summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* VERSION: Diable GIT_SNAPSHOT for the 4.9.12 release.samba-4.9.12Karolin Seeger2019-08-271-1/+1
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* WHATSNEW: Add release notes for Samba 4.9.12.Karolin Seeger2019-08-271-2/+80
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* vfs_glusterfs: Enable profiling for file system operationsAnoop C S2019-08-261-49/+295
| | | | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14093 Signed-off-by: Anoop C S <anoopcs@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Aug 20 19:25:28 UTC 2019 on sn-devel-184 Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Mon Aug 26 13:26:08 UTC 2019 on sn-devel-144
* vfs_gpfs: Implement special case for denying owner access to ACLChristof Schmitt2019-08-261-4/+33
| | | | | | | | | | | | | | | In GPFS, it is not possible to deny ACL or attribute access through a SPECIAL_OWNER entry. The best that can be done is mapping this to a named user entry, as this one can at least be stored in an ACL. The same cannot be done for inheriting SPECIAL_OWNER entries, as these represent CREATOR OWNER entries, and the limitation of not being able to deny owner access to ACL or attributes remains. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit c1770ed96fd3137f45d584ba9328333d5505e3af)
* vfs_gpfs: Move mapping from generic NFSv ACL to GPFS ACL to separate functionChristof Schmitt2019-08-261-28/+41
| | | | | | | | | | | This is not functional change. It cleans up the code a bit and makes expanding this codepath in a later patch easier. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit fbf3a090a9ec94262b2924461cc1d6336af9919c)
* docs: Remove gpfs:merge_writeappend from vfs_gpfs manpageChristof Schmitt2019-08-261-20/+0
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 8bd79ecc37376dbaa35606f9c2777653eb3d55e3)
* vfs_gpfs: Remove merge_writeappend parameterChristof Schmitt2019-08-261-23/+0
| | | | | | | | | | | | All supported GPFS versions now support setting WRITE and APPEND in the ACLs independently. Remove this now unused parameter to simplify the code. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 0aca678fcf1788a76cf0ff11399211c795aa7d2f)
* nfs4_acls: Use correct owner information for ACL after owner changeChristof Schmitt2019-08-261-14/+22
| | | | | | | | | | | | | | | | After a chown, the cached stat data is obviously no longer valid. The code in smb_set_nt_acl_nfs4 checked the file correctly, but did only use a local buffer for the stat data. So later checks of the stat buffer under the fsp->fsp_name->st would still see the old information. Fix this by removing the local stat buffer and always update the one under fsp->fsp_name->st. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 86f7af84f04b06ed96b30f936ace92aa0937be06)
* nfs4_acls: Add test for merging duplicates when mapping from NFS4 ACL to DACLChristof Schmitt2019-08-261-0/+79
| | | | | | | | | | | | The previous patch introduced merging of duplicates on the mapping path from NFS4 ACL entries to DACL entries. Add a testcase to verify the expected behavior of this codepath. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 1a137a2f20c2f159c5feaef230a2b85bb9fb23b5)
* nfs4_acls: Remove duplicate entries when mapping from NFS4 ACL to DACLChristof Schmitt2019-08-261-0/+31
| | | | | | | | | | | | The previous patch added an additional entry for IDMAP_TYPE_BOTH. When mapping back to a DACL, there should be no additional entry. Add a loop that will check and remove entries that are exact duplicates. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 9c88602128592ddad537bf70cbe3c51f0b2cebe5)
* nfs4_acls: Rename smbacl4_fill_ace4 functionChristof Schmitt2019-08-261-11/+9
| | | | | | | | | | | As this function now maps the ACE and also adds it to the NFSv4 ACE, change the name to better describe its behavior. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 169812943de23cf2752289c63331d786b0b063bd)
* nfs4_acls: Add additional owner entry when mapping to NFS4 ACL with ↵Christof Schmitt2019-08-262-7/+69
| | | | | | | | | | | | | | | IDMAP_TYPE_BOTH With IDMAP_TYPE_BOTH, all entries have to be mapped to group entries. In order to have the file system reflect the owner permissions in the POSIX modebits, create a second entry for the user. This will be mapped to the "special owner" entry. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit b796119e2df38d1935064556934dd10da6f3d339)
