int vfs_set_ntquota(files_struct *fsp, enum SMB_QUOTA_TYPE qtype, DOM_SID *psid, SMB_NTQUOTA_STRUCT *qt) { int ret; SMB_DISK_QUOTA D; unid_t id; ZERO_STRUCT(D); if (!fsp||!fsp->conn||!qt) return (-1); id.uid = -1; D.bsize = (SMB_BIG_UINT)QUOTABLOCK_SIZE; D.softlimit = limit_nt2unix(qt->softlim,D.bsize); D.hardlimit = limit_nt2unix(qt->hardlim,D.bsize); D.qflags = qt->qflags; D.isoftlimit = limit_blk2inodes(D.softlimit); D.ihardlimit = limit_blk2inodes(D.hardlimit); if (psid && !sid_to_uid(psid, &id.uid)) { DEBUG(0,("sid_to_uid: failed, SID[%s]\n", sid_string_static(psid))); } ret = SMB_VFS_SET_QUOTA(fsp->conn, qtype, id, &D); return ret; }
/** * Turn SID into UID/GID and setup a struct ifs_identity */ static bool onefs_sid_to_identity(const struct dom_sid *sid, struct ifs_identity *id, bool is_group) { enum ifs_identity_type type = IFS_ID_TYPE_LAST+1; uid_t uid = 0; gid_t gid = 0; if (!sid || sid_equal(sid, &global_sid_NULL)) type = IFS_ID_TYPE_NULL; else if (sid_equal(sid, &global_sid_World)) type = IFS_ID_TYPE_EVERYONE; else if (sid_equal(sid, &global_sid_Creator_Owner)) type = IFS_ID_TYPE_CREATOR_OWNER; else if (sid_equal(sid, &global_sid_Creator_Group)) type = IFS_ID_TYPE_CREATOR_GROUP; else if (is_group) { if (!sid_to_gid(sid, &gid)) return false; type = IFS_ID_TYPE_GID; } else { if (sid_to_uid(sid, &uid)) type = IFS_ID_TYPE_UID; else if (sid_to_gid(sid, &gid)) type = IFS_ID_TYPE_GID; else return false; } if (aclu_initialize_identity(id, type, uid, gid, is_group)) { DEBUG(3, ("Call to aclu_initialize_identity failed! id=%x, " "type=%d, uid=%u, gid=%u, is_group=%d\n", (unsigned int)id, type, uid, gid, is_group)); return false; } return true; }
int vfs_get_ntquota(files_struct *fsp, enum SMB_QUOTA_TYPE qtype, DOM_SID *psid, SMB_NTQUOTA_STRUCT *qt) { int ret; SMB_DISK_QUOTA D; unid_t id; ZERO_STRUCT(D); if (!fsp||!fsp->conn||!qt) return (-1); ZERO_STRUCT(*qt); id.uid = -1; if (psid && !sid_to_uid(psid, &id.uid)) { DEBUG(0,("sid_to_uid: failed, SID[%s]\n", sid_string_static(psid))); } ret = SMB_VFS_GET_QUOTA(fsp->conn, qtype, id, &D); if (psid) qt->sid = *psid; if (ret!=0) { return ret; } qt->usedspace = (SMB_BIG_UINT)D.curblocks*D.bsize; qt->softlim = limit_unix2nt(D.softlimit, D.bsize); qt->hardlim = limit_unix2nt(D.hardlimit, D.bsize); qt->qflags = D.qflags; return 0; }
int pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv) { unsigned int ctrl; int retval; extern BOOL in_client; SAM_ACCOUNT *sampass = NULL; void (*oldsig_handler)(int); const char *user; char *pass_old; char *pass_new; NTSTATUS nt_status; /* Samba initialization. */ setup_logging( "pam_smbpass", False ); in_client = True; ctrl = set_ctrl(flags, argc, argv); /* * First get the name of a user. No need to do anything if we can't * determine this. */ retval = pam_get_user( pamh, &user, "Username: "******"password: could not identify user" ); } return retval; } if (on( SMB_DEBUG, ctrl )) { _log_err( LOG_DEBUG, "username [%s] obtained", user ); } /* Getting into places that might use LDAP -- protect the app from a SIGPIPE it's not expecting */ oldsig_handler = CatchSignal(SIGPIPE, SIGNAL_CAST SIG_IGN); if (!initialize_password_db(True)) { _log_err( LOG_ALERT, "Cannot access samba password database" ); CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_AUTHINFO_UNAVAIL; } /* obtain user record */ if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(&sampass))) { CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return