diff options
| author | Justin Maggard <jmaggard@netgear.com> | 2015-07-21 15:17:30 -0700 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2015-08-04 07:27:23 +0200 |
| commit | aee0165f692abdcb8347b7933e0b658e00e5b451 (patch) | |
| tree | 7434e79c70e94053a19285867c666e991aeae518 | |
| parent | 466abc316218bcaa538d7feb8a353fc8284e87ba (diff) | |
| download | samba-aee0165f692abdcb8347b7933e0b658e00e5b451.tar.gz | |
s3-passdb: Respect LOOKUP_NAME_GROUP flag in sid lookup.
Somewhere along the line, a config line like "valid users = @foo"
broke when "foo" also exists as a user.
user_ok_token() already does the right thing by adding the LOOKUP_NAME_GROUP
flag; but lookup_name() was not respecting that flag, and went ahead and looked
for users anyway.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11320
Signed-off-by: Justin Maggard <jmaggard@netgear.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Marc Muehlfeld <mmuehlfeld@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jul 28 21:35:58 CEST 2015 on sn-devel-104
(cherry picked from commit dc99d451bf23668d73878847219682fced547622)
| -rw-r--r-- | source3/passdb/lookup_sid.c | 4 | ||||
| -rw-r--r-- | source3/passdb/lookup_sid.h | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c index 3cc64de3674..3f99ee1e4e0 100644 --- a/source3/passdb/lookup_sid.c +++ b/source3/passdb/lookup_sid.c @@ -120,7 +120,7 @@ bool lookup_name(TALLOC_CTX *mem_ctx, goto ok; } - if (((flags & LOOKUP_NAME_NO_NSS) == 0) + if (((flags & (LOOKUP_NAME_NO_NSS|LOOKUP_NAME_GROUP)) == 0) && strequal(domain, unix_users_domain_name())) { if (lookup_unix_user_name(name, &sid)) { type = SID_NAME_USER; @@ -293,7 +293,7 @@ bool lookup_name(TALLOC_CTX *mem_ctx, /* 11. Ok, windows would end here. Samba has two more options: Unmapped users and unmapped groups */ - if (((flags & LOOKUP_NAME_NO_NSS) == 0) + if (((flags & (LOOKUP_NAME_NO_NSS|LOOKUP_NAME_GROUP)) == 0) && lookup_unix_user_name(name, &sid)) { domain = talloc_strdup(tmp_ctx, unix_users_domain_name()); type = SID_NAME_USER; diff --git a/source3/passdb/lookup_sid.h b/source3/passdb/lookup_sid.h index 872f4ef0bae..8b5edf6bcb8 100644 --- a/source3/passdb/lookup_sid.h +++ b/source3/passdb/lookup_sid.h @@ -31,7 +31,7 @@ struct unixid; #define LOOKUP_NAME_NONE 0x00000000 #define LOOKUP_NAME_ISOLATED 0x00000001 /* Look up unqualified names */ #define LOOKUP_NAME_REMOTE 0x00000002 /* Ask others */ -#define LOOKUP_NAME_GROUP 0x00000004 /* (unused) This is a NASTY hack for +#define LOOKUP_NAME_GROUP 0x00000004 /* This is a NASTY hack for valid users = @foo where foo also exists in as user. */ #define LOOKUP_NAME_NO_NSS 0x00000008 /* no NSS calls to avoid |