smbd/uid.c

ソースコードを見る。

データ構造
struct	conn_ctx
関数
gid_t	get_current_user_gid_first (int *piterator)
gid_t	get_current_user_gid_next (int *piterator)
BOOL	change_to_guest (void)
static BOOL	check_user_ok (connection_struct *conn, user_struct *vuser, int snum)
BOOL	change_to_user (connection_struct *conn, uint16 vuid)
BOOL	change_to_root_user (void)
BOOL	become_authenticated_pipe_user (pipes_struct *p)
BOOL	unbecome_authenticated_pipe_user (void)
static void	push_conn_ctx (void)
static void	pop_conn_ctx (void)
void	become_root (void)
void	unbecome_root (void)
BOOL	become_user (connection_struct *conn, uint16 vuid)
BOOL	unbecome_user (void)
変数
current_user	current_user
static struct conn_ctx	conn_ctx_stack [MAX_SEC_CTX_DEPTH]
static int	conn_ctx_stack_ndx

---

関数

gid_t get_current_user_gid_first

(

int *

piterator

)

uid.c の 30 行で定義されています。

参照先 current_user・_unix_token::gid・current_user::ut.

{
        *piterator = 0;
        return current_user.ut.gid;
}

gid_t get_current_user_gid_next

(

int *

piterator

)

uid.c の 36 行で定義されています。

参照先 current_user・_unix_token::groups・_unix_token::ngroups・current_user::ut.

{
        gid_t ret;

        if (!current_user.ut.groups || *piterator >= current_user.ut.ngroups) {
                return (gid_t)-1;
        }

        ret = current_user.ut.groups[*piterator];
        (*piterator) += 1;
        return ret;
}

BOOL change_to_guest

(

void

)

uid.c の 53 行で定義されています。

参照先 current_user::conn・current_user・getpwnam_alloc()・set_sec_ctx()・current_user::vuid.

参照元 switch_message().

{
        static struct passwd *pass=NULL;

        if (!pass) {
                /* Don't need to free() this as its stored in a static */
                pass = getpwnam_alloc(NULL, lp_guestaccount());
                if (!pass)
                        return(False);
        }
        
#ifdef AIX
        /* MWW: From AIX FAQ patch to WU-ftpd: call initgroups before 
           setting IDs */
        initgroups(pass->pw_name, pass->pw_gid);
#endif
        
        set_sec_ctx(pass->pw_uid, pass->pw_gid, 0, NULL, NULL);
        
        current_user.conn = NULL;
        current_user.vuid = UID_FIELD_INVALID;

        TALLOC_FREE(pass);
        pass = NULL;
        
        return True;
}

static BOOL check_user_ok	(	connection_struct *	conn,
		user_struct *	vuser,
		int	snum
	)			[static]

uid.c の 85 行で定義されています。

参照先 vuid_cache_entry::admin_user・connection_struct::admin_user・vuid_cache::array・vuid_cache::entries・vuid_cache_entry::read_only・connection_struct::read_only・user_struct::vuid・vuid_cache_entry::vuid・connection_struct::vuid_cache.

参照元 change_to_user().

{
        unsigned int i;
        struct vuid_cache_entry *ent = NULL;
        BOOL readonly_share;
        NT_USER_TOKEN *token;

        for (i=0;i<conn->vuid_cache.entries && i< VUID_CACHE_SIZE;i++) {
                if (conn->vuid_cache.array[i].vuid == vuser->vuid) {
                        ent = &conn->vuid_cache.array[i];
                        conn->read_only = ent->read_only;
                        conn->admin_user = ent->admin_user;
                        return(True);
                }
        }

        if (!user_ok_token(vuser->user.unix_name, vuser->nt_user_token, snum))
                return(False);

        readonly_share = is_share_read_only_for_token(vuser->user.unix_name,
                                                      vuser->nt_user_token,
                                                      SNUM(conn));

        token = conn->nt_user_token ?
                conn->nt_user_token : vuser->nt_user_token;

