-
-        /* Check SID */
-
-        if (!dom_sid_equal(&s1->trustee, &s2->trustee)) {
-                return false;
-        }
-
-        return true;
 }
 

vendor/current/libcli/security/secace.h

@@ -28 +28 @@
 void init_sec_ace(struct security_ace *t, const struct dom_sid *sid, enum security_ace_type type,
                   uint32_t mask, uint8_t flag);
-NTSTATUS sec_ace_add_sid(TALLOC_CTX *ctx, struct security_ace **pp_new, struct security_ace *old, unsigned *num, const struct dom_sid *sid, uint32_t mask);
-NTSTATUS sec_ace_mod_sid(struct security_ace *ace, size_t num, const struct dom_sid *sid, uint32_t mask);
-NTSTATUS sec_ace_del_sid(TALLOC_CTX *ctx, struct security_ace **pp_new, struct security_ace *old, uint32_t *num, const struct dom_sid *sid);
-bool sec_ace_equal(const struct security_ace *s1, const struct security_ace *s2);
 int nt_ace_inherit_comp( const struct security_ace *a1, const struct security_ace *a2);
 int nt_ace_canon_comp( const struct security_ace *a1, const struct security_ace *a2);

vendor/current/libcli/security/secacl.c

@@ -1 @@
-/* 
+/*
  *  Unix SMB/Netbios implementation.
  *  SEC_ACL handling routines
@@ -6 +6 @@
  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
  *  Copyright (C) Paul Ashton                  1997-1998.
- *  
+ *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
  *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
- *  
+ *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *  
+ *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
@@ -29 +29 @@
 
 /*******************************************************************
- Create a SEC_ACL structure.  
+ Create a SEC_ACL structure.
 ********************************************************************/
 
-struct security_acl *make_sec_acl(TALLOC_CTX *ctx, 
-                                                                  enum security_acl_revision revision,
-                                                                  int num_aces, struct security_ace *ace_list)
+struct security_acl *make_sec_acl(TALLOC_CTX *ctx,
+                                  enum security_acl_revision revision,
+                                  int num_aces, struct security_ace *ace_list)
 {
         struct security_acl *dst;
         int i;
 
-        if((dst = talloc_zero(ctx, struct security_acl)) == NULL)
+        dst = talloc(ctx, struct security_acl);
+        if (dst == NULL) {
                 return NULL;
+        }
 
         dst->revision = revision;
         dst->num_aces = num_aces;
         dst->size = SEC_ACL_HEADER_SIZE;
+        dst->aces = NULL;
 
         /* Now we need to return a non-NULL address for the ace list even
@@ -52 +55 @@
            positive number. */
 
-        if ((num_aces) && 
-            ((dst->aces = talloc_array(dst, struct security_ace, num_aces))
-             == NULL)) {
+        if (num_aces == 0) {
+                return dst;
+        }
+
+        dst->aces = talloc_array(dst, struct security_ace, num_aces);
+        if (dst->aces == NULL) {
+                TALLOC_FREE(dst);
                 return NULL;
         }
-        
+
         for (i = 0; i < num_aces; i++) {
                 dst->aces[i] = ace_list[i]; /* Structure copy. */
@@ -65 +72 @@
         return dst;
 }
-
-/*******************************************************************
- Duplicate a SEC_ACL structure.  
-********************************************************************/
-
-struct security_acl *dup_sec_acl(TALLOC_CTX *ctx, struct security_acl *src)
-{
-        if(src == NULL)
-                return NULL;
-
-        return make_sec_acl(ctx, src->revision, src->num_aces, src->aces);
-}

vendor/current/libcli/security/secacl.h

@@ -26 +26 @@
 struct security_acl *make_sec_acl(TALLOC_CTX *ctx, enum security_acl_revision revision,
                       int num_aces, struct security_ace *ace_list);
-struct security_acl *dup_sec_acl(TALLOC_CTX *ctx, struct security_acl *src);
 
 

vendor/current/libcli/security/security.h

@@ -90 +90 @@
 #define SHARE_READ_ONLY       (FILE_GENERIC_READ|FILE_EXECUTE)
 
