← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/samba/oneiric-security

« back to all changes in this revision

Viewing changes to source3/lib/privileges_basic.c

  • Committer: Bazaar Package Importer
  • Author(s): Chuck Short
  • Date: 2011-03-10 10:03:01 UTC
  • mfrom: (0.39.11 sid)
  • Revision ID: james.westby@ubuntu.com-20110310100301-jfjg41wv0iq05zj4
Tags: 2:3.5.8~dfsg-1ubuntu1
https://launchpad.net/bugs/639768
* Merge from debian unstable.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access. 
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/mksmbpasswd.awk:
    - Do not add user with UID less than 1000 to smbpasswd
  + debian/control:
    - Make libwbclient0 replace/conflict with hardy's likewise-open.
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
    - Add cuups breaks to push the package to aslo upgrade cups (LP: #639768)
  + debian/rules:
    - enable "native" PIE hardening.
    - Add BIND_NOW to maximize benefit of RELRO hardening.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
    - Don't ship the /etc/network/if-up.d file.
  + debian/samba.postinst: 
    - Fixed bashism.
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/samba.logrotate: Make it upstart compatible
  + debian/samba-common.dhcp: Fix typo to get a proper parsing in
    /etc/samba/dhcp.
  + Dropped:
    - debian/patches/fix-windows7-print-connection.patch: Merged upstream.
    - debian/patches/security-CVE-2011-0719.patch: Merged upstream. 

Show diffs side-by-side

added added

removed removed

Lines of Context:
source3/lib/privileges_basic.c
46
46
const SE_PRIV se_remote_shutdown = SE_REMOTE_SHUTDOWN;
47
47
const SE_PRIV se_restore         = SE_RESTORE;
48
48
const SE_PRIV se_take_ownership  = SE_TAKE_OWNERSHIP;
 
49
const SE_PRIV se_security       = SE_SECURITY;
49
50
 
50
51
/********************************************************************
51
52
 This is a list of privileges reported by a WIndows 2000 SP4 AD DC
98
99
        {SE_SERVICE_LOGON,      "SeServiceLogonRight",          "Log on as a service",                     { 0x0, 0x0 }},
99
100
#endif
100
101
        {SE_MACHINE_ACCOUNT,    "SeMachineAccountPrivilege",    "Add machines to domain",                  { 0x0, 0x0006 }},
 
102
        {SE_SECURITY,           "SeSecurityPrivilege",          "Manage auditing and security log",        { 0x0, 0x0008 }},
101
103
        {SE_TAKE_OWNERSHIP,     "SeTakeOwnershipPrivilege",     "Take ownership of files or other objects",{ 0x0, 0x0009 }},
102
104
        {SE_BACKUP,             "SeBackupPrivilege",            "Back up files and directories",           { 0x0, 0x0011 }},
103
105
        {SE_RESTORE,            "SeRestorePrivilege",           "Restore files and directories",           { 0x0, 0x0012 }},
107
109
        {SE_ADD_USERS,          "SeAddUsersPrivilege",          "Add users and groups to the domain",      { 0x0, 0x1002 }},
108
110
        {SE_DISK_OPERATOR,      "SeDiskOperatorPrivilege",      "Manage disk shares",                      { 0x0, 0x1003 }},
109
111
 
 
112
 
110
113
        {SE_END, "", "", { 0x0, 0x0 }}
111
114
};
112
115
 
192
195
}
193
196
 
194
197
/***************************************************************************
 
198
 check if 2 LUID's are equal.
 
199
****************************************************************************/
 
200
 
 
201
static bool luid_equal( const LUID *luid1, const LUID *luid2 )
 
202
{
 
203
        return ( luid1->low == luid2->low && luid1->high == luid2->high);
 
204
}
 
205
 
 
206
/***************************************************************************
195
207
 check if a SE_PRIV has any assigned privileges
196
208
****************************************************************************/
197
209
 
406
418
{
407
419
        int i;
408
420
 
409
 
        if (set->high != 0)
410
 
                return NULL;
411
 
 
412
421
        for ( i=0; !se_priv_equal(&privs[i].se_priv, &se_priv_end); i++ ) {
413
 
                if ( set->low == privs[i].luid.low ) {
 
422
                if (luid_equal(set, &privs[i].luid)) {
414
423
                        return privs[i].name;
415
424
                }
416
425
        }
477
486
{
478
487
        int i;
479
488
        uint32 num_privs = count_all_privileges();
 
489
        LUID local_luid;
 
490
 
 
491
        local_luid.low = luid->low;
 
492
        local_luid.high = luid->high;
480
493
 
481
494
        for ( i=0; i<num_privs; i++ ) {
482
 
                if ( luid->low == privs[i].luid.low ) {
 
495
                if (luid_equal(&local_luid, &privs[i].luid)) {
483
496
                        se_priv_copy( mask, &privs[i].se_priv );
484
497
                        return True;
485
498
                }
500
513
        for ( i=0; i<privset->count; i++ ) {
501
514
                SE_PRIV r;
502
515
 
503
 
                /* sanity check for invalid privilege.  we really
504
 
                   only care about the low 32 bits */
505
 
 
506
 
                if ( privset->set[i].luid.high != 0 )
507
 
                        return False;
508
 
 
509
516
                if ( luid_to_se_priv( &privset->set[i].luid, &r ) )
510
517
                        se_priv_add( mask, &r );
511
518
        }