* nfs4_acls: Remove redundant pointer variableChristof Schmitt2019-08-261-30/+26
| | | | | | | | | | | | The previous patch introduced a pointer to a local variable to reduce the amount of lines changed. Remove that pointer and adjust all usage accordingly. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit aa4644193635d846c2e08e8c1e7b512e8009c2ef)
* nfs4_acls: Remove redundant logging from smbacl4_fill_ace4Christof Schmitt2019-08-261-8/+0
| | | | | | | | | | | Logging flags in case they do not match seems unnecessary. Other log messages should show the flags as well. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 7ab0003ffc098247c3ee3962d7061f2af5a2d00e)
* nfs4_acls: Move adding of NFS4 ACE to ACL to smbacl4_fill_ace4Christof Schmitt2019-08-261-29/+39
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit abb58b17599bd3f9a06037e208dcc5033c7fdd8b)
* nfs4_acls: Move smbacl4_MergeIgnoreReject functionChristof Schmitt2019-08-261-31/+30
| | | | | | | | | | This static function will be called earlier in later patches. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 3499d97463110f042415d917160bc2743805a544)
* nfs4_acls: Remove i argument from smbacl4_MergeIgnoreRejectChristof Schmitt2019-08-261-9/+6
| | | | | | | | | | | This is only used for logging of a rejected ACL, but does not provide additional useful information. Remove it to simplify the function a bit. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 44790721e4f2c6ee6f46de7ac88123ce1a9f6e39)
* nfs4_acls: Add missing braces in smbacl4_win2nfs4Christof Schmitt2019-08-261-2/+4
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit ba73d2363d93a376ba4947963c9de45a7e683f02)
* nfs4_acls: Add helper function for checking INHERIT flags.Christof Schmitt2019-08-262-6/+11
| | | | | | | | | | | This avoids some code duplication. Do not make this static, as it will be used in a later patch. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmit <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 336e8668c1cc3682cb3c198eb6dc49baf522a79a)
* nfs4_acls: Use correct type when checking ownerGIDChristof Schmitt2019-08-261-1/+1
| | | | | | | | | | | | uid and gid are members of the same union so this makes no difference, but for type correctness and readability use the gid to check for ownerGID. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 3b3d722ce579c19c7b08d06a3adea275537545dc)
* nfs4_acls: Use switch/case for checking idmap typeChristof Schmitt2019-08-261-9/+18
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit f198a0867e71f248d4887ab0b6f2832123b16d11)
* nfs4_acls: Use sids_to_unixids to lookup uid or gidChristof Schmitt2019-08-261-6/+14
| | | | | | | | | | | This is the newer API to lookup id mappings and will make it easier to add to the IDMAP_TYPE_BOTH case. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit d9a2ff559e1ad953141b1118a9e370496f1f61fa)
* test_nfs4_acls: Add test for mapping from DACL to NFS4 ACL with IDMAP_TYPE_BOTHChristof Schmitt2019-08-261-0/+85
| | | | | | | | | | | | | | | | | When id mappings use IDMAP_TYPE_BOTH, the NFSv4 ACL mapping code is not aware whether a particular entry is for a user or a group. The underlying assumption then is that is should not matter, as both the ACL mapping maps everything to NFSv4 ACL group entries and the user's token will contain gid entries for the groups. Add a testcase to verify that when mapping from DACLS to NFSv4 ACL entries with IDMAP_TYPE_BOTH, all entries are mapped as expected. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 38331b00521ef764893a74add01758f14567d901)
* test_nfs4_acls: Add test for mapping from NFS4 ACL to DACL with IDMAP_TYPE_BOTHChristof Schmitt2019-08-261-0/+67
| | | | | | | | | | | | | | | | | When id mappings use IDMAP_TYPE_BOTH, the NFSv4 ACL mapping code is not aware whether a particular entry is for a user or a group. The underlying assumption then is that is should not matter, as both the ACL mapping maps everything to NFSv4 ACL group entries and the user's token will contain gid entries for the groups. Add a testcase to verify that when mapping from NFSv4 ACL entries to DACLs with IDMAP_TYPE_BOTH, all entries are mapped as expected. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 86480410aec1d2331c65826a13f909492165a291)