+/**
+ * Remaining access is a bit mask of remaining access rights (bits) that have
+ * to be granted in order to fulfill the requested access.
+ *
+ * The GUID is optional, if specified it restricts this object tree and its
+ * childs to object/attributes that inherits from this GUID.
+ * For DS access an object inherits from a GUID if one of its class has this GUID
+ * in the schemaIDGUID attribute.
+ */
 struct object_tree {
         uint32_t remaining_access;
@@ -101 +110 @@
 #include "libcli/security/secace.h"
 #include "libcli/security/secacl.h"
+#include "libcli/security/secdesc.h"
 #include "libcli/security/security_descriptor.h"
 #include "libcli/security/security_token.h"

vendor/current/libcli/security/security_descriptor.c

@@ -183 +183 @@
 }
 
+NTSTATUS security_descriptor_for_client(TALLOC_CTX *mem_ctx,
+                                        const struct security_descriptor *ssd,
+                                        uint32_t sec_info,
+                                        uint32_t access_granted,
+                                        struct security_descriptor **_csd)
+{
+        struct security_descriptor *csd = NULL;
+        uint32_t access_required = 0;
+
+        *_csd = NULL;
+
+        if (sec_info & (SECINFO_OWNER|SECINFO_GROUP)) {
+                access_required |= SEC_STD_READ_CONTROL;
+        }
+        if (sec_info & SECINFO_DACL) {
+                access_required |= SEC_STD_READ_CONTROL;
+        }
+        if (sec_info & SECINFO_SACL) {
+                access_required |= SEC_FLAG_SYSTEM_SECURITY;
+        }
+
+        if (access_required & (~access_granted)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        /*
+         * make a copy...
+         */
+        csd = security_descriptor_copy(mem_ctx, ssd);
+        if (csd == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /*
+         * ... and remove everthing not wanted
+         */
+
+        if (!(sec_info & SECINFO_OWNER)) {
+                TALLOC_FREE(csd->owner_sid);
+                csd->type &= ~SEC_DESC_OWNER_DEFAULTED;
+        }
+        if (!(sec_info & SECINFO_GROUP)) {
+                TALLOC_FREE(csd->group_sid);
+                csd->type &= ~SEC_DESC_GROUP_DEFAULTED;
+        }
+        if (!(sec_info & SECINFO_DACL)) {
+                TALLOC_FREE(csd->dacl);
+                csd->type &= ~(
+                        SEC_DESC_DACL_PRESENT |
+                        SEC_DESC_DACL_DEFAULTED|
+                        SEC_DESC_DACL_AUTO_INHERIT_REQ |
+                        SEC_DESC_DACL_AUTO_INHERITED |
+                        SEC_DESC_DACL_PROTECTED |
+                        SEC_DESC_DACL_TRUSTED);
+        }
+        if (!(sec_info & SECINFO_SACL)) {
+                TALLOC_FREE(csd->sacl);
+                csd->type &= ~(
+                        SEC_DESC_SACL_PRESENT |
+                        SEC_DESC_SACL_DEFAULTED |
+                        SEC_DESC_SACL_AUTO_INHERIT_REQ |
+                        SEC_DESC_SACL_AUTO_INHERITED |
+                        SEC_DESC_SACL_PROTECTED |
+                        SEC_DESC_SERVER_SECURITY);
+        }
+
+        *_csd = csd;
+        return NT_STATUS_OK;
+}
+
 /*
   add an ACE to an ACL of a security_descriptor
@@ -345 +415 @@
   compare two security ace structures
 */
-bool security_ace_equal(const struct security_ace *ace1, 
+bool security_ace_equal(const struct security_ace *ace1,
                         const struct security_ace *ace2)
 {
-        if (ace1 == ace2) return true;
-        if (!ace1 || !ace2) return false;
-        if (ace1->type != ace2->type) return false;
-        if (ace1->flags != ace2->flags) return false;
-        if (ace1->access_mask != ace2->access_mask) return false;
-        if (!dom_sid_equal(&ace1->trustee, &ace2->trustee)) return false;
-
-        return true;    
+        if (ace1 == ace2) {
+                return true;
+        }
+        if ((ace1 == NULL) || (ace2 == NULL)) {
+                return false;
+        }
+        if (ace1->type != ace2->type) {
+                return false;
+        }
+        if (ace1->flags != ace2->flags) {
+                return false;
+        }
+        if (ace1->access_mask != ace2->access_mask) {
+                return false;
+        }
+        if (!dom_sid_equal(&ace1->trustee, &ace2->trustee)) {
+                return false;
+        }
+
+        return true;
 }
 