        if (!readonly_share &&
            !share_access_check(token, lp_servicename(snum),
                                FILE_WRITE_DATA)) {
                /* smb.conf allows r/w, but the security descriptor denies
                 * write. Fall back to looking at readonly. */
                readonly_share = True;
                DEBUG(5,("falling back to read-only access-evaluation due to "
                         "security descriptor\n"));
        }

        if (!share_access_check(token, lp_servicename(snum),
                                readonly_share ?
                                FILE_READ_DATA : FILE_WRITE_DATA)) {
                return False;
        }

        i = conn->vuid_cache.entries % VUID_CACHE_SIZE;
        if (conn->vuid_cache.entries < VUID_CACHE_SIZE)
                conn->vuid_cache.entries++;

        ent = &conn->vuid_cache.array[i];
        ent->vuid = vuser->vuid;
        ent->read_only = readonly_share;

        ent->admin_user = token_contains_name_in_list(
                vuser->user.unix_name, NULL, vuser->nt_user_token,
                lp_admin_users(SNUM(conn)));

        conn->read_only = ent->read_only;
        conn->admin_user = ent->admin_user;

        return(True);
}

BOOL change_to_user	(	connection_struct *	conn,
		uint16	vuid
	)

uid.c の 150 行で定義されています。

参照先 connection_struct::admin_user・check_user_ok()・current_user::conn・current_user・dup_nt_token()・connection_struct::force_user・get_valid_user_struct()・user_struct::gid・connection_struct::gid・gid_to_sid()・user_struct::groups・connection_struct::groups・user_struct::n_groups・connection_struct::ngroups・user_struct::nt_user_token・connection_struct::nt_user_token・SEC_SHARE・userdom_struct::smb_name・user_struct::uid・connection_struct::uid・_unix_token::uid・userdom_struct::unix_name・user_struct::user・nt_user_token::user_sids・current_user::ut・current_user::vuid.

参照元 become_user()・close_cnum()・process_blocking_lock_queue()・switch_message().

{
        user_struct *vuser = get_valid_user_struct(vuid);
        int snum;
        gid_t gid;
        uid_t uid;
        char group_c;
        BOOL must_free_token = False;
        NT_USER_TOKEN *token = NULL;
        int num_groups = 0;
        gid_t *group_list = NULL;
        
        if (!conn) {
                DEBUG(2,("change_to_user: Connection not open\n"));
                return(False);
        }

        /*
         * We need a separate check in security=share mode due to vuid
         * always being UID_FIELD_INVALID. If we don't do this then
         * in share mode security we are *always* changing uid's between
         * SMB's - this hurts performance - Badly.
         */

        if((lp_security() == SEC_SHARE) && (current_user.conn == conn) &&
           (current_user.ut.uid == conn->uid)) {
                DEBUG(4,("change_to_user: Skipping user change - already "
                         "user\n"));
                return(True);
        } else if ((current_user.conn == conn) && 
                   (vuser != 0) && (current_user.vuid == vuid) && 
                   (current_user.ut.uid == vuser->uid)) {
                DEBUG(4,("change_to_user: Skipping user change - already "
                         "user\n"));
                return(True);
        }

        snum = SNUM(conn);

        if ((vuser) && !check_user_ok(conn, vuser, snum)) {
                DEBUG(2,("change_to_user: SMB user %s (unix user %s, vuid %d) "
                         "not permitted access to share %s.\n",
                         vuser->user.smb_name, vuser->user.unix_name, vuid,
                         lp_servicename(snum)));
                return False;
        }

        if (conn->force_user) /* security = share sets this too */ {
                uid = conn->uid;
                gid = conn->gid;
                group_list = conn->groups;
                num_groups = conn->ngroups;
                token = conn->nt_user_token;
        } else if (vuser) {
                uid = conn->admin_user ? 0 : vuser->uid;
                gid = vuser->gid;
                num_groups = vuser->n_groups;
                group_list  = vuser->groups;
                token = vuser->nt_user_token;
        } else {
                DEBUG(2,("change_to_user: Invalid vuid used %d in accessing "
                         "share %s.\n",vuid, lp_servicename(snum) ));
                return False;
        }