* test_nfs4_acls: Add test for mapping from NFS4 to DACL in config mode specialChristof Schmitt2019-08-261-0/+63
| | | | | | | | | | | | | | | | | | | | The mapping code between NFSv4 ACLs and security descriptors still has the deprecated config setting "nfs4:mode = special". This should not be used as it has security problems: All entries matching owner or group are mapped to "special owner" or "special group", which can change its meaning when being inherited to a new file or directory with different owner and owning group. This mode should eventually be removed, but as long as it still exists add testcases to verify the expected behavior. This patch adds the testcase for "nfs4:mode = special" when mapping from the NFS4 ACL to the DACL in the security descriptor. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 829c5ea99685c0629fd67ed0528897534ff35b36)
* test_nfs4_acls: Add test for mapping from DACL to NFS4 ACL with config specialChristof Schmitt2019-08-261-0/+119
| | | | | | | | | | | | | | | | | | | | The mapping code between NFSv4 ACLs and security descriptors still has the deprecated config setting "nfs4:mode = special". This should not be used as it has security problems: All entries matching owner or group are mapped to "special owner" or "special group", which can change its meaning when being inherited to a new file or directory with different owner and owning group. This mode should eventually be removed, but as long as it still exists add testcases to verify the expected behavior. This patch adds the testcase for "nfs4:mode = special" when mapping from the DACL in the security descriptor to the NFSv4 ACL. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 7ae06d96eb59722154d30e21949f9dba4f2f0bc6)
* test_nfs4_acls: Add test for matching DACL entries for acedupChristof Schmitt2019-08-261-0/+122
| | | | | | | | | | | | | | The NFSv4 mapping code has a config option nfs4:acedup for the mapping path from DACLs to NFSv4 ACLs. Part of this codepath is detecting duplicate ACL entries. Add a testcase with different ACL entries and verify that only exactly matching entries are detected as duplicates and treated accordingly. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit f55cdf42a14f314102f2e13cb06d4db48c08ad4b)
* test_nfs4_acls: Add test for acedup settingsChristof Schmitt2019-08-261-0/+124
| | | | | | | | | | | | | | The NFSv4 ACL mapping code has a setting nfs4:acedup. Depending on the setting, when mapping from DACLs to NFSv4 ACLs, duplicate ACL entries are either merged, ignored or rejected. Add a testcase that has duplicate ACL entries and verify the expected behavior for all possible settings of the nfs4:acedup option. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 9671bf2b9f055012057620207624aa2f4ea6833e)
* test_nfs4_acls: Add test for 'map full control' optionChristof Schmitt2019-08-261-0/+82
| | | | | | | | | | | | | | | | "map full control" when enabled adds the DELETE_CHILD permission, when all other permissions are present. This allows Windows clients to display the "FULL CONTROL" permissions. Add a testcase that verifies this mapping when mapping from NFSv4 ACL to the DACL in the security descriptor. Also verify that switching the option off disables this behavior. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 30677df4dac4ebfcf4e3198db33f14be37948197)
* test_nfs4_acls: Add test for mapping from NFS4 to DACL CREATOR entriesChristof Schmitt2019-08-261-0/+122
| | | | | | | | | | | | | | | Add testcase for mapping from NFSv4 ACL entries for "special owner" and "special group" to DACL entries in the security descriptor. Each NFSv4 entry here with INHERIT_ONLY maps directly to a CREATOR OWNER or CREATOR GROUP entry in the DACL. Entries without INHERIT_ONLY map to the CREATOR entry and an additional explicit entry granting permission on the current object. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 3c9cda0f6d80258ef0c2a80d6e24dfb650fea1b1)
* test_nfs4_acls: Add test for mapping CREATOR entries to NFS4 ACL entriesChristof Schmitt2019-08-261-0/+108