@@ -565 +647 @@
 
 {
-        struct dom_sid *sid;
         struct security_ace *ace;
+        bool ok;
 
         ace = talloc_zero(mem_ctx, struct security_ace);
@@ -573 +655 @@
         }
 
-        sid = dom_sid_parse_talloc(ace, sid_str);
-        if (sid == NULL) {
+        ok = dom_sid_parse(sid_str, &ace->trustee);
+        if (!ok) {
                 talloc_free(ace);
                 return NULL;
         }
-
-        ace->trustee = *sid;
         ace->type = type;
         ace->access_mask = access_mask;
@@ -586 +666 @@
         return ace;
 }
+
+/*******************************************************************
+ Check for MS NFS ACEs in a sd
+*******************************************************************/
+bool security_descriptor_with_ms_nfs(const struct security_descriptor *psd)
+{
+        int i;
+
+        if (psd->dacl == NULL) {
+                return false;
+        }
+
+        for (i = 0; i < psd->dacl->num_aces; i++) {
+                if (dom_sid_compare_domain(
+                            &global_sid_Unix_NFS,
+                            &psd->dacl->aces[i].trustee) == 0) {
+                        return true;
+                }
+        }
+
+        return false;
+}

vendor/current/libcli/security/security_descriptor.h

@@ -27 +27 @@
 struct security_descriptor *security_descriptor_copy(TALLOC_CTX *mem_ctx, 
                                                      const struct security_descriptor *osd);
+NTSTATUS security_descriptor_for_client(TALLOC_CTX *mem_ctx,
+                                        const struct security_descriptor *ssd,
+                                        uint32_t sec_info,
+                                        uint32_t access_granted,
+                                        struct security_descriptor **_csd);
 NTSTATUS security_descriptor_sacl_add(struct security_descriptor *sd,
                                       const struct security_ace *ace);
@@ -82 +87 @@
                                                        uint32_t (*generic_map)(uint32_t access_mask));
 
+bool security_descriptor_with_ms_nfs(const struct security_descriptor *psd);
+
 #endif /* __SECURITY_DESCRIPTOR_H__ */

vendor/current/libcli/security/security_token.c

@@ -85 +85 @@
 {
         bool ret;
-        struct dom_sid *sid = dom_sid_parse_talloc(NULL, sid_string);
-        if (!sid) return false;
+        struct dom_sid sid;
 
-        ret = security_token_is_sid(token, sid);
+        ret = dom_sid_parse(sid_string, &sid);
+        if (!ret) {
+                return false;
+        }
 
-        talloc_free(sid);
+        ret = security_token_is_sid(token, &sid);
         return ret;
 }
@@ -118 +120 @@
 {
         bool ret;
-        struct dom_sid *sid = dom_sid_parse_talloc(NULL, sid_string);
-        if (!sid) return false;
+        struct dom_sid sid;
 
-        ret = security_token_has_sid(token, sid);
+        ret = dom_sid_parse(sid_string, &sid);
+        if (!ret) {
+                return false;
+        }
 
-        talloc_free(sid);
+        ret = security_token_has_sid(token, &sid);
         return ret;
+}
+
+bool security_token_has_builtin_guests(const struct security_token *token)
+{
+        return security_token_has_sid(token, &global_sid_Builtin_Guests);
 }
 

vendor/current/libcli/security/security_token.h

@@ -52 +52 @@
 bool security_token_has_sid_string(const struct security_token *token, const char *sid_string);
 