        /*
         * See if we should force group for this service.
         * If so this overrides any group set in the force
         * user code.
         */

        if((group_c = *lp_force_group(snum))) {

                token = dup_nt_token(NULL, token);
                if (token == NULL) {
                        DEBUG(0, ("dup_nt_token failed\n"));
                        return False;
                }
                must_free_token = True;

                if(group_c == '+') {

                        /*
                         * Only force group if the user is a member of
                         * the service group. Check the group memberships for
                         * this user (we already have this) to
                         * see if we should force the group.
                         */

                        int i;
                        for (i = 0; i < num_groups; i++) {
                                if (group_list[i] == conn->gid) {
                                        gid = conn->gid;
                                        gid_to_sid(&token->user_sids[1], gid);
                                        break;
                                }
                        }
                } else {
                        gid = conn->gid;
                        gid_to_sid(&token->user_sids[1], gid);
                }
        }
        
        /* Now set current_user since we will immediately also call
           set_sec_ctx() */

        current_user.ut.ngroups = num_groups;
        current_user.ut.groups  = group_list;   

        set_sec_ctx(uid, gid, current_user.ut.ngroups, current_user.ut.groups,
                    token);

        /*
         * Free the new token (as set_sec_ctx copies it).
         */

        if (must_free_token)
                TALLOC_FREE(token);

        current_user.conn = conn;
        current_user.vuid = vuid;

        DEBUG(5,("change_to_user uid=(%d,%d) gid=(%d,%d)\n",
                 (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));
  
        return(True);
}

BOOL change_to_root_user

(

void

)

uid.c の 283 行で定義されています。

参照先 current_user::conn・current_user・set_root_sec_ctx()・current_user::vuid.

参照元 async_processing()・close_cnum()・exit_server_common()・open_sockets_smbd()・process_blocking_lock_queue()・smbd_process()・start_background_queue()・switch_message()・timeout_processing().

{
        set_root_sec_ctx();

        DEBUG(5,("change_to_root_user: now uid=(%d,%d) gid=(%d,%d)\n",
                (int)getuid(),(int)geteuid(),(int)getgid(),(int)getegid()));

        current_user.conn = NULL;
        current_user.vuid = UID_FIELD_INVALID;

        return(True);
}

BOOL become_authenticated_pipe_user

(

pipes_struct *

p

)

uid.c の 302 行で定義されています。

参照先 _unix_token::gid・_unix_token::groups・_unix_token::ngroups・current_user::nt_user_token・pipes_struct::pipe_user・push_sec_ctx()・set_sec_ctx()・_unix_token::uid・current_user::ut.

参照元 api_pipe_request().

{
        if (!push_sec_ctx())
                return False;

        set_sec_ctx(p->pipe_user.ut.uid, p->pipe_user.ut.gid, 
                    p->pipe_user.ut.ngroups, p->pipe_user.ut.groups,
                    p->pipe_user.nt_user_token);

        return True;
}

BOOL unbecome_authenticated_pipe_user

(

void

)

uid.c の 321 行で定義されています。

参照先 pop_sec_ctx().

参照元 api_pipe_request().

{
        return pop_sec_ctx();
}

static void push_conn_ctx

(

void

)

[static]

uid.c の 340 行で定義されています。

参照先 current_user::conn・conn_ctx::conn・conn_ctx_stack・current_user・smb_panic()・current_user::vuid・conn_ctx::vuid.

参照元 become_root()・become_user().

{
        struct conn_ctx *ctx_p;
 
        /* Check we don't overflow our stack */
 
        if (conn_ctx_stack_ndx == MAX_SEC_CTX_DEPTH) {
                DEBUG(0, ("Connection context stack overflow!\n"));
                smb_panic("Connection context stack overflow!\n");
        }
 
        /* Store previous user context */
        ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];
 
        ctx_p->conn = current_user.conn;
        ctx_p->vuid = current_user.vuid;
 
        DEBUG(3, ("push_conn_ctx(%u) : conn_ctx_stack_ndx = %d\n",
                (unsigned int)ctx_p->vuid, conn_ctx_stack_ndx ));

        conn_ctx_stack_ndx++;
}

static void pop_conn_ctx

(

void

)

[static]

uid.c の 363 行で定義されています。

参照先 conn_ctx::conn・current_user::conn・conn_ctx_stack・current_user・smb_panic()・conn_ctx::vuid・current_user::vuid.