| | | | | | | | | | | | | | | | | | Add testcase for mapping DACL entries CREATOR OWNER and CREATOR GROUP with inheritance flag in the security descriptor to NFSv4 "special owner" and "special group" entries. This is the correct mapping for these entries as inheriting "special owner" and "special group" grants permissions to the actual owner and owning group of the new file or directory, similar to what CREATOR entries do. The other side is that CREATOR entries without any inheritance flags do not make sense, so these are not mapped to NFSv4 ACL entries. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit bfcc19b705f83bdd5cf665fd4daf43e7eae997a9)
* test_nfs4_acls: Add test for mapping from DACL to special NFS4 ACL entriesChristof Schmitt2019-08-261-0/+108
| | | | | | | | | | | | | | | | | Add testcase for mapping from entries in the DACL security descriptor to "special" entries in the NFSv4 ACL. Verify that the WORLD well-known SID maps to "everyone" in the NFSv4 ACL. Verify that the "Unix NFS" SID is ignored, as there is no meaningful mapping for this entry. Verify that SID entries matching the owner or group are mapped to "special owner" or "special group", but only if no inheritance flags are used. "special owner" and "special group" with inheritance flags have the meaning of CREATOR OWNER and CREATOR GROUP and will be tested in another testcase. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 1f1fa5bde2c76636c1beec39c21067b252ea10be)
* test_nfs4_acls: Add test for mapping of special NFS4 ACL entries to DACL entriesChristof Schmitt2019-08-261-0/+139
| | | | | | | | | | | | | | | | In addition to entries for users and groups, NFSv4 ACLs have the concept of entries for "special" entries. Only the "owner", "group" and "everyone" entries are currently used in the ACL mapping. Add a testcase that verifies the mapping from NFSv4 "special" entries to the DACL in the security descriptor. Verify that only "owner", "group" and "everyone" are mapped and all other "special" entries are ignored. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit f86148948c7f89307a34e31f6ddede6923149d34)
* test_nfs4_acls: Add test for mapping permissions from DACL to NFS4 ACLChristof Schmitt2019-08-261-0/+106
| | | | | | | | | | | | | | Add testcase for mapping the permission flags from the DACL in the Security Descriptor to a NFSv4 ACL. The mapping is straight-forward as the same permission bits exist for Security Descriptors and NFSv4 ACLs. In addition, the code also maps from the generic DACL permissions to a set of NFSv4 permissions, also verify this mapping. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit e4840e680744bd860beedeb5123704c3c0d6a4d7)
* test_nfs4_acls: Add test for mapping permissions from NFS4 ACL to DACLChristof Schmitt2019-08-261-0/+77
| | | | | | | | | | | | Add testcase for mapping permissions from the NFSv4 ACL to DACL in the security descriptor. The mapping is simple as each permission bit exists on both sides. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 1767027b44a9e4ebd865022e3f8abb0c72bf15c6)
* test_nfs4_acls: Add test for flags mapping from DACL to NFS4 ACLChristof Schmitt2019-08-261-0/+87
| | | | | | | | | | | | | Add testcase for the mapping of inheritance flags from the DACL in the security descriptor to the NFSv4 ACL. The mapping is different for files and directories as some inheritance flags should not be present for files. Also other flags are not mapped at all, verify this behavior. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit bccd2612761e26ee2514935d56927b2c0c000859)
* test_nfs4_acls: Add test for flags mapping from NFS4 ACL to DACLChristof Schmitt2019-08-261-0/+87
| | | | | | | | | | | | | | Add testcase for the mapping of inheritance flags when mapping from a NFSv4 ACL to a DACL in the security descriptor. The mapping is different between files and directories, as some inheritance flags should never be present for files. Some defined flags like SUCCESSFUL_ACCESS are also not mapped at this point, also verify this behavior. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 16eb61a900c6749c2554d635ce2dd903f5de1704)
* test_nfs4_acls: Add tests for mapping of ACL typesChristof Schmitt2019-08-261-0/+107
| | | | | | | | | | | Add testcases for mapping the type field (ALLOW or DENY) between NFSv4 ACLs and security descriptors. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit dd5934797526ebb4c6f3027a809401dad3abf701)