+bool security_token_has_builtin_guests(const struct security_token *token);
+
 bool security_token_has_builtin_administrators(const struct security_token *token);
 

vendor/current/libcli/security/session.c

@@ -39 +39 @@
         }
 
+        if (security_token_has_builtin_guests(session_info->security_token)) {
+                return SECURITY_GUEST;
+        }
+
         if (security_token_has_builtin_administrators(session_info->security_token)) {
                 return SECURITY_ADMINISTRATOR;

vendor/current/libcli/security/session.h

@@ -25 +25 @@
 enum security_user_level {
         SECURITY_ANONYMOUS            = 0,
+        SECURITY_GUEST                = 1,
         SECURITY_USER                 = 10,
         SECURITY_RO_DOMAIN_CONTROLLER = 20,
@@ -36 +37 @@
 struct auth_user_info;
 struct auth_user_info_torture;
-
-struct auth_session_info {
-        struct security_token *security_token;
-        struct security_unix_token *unix_token;
-        struct auth_user_info *info;
-        struct auth_user_info_unix *unix_info;
-        struct auth_user_info_torture *torture;
-        DATA_BLOB session_key;
-        struct cli_credentials *credentials;
-};
+struct auth_session_info;
 
 enum security_user_level security_session_user_level(struct auth_session_info *session_info,

vendor/current/libcli/security/util_sid.c

@@ -39 +39 @@
 const struct dom_sid global_sid_World =                      /* Everyone */
 { 1, 1, {0,0,0,0,0,1}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const struct dom_sid global_sid_Local_Authority =            /* Local Authority */
+{ 1, 0, {0,0,0,0,0,2}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
 const struct dom_sid global_sid_Creator_Owner_Domain =       /* Creator Owner domain */
 { 1, 0, {0,0,0,0,0,3}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
@@ -54 +56 @@
 { 1, 1, {0,0,0,0,0,5}, {12,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
 #endif
+
+const struct dom_sid global_sid_Asserted_Identity =       /* Asserted Identity */
+{ 1, 0, {0,0,0,0,0,18}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const struct dom_sid global_sid_Asserted_Identity_Service =     /* Asserted Identity Service */
+{ 1, 1, {0,0,0,0,0,18}, {1,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const struct dom_sid global_sid_Asserted_Identity_Authentication_Authority =    /* Asserted Identity Authentication Authority */
+{ 1, 1, {0,0,0,0,0,18}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+
 const struct dom_sid global_sid_Network =                       /* Network rids */
 { 1, 1, {0,0,0,0,0,5}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
@@ -61 +71 @@
 const struct dom_sid global_sid_Creator_Group =         /* Creator Group */
 { 1, 1, {0,0,0,0,0,3}, {1,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const struct dom_sid global_sid_Owner_Rights =          /* Owner Rights */
+{ 1, 1, {0,0,0,0,0,3}, {4,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
 const struct dom_sid global_sid_Anonymous =                     /* Anonymous login */
 { 1, 1, {0,0,0,0,0,5}, {7,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
@@ -93 +105 @@
 { 1, 1, {0,0,0,0,0,22}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
 
+/*
+ * http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx
+ */
+const struct dom_sid global_sid_Unix_NFS =             /* MS NFS and Apple style */
+{ 1, 1, {0,0,0,0,0,5}, {88,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const struct dom_sid global_sid_Unix_NFS_Users =                /* Unix uid, MS NFS and Apple style */
+{ 1, 2, {0,0,0,0,0,5}, {88,1,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const struct dom_sid global_sid_Unix_NFS_Groups =               /* Unix gid, MS NFS and Apple style */
+{ 1, 2, {0,0,0,0,0,5}, {88,2,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const struct dom_sid global_sid_Unix_NFS_Mode =                 /* Unix mode */
+{ 1, 2, {0,0,0,0,0,5}, {88,3,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+/* Unused, left here for documentary purposes */
+#if 0
+const struct dom_sid global_sid_Unix_NFS_Other =                /* Unix other, MS NFS and Apple style */
+{ 1, 2, {0,0,0,0,0,5}, {88,4,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+#endif
+
 /* Unused, left here for documentary purposes */
 #if 0
@@ -222 +251 @@
         int i;
 