nt_status_to_pam(nt_status); } if (!pdb_getsampwnam(sampass,user)) { _log_err( LOG_ALERT, "Failed to find entry for user %s.", user ); CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_USER_UNKNOWN; } if (flags & PAM_PRELIM_CHECK) { /* * obtain and verify the current password (OLDAUTHTOK) for * the user. */ char *Announce; if (_smb_blankpasswd( ctrl, sampass )) { pdb_free_sam(&sampass); CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_SUCCESS; } /* Password change by root, or for an expired token, doesn't require authentication. Is this a good choice? */ if (getuid() != 0 && !(flags & PAM_CHANGE_EXPIRED_AUTHTOK)) { /* tell user what is happening */ #define greeting "Changing password for " Announce = (char *) malloc(sizeof(greeting)+strlen(user)); if (Announce == NULL) { _log_err(LOG_CRIT, "password: out of memory"); pdb_free_sam(&sampass); CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return PAM_BUF_ERR; } strncpy( Announce, greeting, sizeof(greeting) ); strncpy( Announce+sizeof(greeting)-1, user, strlen(user)+1 ); #undef greeting set( SMB__OLD_PASSWD, ctrl ); retval = _smb_read_password( pamh, ctrl, Announce, "Current SMB password: "******"password - (old) token not obtained" ); pdb_free_sam(&sampass); CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } /* verify that this is the password for this user */ retval = _smb_verify_password( pamh, sampass, pass_old, ctrl ); } else { pass_old = NULL; retval = PAM_SUCCESS; /* root doesn't have to */ } pass_old = NULL; pdb_free_sam(&sampass); CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } else if (flags & PAM_UPDATE_AUTHTOK) { /* * obtain the proposed password */ /* * get the old token back. NULL was ok only if root [at this * point we assume that this has already been enforced on a * previous call to this function]. */ if (off( SMB_NOT_SET_PASS, ctrl )) { retval = pam_get_item( pamh, PAM_OLDAUTHTOK, (const void **)&pass_old ); } else { retval = pam_get_data( pamh, _SMB_OLD_AUTHTOK, (const void **)&pass_old ); if (retval == PAM_NO_MODULE_DATA) { pass_old = NULL; retval = PAM_SUCCESS; } } if (retval != PAM_SUCCESS) { _log_err( LOG_NOTICE, "password: user not authenticated" ); pdb_free_sam(&sampass); CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } /* * use_authtok is to force the use of a previously entered * password -- needed for pluggable password strength checking * or other module stacking */ if (on( SMB_USE_AUTHTOK, ctrl )) { set( SMB_USE_FIRST_PASS, ctrl ); } retval = _smb_read_password( pamh, ctrl , NULL , "Enter new SMB password: "******"Retype new SMB password: "******"password: new password not obtained" ); } pass_old = NULL; /* tidy up */ pdb_free_sam(&sampass); CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } /* * At this point we know who the user is and what they * propose as their new password. Verify that the new * password is acceptable. */ if (pass_new[0] == '\0') { /* "\0" password = NULL */ pass_new = NULL; } retval = _pam_smb_approve_pass(pamh, ctrl, pass_old, pass_new); if (retval != PAM_SUCCESS) { _log_err(LOG_NOTICE, "new password not acceptable"); pass_new = pass_old = NULL; /* tidy up */ pdb_free_sam(&sampass); CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; } /* * By reaching here we have approved the passwords and must now * rebuild the smb password file. */ /* update the password database */ retval = smb_update_db(pamh, ctrl, user, pass_new); if (retval == PAM_SUCCESS) { uid_t uid; /* password updated */ if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sampass), &uid))) { _log_err( LOG_NOTICE, "Unable to get uid for user %s", pdb_get_username(sampass)); _log_err( LOG_NOTICE, "password for (%s) changed by (%s/%d)", user, uidtoname(getuid()), getuid()); } else { _log_err( LOG_NOTICE, "password for (%s/%d) changed by (%s/%d)", user, uid, uidtoname(getuid()), getuid()); } } else { _log_err( LOG_ERR, "password change failed for user %s", user); } pass_old = pass_new = NULL; if (sampass) { pdb_free_sam(&sampass); sampass = NULL; } } else { /* something has broken with the library */ _log_err( LOG_ALERT, "password received unknown request" ); retval = PAM_ABORT; } if (sampass) { pdb_free_sam(&sampass); sampass = NULL; } pdb_free_sam(&sampass); CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler); return retval; }
static bool smbacl4_fill_ace4( const struct smb_filename *filename, smbacl4_vfs_params *params, uid_t ownerUID, gid_t ownerGID, const struct security_ace *ace_nt, /* input */ SMB_ACE4PROP_T *ace_v4 /* output */ ) { DEBUG(10, ("got ace for %s\n", sid_string_dbg(&ace_nt->trustee))); memset(ace_v4, 0, sizeof(SMB_ACE4PROP_T)); /* only ACCESS|DENY supported right now */ ace_v4->aceType = ace_nt->type; ace_v4->aceFlags = map_windows_ace_flags_to_nfs4_ace_flags( ace_nt->flags); /* remove inheritance flags on files */ if (VALID_STAT(filename->st) && !S_ISDIR(filename->st.st_ex_mode)) { DEBUG(10, ("Removing inheritance flags from a file\n")); ace_v4->aceFlags &= ~(SMB_ACE4_FILE_INHERIT_ACE| SMB_ACE4_DIRECTORY_INHERIT_ACE| SMB_ACE4_NO_PROPAGATE_INHERIT_ACE| SMB_ACE4_INHERIT_ONLY_ACE); } ace_v4->aceMask = ace_nt->access_mask & (SEC_STD_ALL | SEC_FILE_ALL); se_map_generic(&ace_v4->aceMask, &file_generic_mapping); if (ace_v4->aceFlags!=ace_nt->flags) DEBUG(9, ("ace_v4->aceFlags(0x%x)!=ace_nt->flags(0x%x)\n", ace_v4->aceFlags, ace_nt->flags)); if (ace_v4->aceMask!=ace_nt->access_mask) DEBUG(9, ("ace_v4->aceMask(0x%x)!=ace_nt->access_mask(0x%x)\n", ace_v4->aceMask, ace_nt->access_mask)); if (dom_sid_equal(&ace_nt->trustee, &global_sid_World)) { ace_v4->who.special_id = SMB_ACE4_WHO_EVERYONE; ace_v4->flags |= SMB_ACE4_ID_SPECIAL; } else if (params->mode!=e_special && dom_sid_equal(&ace_nt->trustee, &global_sid_Creator_Owner)) { DEBUG(10, ("Map creator owner\n")); ace_v4->who.special_id = SMB_ACE4_WHO_OWNER; ace_v4->flags |= SMB_ACE4_ID_SPECIAL; /* A non inheriting creator owner entry has no effect. */ ace_v4->aceFlags |= SMB_ACE4_INHERIT_ONLY_ACE; if (!(ace_v4->aceFlags & SMB_ACE4_DIRECTORY_INHERIT_ACE) && !(ace_v4->aceFlags & SMB_ACE4_FILE_INHERIT_ACE)) { return false; } } else if (params->mode!=e_special && dom_sid_equal(&ace_nt->trustee, &global_sid_Creator_Group)) { DEBUG(10, ("Map creator owner group\n")); ace_v4->who.special_id = SMB_ACE4_WHO_GROUP; ace_v4->flags |= SMB_ACE4_ID_SPECIAL; /* A non inheriting creator group entry has no effect. */ ace_v4->aceFlags |= SMB_ACE4_INHERIT_ONLY_ACE; if (!(ace_v4->aceFlags & SMB_ACE4_DIRECTORY_INHERIT_ACE) && !(ace_v4->aceFlags & SMB_ACE4_FILE_INHERIT_ACE)) { return false; } } else { uid_t uid; gid_t gid; if (sid_to_gid(&ace_nt->trustee, &gid)) { ace_v4->aceFlags |= SMB_ACE4_IDENTIFIER_GROUP; ace_v4->who.gid = gid; } else if (sid_to_uid(&ace_nt->trustee, &uid)) { ace_v4->who.uid = uid; } else { DEBUG(1, ("nfs4_acls.c: file [%s]: could not " "convert %s to uid or gid\n", filename->base_name, sid_string_dbg(&ace_nt->trustee))); return false; } } return true; /* OK */ }