← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/samba/oneiric-security

« back to all changes in this revision

Viewing changes to source3/lib/netapi/user.c

  • Committer: Bazaar Package Importer
  • Author(s): Chuck Short
  • Date: 2011-03-10 10:03:01 UTC
  • mfrom: (0.39.11 sid)
  • Revision ID: james.westby@ubuntu.com-20110310100301-jfjg41wv0iq05zj4
Tags: 2:3.5.8~dfsg-1ubuntu1
https://launchpad.net/bugs/639768
* Merge from debian unstable.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access. 
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/mksmbpasswd.awk:
    - Do not add user with UID less than 1000 to smbpasswd
  + debian/control:
    - Make libwbclient0 replace/conflict with hardy's likewise-open.
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
    - Add cuups breaks to push the package to aslo upgrade cups (LP: #639768)
  + debian/rules:
    - enable "native" PIE hardening.
    - Add BIND_NOW to maximize benefit of RELRO hardening.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
    - Don't ship the /etc/network/if-up.d file.
  + debian/samba.postinst: 
    - Fixed bashism.
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/samba.logrotate: Make it upstart compatible
  + debian/samba-common.dhcp: Fix typo to get a proper parsing in
    /etc/samba/dhcp.
  + Dropped:
    - debian/patches/fix-windows7-print-connection.patch: Merged upstream.
    - debian/patches/security-CVE-2011-0719.patch: Merged upstream. 

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/lib/netapi/user.c
52
52
        if (infoX->usriX_flags) {
53
53
                fields_present |= SAMR_FIELD_ACCT_FLAGS;
54
54
        }
55
 
        if (infoX->usriX_name) {
56
 
                fields_present |= SAMR_FIELD_FULL_NAME;
57
 
        }
58
55
        if (infoX->usriX_home_dir) {
59
56
                fields_present |= SAMR_FIELD_HOME_DIRECTORY;
60
57
        }
313
310
                                          session_key,
314
311
                                          &user_info.info25.password);
315
312
 
316
 
                status = rpccli_samr_SetUserInfo2(pipe_cli, ctx,
 
313
                status = rpccli_samr_SetUserInfo2(pipe_cli, talloc_tos(),
317
314
                                                  user_handle,
318
315
                                                  25,
319
316
                                                  &user_info);
326
323
                                                session_key,
327
324
                                                &user_info.info23.password);
328
325
 
329
 
                        status = rpccli_samr_SetUserInfo2(pipe_cli, ctx,
 
326
                        status = rpccli_samr_SetUserInfo2(pipe_cli, talloc_tos(),
330
327
                                                          user_handle,
331
328
                                                          23,
332
329
                                                          &user_info);
335
332
 
336
333
                user_info.info21 = info21;
337
334
 
338
 
                status = rpccli_samr_SetUserInfo(pipe_cli, ctx,
 
335
                status = rpccli_samr_SetUserInfo(pipe_cli, talloc_tos(),
339
336
                                                 user_handle,
340
337
                                                 21,
341
338
                                                 &user_info);
409
406
 
410
407
        init_lsa_String(&lsa_account_name, uX.usriX_name);
411
408
 
412
 
        status = rpccli_samr_CreateUser2(pipe_cli, ctx,
 
409
        status = rpccli_samr_CreateUser2(pipe_cli, talloc_tos(),
413
410
                                         &domain_handle,
414
411
                                         &lsa_account_name,
415
412
                                         ACB_NORMAL,
426
423
                goto done;
427
424
        }
428
425
 
429
 
        status = rpccli_samr_QueryUserInfo(pipe_cli, ctx,
 
426
        status = rpccli_samr_QueryUserInfo(pipe_cli, talloc_tos(),
430
427
                                           &user_handle,
431
428
                                           16,
432
429
                                           &user_info);
440
437
                goto done;
441
438
        }
442
439
 
443
 
        status = rpccli_samr_GetUserPwInfo(pipe_cli, ctx,
 
440
        status = rpccli_samr_GetUserPwInfo(pipe_cli, talloc_tos(),
444
441
                                           &user_handle,
445
442
                                           &pw_info);
446
443
        if (!NT_STATUS_IS_OK(status)) {
463
460
        goto done;
464
461
 
465
462
 failed:
466
 
        rpccli_samr_DeleteUser(pipe_cli, ctx,
 
463
        rpccli_samr_DeleteUser(pipe_cli, talloc_tos(),
467
464
                               &user_handle);
468
465
 