-        ZERO_STRUCTP(dst);
-
-        dst->sid_rev_num = src->sid_rev_num;
-        dst->num_auths = src->num_auths;
+        *dst = (struct dom_sid) {
+                .sid_rev_num = src->sid_rev_num,
+                .num_auths = src->num_auths,
+        };
 
         memcpy(&dst->id_auth[0], &src->id_auth[0], sizeof(src->id_auth));
@@ -234 +263 @@
 
 /*****************************************************************
- Parse a on-the-wire SID (in a DATA_BLOB) to a struct dom_sid.
-*****************************************************************/
-
-bool sid_blob_parse(DATA_BLOB in, struct dom_sid *sid)
-{
+ Parse a on-the-wire SID to a struct dom_sid.
+*****************************************************************/
+
+bool sid_parse(const uint8_t *inbuf, size_t len, struct dom_sid *sid)
+{
+        DATA_BLOB in = data_blob_const(inbuf, len);
         enum ndr_err_code ndr_err;
-        ndr_err = ndr_pull_struct_blob_all(&in, NULL, sid,
-                                           (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
+
+        ndr_err = ndr_pull_struct_blob_all(
+                &in, NULL, sid, (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 return false;
         }
         return true;
-}
-
-/*****************************************************************
- Parse a on-the-wire SID to a struct dom_sid.
-*****************************************************************/
-
-bool sid_parse(const char *inbuf, size_t len, struct dom_sid *sid)
-{
-        DATA_BLOB in = data_blob_const(inbuf, len);
-        return sid_blob_parse(in, sid);
 }
 
@@ -274 +295 @@
 
         return dom_sid_compare_auth(sid1, sid2);
-}
-
-/*****************************************************************
- Compare two sids.
-*****************************************************************/
-
-bool sid_equal(const struct dom_sid *sid1, const struct dom_sid *sid2)
-{
-        return dom_sid_compare(sid1, sid2) == 0;
 }
 
@@ -316 +328 @@
 
         for (i=0; i<(*num_sids); i++) {
-                if (dom_sid_compare(sid, &(*sids)[i]) == 0)
+                if (dom_sid_equal(sid, &(*sids)[i])) {
                         return NT_STATUS_OK;
+                }
         }
 
@@ -338 +351 @@
                    and break out of the loop */
 
-                if ( sid_equal(sid, &sid_list[i]) ) {
+                if (dom_sid_equal(sid, &sid_list[i])) {
                         *num -= 1;
                         break;
@@ -345 +358 @@
 
         /* This loop will copy the remainder of the array
-           if i < num of sids ni the array */
-
-        for ( ; i<*num; i++ )
+           if i < num of sids in the array */
+
+        for ( ; i<*num; i++ ) {
                 sid_copy( &sid_list[i], &sid_list[i+1] );
+        }
 
         return;
@@ -378 +392 @@
 {
         static const struct dom_sid null_sid = {0};
-        return sid_equal(sid, &null_sid);
-}
+        return dom_sid_equal(sid, &null_sid);
+}

vendor/current/libcli/security/wscript_build

@@ -2 +2 @@
 
 
-bld.SAMBA_LIBRARY('security',
-                  source='dom_sid.c display_sec.c secace.c secacl.c security_descriptor.c sddl.c privileges.c security_token.c access_check.c object_tree.c create_descriptor.c util_sid.c session.c',
+bld.SAMBA_LIBRARY('samba-security',
+                  source='dom_sid.c display_sec.c secace.c secacl.c security_descriptor.c sddl.c privileges.c security_token.c access_check.c object_tree.c create_descriptor.c util_sid.c session.c secdesc.c',
                   private_library=True,
                   deps='talloc ndr NDR_SECURITY'
                   )
 
-if getattr(bld.env, '_SAMBA_BUILD_', 0) == 4:
-    bld.SAMBA_PYTHON('pysecurity',
-                     source='pysecurity.c',
-                     deps='security pytalloc-util',
-                     realname='samba/security.so'
-                     )
+bld.SAMBA_PYTHON('pysecurity',
+                 source='pysecurity.c',
+                 deps='samba-security pytalloc-util',
+                 realname='samba/security.so'
+                 )