* test_nfs4_acls: Add tests for mapping of empty ACLsChristof Schmitt2019-08-261-0/+53
| | | | | | | | | | | This is a fairly simple test that ensures the mapping of empty ACLs (without any ACL entries) is always done the same way. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 00f494b25f4e1d1aecf6191523e30f20a90b1e4f)
* selftest: Start implementing unit test for nfs4_aclsChristof Schmitt2019-08-263-0/+145
| | | | | | | | | | | | | | | | Existing smbtorture tests set and query ACLs through SMB, only working with the DACLs in the Security Descriptors, but never check the NFSv4 ACL representation. This patch introduces a unit test to verify the mapping between between Security Descriptors and NFSv4 ACLs. As the mapping code queries id mappings, the id mapping cache is first primed with the mappings used by the tests and those mappings are removed again during teardown. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 8fb906a1860452a320c79ac87917a97303729c19)
* nfs4_acls: Remove fsp from smbacl4_win2nfs4Christof Schmitt2019-08-261-12/+10
| | | | | | | | | | | | Only the information whether the ACL is for a file or a directory is required. Replacing the fsp with a flag is clearer and allows for unit testing of the mapping functions. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit a06486bb110d04a90b66a0bca4b1b600ef3c0ebf)
* Revert "nfs4acl: Fix owner mapping with ID_TYPE_BOTH"Christof Schmitt2019-08-261-8/+1
| | | | | | | | | | | | | | | | This reverts commit 5d4f7bfda579cecb123cfb1d7130688f1d1c98b7. That patch broke the case with ID_TYPE_BOTH where a file is owned by a group (e.g. using autorid and having a file owned by BUILTIN\Administrators). In this case, the ACE entry for the group gets mapped a to a user ACL entry and the group no longer has access (as in the user's token the group is not mapped to a uid). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032 Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 42bd3a72a2525aa8a918f4bf7067b30ce8e0e197)
* vfs: Use dom_sid_str_bufVolker Lendecke2019-08-263-8/+18
| | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> (cherry picked from commit 59f29acb2cd947d2f594a5af3d73d0cbe8298d92)
* Add PrimaryGroupId to group array in DC responseIsaac Boukris2019-08-262-3/+6
| | | | | | | | | | | | | | | | | | This is a simplified version of the original patch by: Felix Botner <botner@univention.de> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11362 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Isaac Boukris <iboukris@gmail.com> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Jul 3 13:52:55 UTC 2019 on sn-devel-184 (cherry picked from commit 2ae75184fcb5dc90602aeef113d4c13540073324)
* selftest: check for PrimaryGroupId in DC returned group arrayIsaac Boukris2019-08-262-1/+49
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=11362 Signed-off-by: Isaac Boukris <iboukris@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 3700998419738caa1ca8672fbf5dbaccaaa498fa)
* selftest: remote_pac: s/s2u4self/s4u2self/gIsaac Boukris2019-08-261-32/+33
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=11362 Signed-off-by: Isaac Boukris <iboukris@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 60afe949c3e664f81c9b0db9c54f701aa2874a5e)
* vfs:glusterfs_fuse: build only if we have setmntent()Michael Adam2019-08-261-1/+3
| | | | | | | | | | | | | | | | FreeBSD and other platforms that don't have setmntent() and friends can not compile this module. This patch lets changes the build to only compile this module if the setmntent() function is found. This is the a follow-up fix to the actual fix for bug #13972. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13972 Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Amitay Isaacs <amitay@gmail.com> Autobuild-User(master): Amitay Isaacs <amitay@samba.org> Autobuild-Date(master): Thu Aug 1 09:49:04 UTC 2019 on sn-devel-184
* vfs:glusterfs_fuse: ensure fileids are constant across nodesMichael Adam2019-08-262-1/+200