469
466
 done:
470
467
        if (is_valid_policy_hnd(&user_handle) && pipe_cli) {
471
 
                rpccli_samr_Close(pipe_cli, ctx, &user_handle);
 
468
                rpccli_samr_Close(pipe_cli, talloc_tos(), &user_handle);
472
469
        }
473
470
 
474
471
        if (ctx->disable_policy_handle_cache) {
527
524
                goto done;
528
525
        }
529
526
 
530
 
        status = rpccli_samr_OpenDomain(pipe_cli, ctx,
 
527
        status = rpccli_samr_OpenDomain(pipe_cli, talloc_tos(),
531
528
                                        &connect_handle,
532
529
                                        SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
533
530
                                        CONST_DISCARD(DOM_SID *, &global_sid_Builtin),
539
536
 
540
537
        init_lsa_String(&lsa_account_name, r->in.user_name);
541
538
 
542
 
        status = rpccli_samr_LookupNames(pipe_cli, ctx,
 
539
        status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
543
540
                                         &domain_handle,
544
541
                                         1,
545
542
                                         &lsa_account_name,
550
547
                goto done;
551
548
        }
552
549
 
553
 
        status = rpccli_samr_OpenUser(pipe_cli, ctx,
 
550
        status = rpccli_samr_OpenUser(pipe_cli, talloc_tos(),
554
551
                                      &domain_handle,
555
552
                                      SEC_STD_DELETE,
556
553
                                      user_rids.ids[0],
562
559
 
563
560
        sid_compose(&user_sid, domain_sid, user_rids.ids[0]);
564
561
 
565
 
        status = rpccli_samr_RemoveMemberFromForeignDomain(pipe_cli, ctx,
 
562
        status = rpccli_samr_RemoveMemberFromForeignDomain(pipe_cli, talloc_tos(),
566
563
                                                           &builtin_handle,
567
564
                                                           &user_sid);
568
565
        if (!NT_STATUS_IS_OK(status)) {
570
567
                goto done;
571
568
        }
572
569
 
573
 
        status = rpccli_samr_DeleteUser(pipe_cli, ctx,
 
570
        status = rpccli_samr_DeleteUser(pipe_cli, talloc_tos(),
574
571
                                        &user_handle);
575
572
        if (!NT_STATUS_IS_OK(status)) {
576
573
                werr = ntstatus_to_werror(status);
581
578
 
582
579
 done:
583
580
        if (is_valid_policy_hnd(&user_handle)) {
584
 
                rpccli_samr_Close(pipe_cli, ctx, &user_handle);
 
581
                rpccli_samr_Close(pipe_cli, talloc_tos(), &user_handle);
585
582
        }
586
583
 
587
584
        if (ctx->disable_policy_handle_cache) {
1671
1668
 
1672
1669
        init_lsa_String(&lsa_account_name, r->in.user_name);
1673
1670
 
1674
 
        status = rpccli_samr_LookupNames(pipe_cli, ctx,
 
1671
        status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
1675
1672
                                         &domain_handle,
1676
1673
                                         1,
1677
1674
                                         &lsa_account_name,
1698
1695
 
1699
1696
 done:
1700
1697
        if (is_valid_policy_hnd(&user_handle) && pipe_cli) {
1701
 
                rpccli_samr_Close(pipe_cli, ctx, &user_handle);
 
1698
                rpccli_samr_Close(pipe_cli, talloc_tos(), &user_handle);
1702
1699
        }
1703
1700
 
1704
1701
        if (ctx->disable_policy_handle_cache) {
1826
1823
 
1827
1824
        init_lsa_String(&lsa_account_name, r->in.user_name);
1828
1825
 
1829
 
        status = rpccli_samr_LookupNames(pipe_cli, ctx,
 
1826
        status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
1830
1827
                                         &domain_handle,
1831
1828
                                         1,
1832
1829
                                         &lsa_account_name,
1837
1834
                goto done;
1838
1835
        }
1839
1836
 
1840
 
        status = rpccli_samr_OpenUser(pipe_cli, ctx,
 
1837
        status = rpccli_samr_OpenUser(pipe_cli, talloc_tos(),
1841
1838
                                      &domain_handle,
1842
1839
                                      user_mask,
1843
1840
                                      user_rids.ids[0],
1866
1863
 