参照元 become_user()・unbecome_root()・unbecome_user().

{
        struct conn_ctx *ctx_p;
 
        /* Check for stack underflow. */

        if (conn_ctx_stack_ndx == 0) {
                DEBUG(0, ("Connection context stack underflow!\n"));
                smb_panic("Connection context stack underflow!\n");
        }

        conn_ctx_stack_ndx--;
        ctx_p = &conn_ctx_stack[conn_ctx_stack_ndx];

        current_user.conn = ctx_p->conn;
        current_user.vuid = ctx_p->vuid;

        ctx_p->conn = NULL;
        ctx_p->vuid = UID_FIELD_INVALID;
}

void become_root

(

void

)

uid.c の 389 行で定義されています。

参照先 push_conn_ctx()・push_sec_ctx()・set_root_sec_ctx().

{
        push_sec_ctx();
        push_conn_ctx();
        set_root_sec_ctx();
}

void unbecome_root

(

void

)

uid.c の 398 行で定義されています。

参照先 pop_conn_ctx()・pop_sec_ctx().

{
        pop_sec_ctx();
        pop_conn_ctx();
}

BOOL become_user	(	connection_struct *	conn,
		uint16	vuid
	)

uid.c の 409 行で定義されています。

参照先 change_to_user()・conn_ctx::conn・pop_conn_ctx()・pop_sec_ctx()・push_conn_ctx()・push_sec_ctx().

参照元 _srv_net_file_query_secdesc()・_srv_net_file_set_secdesc()・close_directory()・close_remove_share_mode()・delete_driver_files()・get_correct_cversion()・move_driver_to_download_area().

{
        if (!push_sec_ctx())
                return False;

        push_conn_ctx();

        if (!change_to_user(conn, vuid)) {
                pop_sec_ctx();
                pop_conn_ctx();
                return False;
        }

        return True;
}

BOOL unbecome_user

(

void

)

uid.c の 425 行で定義されています。

参照先 pop_conn_ctx()・pop_sec_ctx().

参照元 _srv_net_file_query_secdesc()・_srv_net_file_set_secdesc()・close_directory()・close_remove_share_mode()・delete_driver_files()・get_correct_cversion().

{
        pop_sec_ctx();
        pop_conn_ctx();
        return True;
}

---

変数

struct current_user current_user

smbrun.c の 24 行で定義されています。

参照元 afs_login()・api_RDosPrintJobDel()・api_WPrintQueueCtrl()・call_nt_transact_get_user_quota()・call_nt_transact_set_user_quota()・call_trans2qfsinfo()・call_trans2setfsinfo()・can_access_file()・can_access_file_acl()・can_delete_file_in_directory()・change_to_guest()・change_to_root_user()・change_to_user()・close_directory()・close_remove_share_mode()・current_user_in_group()・fake_perms_fstat()・fake_perms_stat()・fcb_or_dos_open()・get_current_user()・get_current_user_gid_first()・get_current_user_gid_next()・init_sec_ctx()・open_directory()・open_fake_file()・open_file()・open_file_ntcreate()・open_file_stat()・pop_conn_ctx()・pop_sec_ctx()・print_access_check()・print_fsp_open()・print_queue_update()・print_run_command()・push_conn_ctx()・reply_close()・set_sec_ctx()・smb_set_file_disposition_info()・smb_set_nt_acl_nfs4()・smbrun_internal()・smbrunsecret()・try_chown()・uid_entry_in_group()・unpack_nt_owners()・user_can_read_file()・user_can_write_file().

struct conn_ctx conn_ctx_stack[MAX_SEC_CTX_DEPTH] [static]

uid.c の 337 行で定義されています。

参照元 pop_conn_ctx()・push_conn_ctx().

int conn_ctx_stack_ndx [static]

uid.c の 338 行で定義されています。

---