| | | | | | | | | | | | | | | | Instead of adding a new gluster-specific mode to the fileid module, this patches provides a fileid algorithm as part of the glusterfs_fuse vfs module. This can not be configured further, simply adding the glusterfs_fuse vfs module to the vfs objects configuration will enable the new fileid mode. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13972 Signed-off-by: Michael Adam <obnox@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Sat Jul 13 22:54:56 UTC 2019 on sn-devel-184
* smbtorture: extend rpc.lsa to lookup machine over forest-wide LookupNamesAlexander Bokovoy2019-08-161-1/+7
| | | | | | | | | | | | | | | | | | | Add a simple test to resolve DOMAIN\MACHINE$ via LSA LookupNames3 using LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 level. This level would pass zero lookup flags to lookup_name(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14091 Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Alexander Bokovoy <ab@samba.org> Autobuild-Date(master): Wed Aug 14 13:07:42 UTC 2019 on sn-devel-184 (cherry picked from commit 4d276a93fc624dc04d880f5b4157f272d3555be6) Autobuild-User(v4-9-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-9-test): Fri Aug 16 14:18:35 UTC 2019 on sn-devel-144
* lookup_name: allow own domain lookup when flags == 0Alexander Bokovoy2019-08-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In 2007, we've added support for multiple lookup levels for LSA LookupNames family of calls. However, forest-wide lookups, as described in MS-LSAT 2.2.16, never worked because flags passed to lookup_name() were always set to zero, expecting at least default lookup on a DC to apply. lookup_name() was instead treating zero flags as 'skip all checks'. Allow at least own domain lookup in case domain name is the same. This should allow FreeIPA DC to respond to LSA LookupNames3 calls from a trusted AD DC side. For the reference, below is a request Windows Server 2016 domain controller sends to FreeIPA domain controller when attempting to look up a user from a trusted forest root domain that attemps to login to the domain controller. Notice the level in the lsa_LookupNames3 call and resulting flags in lookup_name(). [2019/08/03 07:14:24.156065, 1, pid=23639, effective(967001000, 967001000), real(967001000, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) lsa_LookupNames3: struct lsa_LookupNames3 in: struct lsa_LookupNames3 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000004c-0000-0000-455d-3018575c0000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x000a (10) size : 0x000c (12) string : * string : 'XS\ab' sids : * sids: struct lsa_TransSidArray3 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2019/08/03 07:14:24.156189, 6, pid=23639, effective(967001000, 967001000), real(967001000, 0), class=rpc_srv] ../../source3/rpc_server/rpc_handles.c:339(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 4C 00 00 00 00 00 00 00 45 5D 30 18 ....L... ....E]0. [0010] 57 5C 00 00 W\.. [2019/08/03 07:14:24.156228, 4, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/smbd/sec_ctx.c:215(push_sec_ctx) push_sec_ctx(967001000, 967001000) : sec_ctx_stack_ndx = 2 [2019/08/03 07:14:24.156246, 4, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/smbd/uid.c:552(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2019/08/03 07:14:24.156259, 4, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/smbd/sec_ctx.c:319(set_sec_ctx_internal) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2019/08/03 07:14:24.156273, 5, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2019/08/03 07:14:24.156285, 5, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/auth/token_util.c:865(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2019/08/03 07:14:24.156311, 5, pid=23639, effective(0, 0), real(0, 0), class=rpc_srv] ../../source3/rpc_server/lsa/srv_lsa_nt.c:244(lookup_lsa_sids) lookup_lsa_sids: looking up name XS\ab [2019/08/03 07:14:24.156327, 10, pid=23639, effective(0, 0), real(0, 0)] ../../source3/passdb/lookup_sid.c:112(lookup_name) lookup_name: XS\ab => domain=[XS], name=[ab] [2019/08/03 07:14:24.156340, 10, pid=23639, effective(0, 0), real(0, 0)] ../../source3/passdb/lookup_sid.c:114(lookup_name) lookup_name: flags = 0x00 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14091 Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> (cherry picked from commit 685bb03de6ab733590831d1df4f5fd60d2ac427d)
View Lorry Controller Status