1867
1864
 done:
1868
1865
        if (is_valid_policy_hnd(&user_handle) && pipe_cli) {
1869
 
                rpccli_samr_Close(pipe_cli, ctx, &user_handle);
 
1866
                rpccli_samr_Close(pipe_cli, talloc_tos(), &user_handle);
1870
1867
        }
1871
1868
 
1872
1869
        if (ctx->disable_policy_handle_cache) {
2845
2842
 
2846
2843
        init_lsa_String(&lsa_account_name, r->in.user_name);
2847
2844
 
2848
 
        status = rpccli_samr_LookupNames(pipe_cli, ctx,
 
2845
        status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
2849
2846
                                         &domain_handle,
2850
2847
                                         1,
2851
2848
                                         &lsa_account_name,
2856
2853
                goto done;
2857
2854
        }
2858
2855
 
2859
 
        status = rpccli_samr_OpenUser(pipe_cli, ctx,
 
2856
        status = rpccli_samr_OpenUser(pipe_cli, talloc_tos(),
2860
2857
                                      &domain_handle,
2861
2858
                                      SAMR_USER_ACCESS_GET_GROUPS,
2862
2859
                                      user_rids.ids[0],
2866
2863
                goto done;
2867
2864
        }
2868
2865
 
2869
 
        status = rpccli_samr_GetGroupsForUser(pipe_cli, ctx,
 
2866
        status = rpccli_samr_GetGroupsForUser(pipe_cli, talloc_tos(),
2870
2867
                                              &user_handle,
2871
2868
                                              &rid_array);
2872
2869
        if (!NT_STATUS_IS_OK(status)) {
2884
2881
                rids[i] = rid_array->rids[i].rid;
2885
2882
        }
2886
2883
 
2887
 
        status = rpccli_samr_LookupRids(pipe_cli, ctx,
 
2884
        status = rpccli_samr_LookupRids(pipe_cli, talloc_tos(),
2888
2885
                                        &domain_handle,
2889
2886
                                        rid_array->count,
2890
2887
                                        rids,
2996
2993
 
2997
2994
        init_lsa_String(&lsa_account_name, r->in.user_name);
2998
2995
 
2999
 
        status = rpccli_samr_LookupNames(pipe_cli, ctx,
 
2996
        status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
3000
2997
                                         &domain_handle,
3001
2998
                                         1,
3002
2999
                                         &lsa_account_name,
3007
3004
                goto done;
3008
3005
        }
3009
3006
 
3010
 
        status = rpccli_samr_OpenUser(pipe_cli, ctx,
 
3007
        status = rpccli_samr_OpenUser(pipe_cli, talloc_tos(),
3011
3008
                                      &domain_handle,
3012
3009
                                      SAMR_USER_ACCESS_GET_GROUPS,
3013
3010
                                      user_rids.ids[0],
3046
3043
                }
3047
3044
        }
3048
3045
 
3049
 
        status = rpccli_samr_LookupNames(pipe_cli, ctx,
 
3046
        status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
3050
3047
                                         &domain_handle,
3051
3048
                                         r->in.num_entries,
3052
3049
                                         lsa_names,
3060
3057
        member_rids = group_rids.ids;
3061
3058
        num_member_rids = group_rids.count;
3062
3059
 
3063
 
        status = rpccli_samr_GetGroupsForUser(pipe_cli, ctx,
 
3060
        status = rpccli_samr_GetGroupsForUser(pipe_cli, talloc_tos(),
3064
3061
                                              &user_handle,
3065
3062
                                              &rid_array);
3066
3063
        if (!NT_STATUS_IS_OK(status)) {
3111
3108
        /* add list */
3112
3109
 
3113
3110
        for (i=0; i < num_add_rids; i++) {
3114
 
                status = rpccli_samr_OpenGroup(pipe_cli, ctx,
 
3111
                status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
3115
3112
                                               &domain_handle,
3116
3113
                                               SAMR_GROUP_ACCESS_ADD_MEMBER,
3117
3114
                                               add_rids[i],
3121
3118
                        goto done;
3122
3119
                }
3123
3120
 
3124
 
                status = rpccli_samr_AddGroupMember(pipe_cli, ctx,
 
3121
                status = rpccli_samr_AddGroupMember(pipe_cli, talloc_tos(),
3125
3122
                                                    &group_handle,
3126
3123
                                                    user_rids.ids[0],
3127
3124
                                                    7 /* ? */);
3131
3128
                }
3132
3129
 
3133
3130
                if (is_valid_policy_hnd(&group_handle)) {
3134
 
                        rpccli_samr_Close(pipe_cli, ctx, &group_handle);
 
3131
                        rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
3135
3132
                }
3136
3133
        }
3137
3134
 
3138
3135
        /* del list */
3139
3136
 
3140
3137
        for (i=0; i < num_del_rids; i++) {
3141
 
                status = rpccli_samr_OpenGroup(pipe_cli, ctx,
 
3138
                status = rpccli_samr_OpenGroup(pipe_cli, talloc_tos(),
3142
3139
                                               &domain_handle,
3143
3140
                                               SAMR_GROUP_ACCESS_REMOVE_MEMBER,
3144
3141
                                               del_rids[i],
3148
3145
                        goto done;
3149
3146
                }
3150
3147
 
3151
 
                status = rpccli_samr_DeleteGroupMember(pipe_cli, ctx,
 
3148
                status = rpccli_samr_DeleteGroupMember(pipe_cli, talloc_tos(),
3152
3149
                                                       &group_handle,
3153
3150
                                                       user_rids.ids[0]);
3154
3151
                if (!NT_STATUS_IS_OK(status)) {
3157
3154
                }
3158
3155
 
3159
3156
                if (is_valid_policy_hnd(&group_handle)) {
3160
 
                        rpccli_samr_Close(pipe_cli, ctx, &group_handle);
 
3157
                        rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
3161
3158
                }
3162
3159
        }
3163
3160
 
3165
3162
 
3166
3163
 done:
3167
3164
        if (is_valid_policy_hnd(&group_handle)) {
3168
 
                rpccli_samr_Close(pipe_cli, ctx, &group_handle);
 
3165
                rpccli_samr_Close(pipe_cli, talloc_tos(), &group_handle);
3169
3166
        }
3170
3167
 
3171
3168
        if (ctx->disable_policy_handle_cache) {
3290
3287
 
3291
3288
        init_lsa_String(&lsa_account_name, r->in.user_name);
3292
3289
 
3293
 
        status = rpccli_samr_LookupNames(pipe_cli, ctx,
 
3290
        status = rpccli_samr_LookupNames(pipe_cli, talloc_tos(),
3294
3291
                                         &domain_handle,
3295
3292
                                         1,
3296
3293
                                         &lsa_account_name,
3301
3298
                goto done;
3302
3299
        }
3303
3300
 
3304
 
        status = rpccli_samr_OpenUser(pipe_cli, ctx,
 
3301
        status = rpccli_samr_OpenUser(pipe_cli, talloc_tos(),
3305
3302
                                      &domain_handle,
3306
3303
                                      SAMR_USER_ACCESS_GET_GROUPS,
3307
3304
                                      user_rids.ids[0],
3311
3308
                goto done;
3312
3309
        }
3313
3310
 
3314
 
        status = rpccli_samr_GetGroupsForUser(pipe_cli, ctx,
 
3311
        status = rpccli_samr_GetGroupsForUser(pipe_cli, talloc_tos(),
3315
3312
                                              &user_handle,
3316
3313
                                              &rid_array);
3317
3314
        if (!NT_STATUS_IS_OK(status)) {
3352
3349
                }
3353
3350
        }
3354
3351
 
3355
 
        status = rpccli_samr_GetAliasMembership(pipe_cli, ctx,
 
3352
        status = rpccli_samr_GetAliasMembership(pipe_cli, talloc_tos(),
3356
3353
                                                &domain_handle,
3357
3354
                                                &sid_array,
3358
3355
                                                &domain_rids);
3369
3366
                }
3370
3367
        }
3371
3368
 
3372
 
        status = rpccli_samr_GetAliasMembership(pipe_cli, ctx,
 
3369
        status = rpccli_samr_GetAliasMembership(pipe_cli, talloc_tos(),
3373
3370
                                                &builtin_handle,
3374
3371
                                                &sid_array,
3375
3372
                                                &builtin_rids);
3386
3383
                }
3387
3384
        }
3388
3385
 
3389
 
        status = rpccli_samr_LookupRids(pipe_cli, ctx,
 
3386
        status = rpccli_samr_LookupRids(pipe_cli, talloc_tos(),
3390
3387
                                        &builtin_handle,
3391
3388
                                        num_rids,
3392
3389
                                        rids,