summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2012-04-19autoconf: set version to 5.4.1 for interim buildsJeff Layton1-1/+1
Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-04-18autoconf: set version to 5.4cifs-utils-5.4Jeff Layton1-1/+1
Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-04-18docs: update to project resources in READMEJeff Layton2-4/+6
...and add Igor Druzhinin and Pavel Shilovsky to AUTHORS. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-04-16automake: add -Werror to CFLAGSJeff Layton1-1/+1
With the recent patch to fix the warnings in asn1.c, cifs-utils now builds without any warnings. Ban them henceforth by adding -Werror for builds. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-04-15asn1: fix up some compiler warnings in asn1.cJeff Layton1-5/+10
These have been around for quite some time. gcc -DHAVE_CONFIG_H -I. -Wall -Wextra -g -O2 -MT asn1.o -MD -MP -MF .deps/asn1.Tpo -c -o asn1.o asn1.c asn1.c: In function ‘asn1_write’: asn1.c:45:19: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] asn1.c: In function ‘asn1_peek’: asn1.c:411:22: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] asn1.c: In function ‘asn1_tag_remaining’: asn1.c:541:16: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] asn1.c: In function ‘_ber_read_OID_String_impl’: asn1.c:570:22: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] Almost all of these are due to the fact that asn1_data->ofs is a signed value, and ->length is unsigned. This should clear the way to add -Werror to the cflags in the near future. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-04-15autoconf: fix tests for wbclient to use pkgconfigJeff Layton3-52/+10
Use the pkgconfig file that's included with wbclient to perform the test for wbclient usability, and to set the correct CFLAGS and LDADD. This is particularly necessary on recent Fedora with samba4 since it puts the wbclient.h file in a different directory than before. Also, remove a redundant test for wbclient.h from configure.ac. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-04-02mount.cifs: don't allow unprivileged users to mount onto dirs to which theyJeff Layton3-20/+72
can't chdir If mount.cifs is installed as a setuid root program, then a user can use it to gather information about files and directories to which he does not have access. One of the first things that mount.cifs does is to chdir() into the mountpoint and then proceeds to perform the mount onto ".". A malicious user could exploit this fact to determine information about directories to which he does not have access. Specifically, whether the dentry in question is a file or directory and whether it exists at all. This patch fixes this by making the program switch the fsuid to the real uid for unprivileged users when mounting. Note that this is a behavior change. mount.cifs has in the past allowed users to mount onto any directory as long as it's listed in /etc/fstab as a user mount. With this change, the user must also be able to chdir into the mountpoint without needing special privileges. Hopefully not many people have such a pathological configuration. This patch should fix CVE-2012-1586. Reported-by: Jesus Olmos <jesus.olmos@blueliv.com> Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-03-29cifs.upcall: use krb5_sname_to_principal to construct principal nameJeff Layton1-27/+20
Currently, we build the string by hand then then construct the principal name with krb5_parse_name. That bypasses the domain_realm section in krb5.conf however. Switch the code to use krb5_sname_to_principal instead which is more suited to this task. In order for that to work, we change a couple of calling functions to pass down a hostname instead of a principal name, and then pass in "cifs" as the service name. Reported-and-Tested-by: Nirupama Karandikar <nkarandi@redhat.com> Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-03-06mount.cifs: add support for -s optionJeff Layton1-1/+9
autofs generally calls mount helpers with '-s'. Handle that the same way we do for NFS -- append ",sloppy" option to the mount options. The kernel can look for that option to decide whether to ignore unknown mount options, warn, or error out. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-02-23mount.cifs: fix tests for strtoul successJeff Layton1-5/+7
The current test just looks to see if errno was 0 after the conversion but we need to do a bit more. According to the strtoul manpage: If there were no digits at all, strtoul() stores the original value of nptr in *endptr (and returns 0). So, if you pass in a string of letters, strtoul will return 0, but won't actually have converted anything. Luckily, in most cases, /bin/mount papers over this bug by doing uid/gid conversions itself before calling mount.cifs. Fix this by also checking to ensure that strtoul() converted the entire string in addition to checking that it didn't set errno. While we're at it, fix the test in backupuid/backupgid options as well which don't currently check whether errno got set. Reported-by: Kyle Squizzato <ksquizza@redhat.com> Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-02-20manpage: update wsize= entry to account for change in default wsizeJeff Layton1-1/+3
Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-02-12cifs-utils: allow specifying rootsbindir at configure timeJeff Layton2-2/+10
...via the $ROOTSBINDIR environment variable, and AC_ARG_VAR macro. The default is to use /sbin for this value, which only currently affects the installation location of mount.cifs. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-02-12autoconf: set release to 5.3.1 for interim buildsJeff Layton0-0/+0
Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-02-12autoconf: set release to 5.3.1 for interim buildsJeff Layton1-1/+1
Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-28autoconf: set version to 5.3cifs-utils-5.3Jeff Layton1-1/+1
...and fix the URL for cifs-utils. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-24cifscreds: build it by defaultJeff Layton1-5/+13
...but either error out or disable it if keyutils.h isn't present. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-24cifscreds: add a manpageJeff Layton3-0/+281
...I'm also including the POD sources here for easier editing, but we may remove them in the future if it becomes burdensome to keep up 2 copies. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: change prefix on keys to "cifs:" instead of "cifscreds:"Jeff Layton1-6/+7
The "creds" portion seems redundant. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: make key_search use keyctl_searchJeff Layton1-45/+1
...which is much more efficient than walking the keyring by hand. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: make cifscreds use the "logon" key_typeJeff Layton1-5/+5
...and have it loosen the permissions to allow searching. There seems to be no clear way to make user keys unreadable, but still allow for them to be searched, so we'll need a new key_type that doesn't allow you to read the payload from userspace. That will be proposed in a separate kernel patch. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: use the session keyringJeff Layton1-1/+1
This seems like a reasonable change, but I'm willing to listen to arguments to the contrary... cifscreds currently hangs the keys off of the uid keyring. It seems more appropriate though that we require that each session have its own set. This might be particularly important in a containerized situation. If a user authenticates in one container, then we probably don't want to allow a user in another to "borrow" those creds. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: loosen allowed characters in domain namesJeff Layton1-5/+8
As Donald points out, NetBIOS domains are allowed more characters than the code currently allows. Change the test to one that checks for disallowed characters instead. Also, I can't find anything that says that '@' is not allowed in a username. Might as well allow that too. Worst case, the server will reject the username. Reported-by: Donald R. Gray Jr <donald.r.gray@gmail.com> Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: add --domain flagJeff Layton1-20/+44
...to indicate that the first argument is not a hostname but an NT domain name. If it's set, then treat the argument as a string literal. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: make username parameter optionalJeff Layton1-11/+28
...and use getopt_long to get it. If someone doesn't specify the username, use getusername() to get it. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: move option parsing into main()Jeff Layton1-32/+44
Having to parse options in every command routine is cumbersome and restrictive. Declare a struct to hold arguments, and then have the functions take that struct as an argument. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: make usage use "return" and have callers returnJeff Layton1-10/+11
...banish the use of exit(), which may be helpful in the future in the event that we eventually move some of this code into a library. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: make username part of value instead of descriptionJeff Layton1-19/+11
Change the payload to be "username:password". Since usernames can't contain ':', this is suitable delimiter. Also, create_description is just a sprintf now, so eliminate it. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: remove user parameter from create_descriptionJeff Layton1-8/+8
The username should be part of the key payload and not part of the description. Also, prefix the address with an "a:" in the description. Eventually we'll also need a "domain" key variant. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: eliminate domain parm from most functionsJeff Layton1-67/+18
Eventually we'll add this back in a different way. The domain and address should be exclusive of one another. IOW, we want the kernel to be able to find credentials for a specific address or for the domain of which the server is a member. Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17cifscreds: add unused attribute to argv parm in cifscreds_clearallJeff Layton1-1/+1
...to eliminate this warning: cifscreds.c: In function ‘cifscreds_clearall’: cifscreds.c:422:47: warning: unused parameter ‘argv’ Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-17util: move getusername to util.cJeff Layton3-11/+14
Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-16mount.cifs: handle errors from rename() in del_mtabJeff Layton1-1/+5
The new del_mtab code ignored errors from rename(). Make it handle that error as well like it does other errors. Cc: Carlos Maiolino <cmaiolino@redhat.com> Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-16mount.cifs: Properly update mtab during remountCarlos Maiolino1-1/+98
During a remount of a cifs filesystem, the mtab file is not properly updated, which leads to a doubled entry of the same filesystem in the /etc/mtab file. This patch adds a new function del_mtab() which is called before the add_mtab() in case the fs is being remounted. The del_mtab() function will delete from the mtab, the old entry from the filesystem which is being remounted, and then, calls add_mtab() to add an updated entry to the mtab file. Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
2012-01-16cifs.upcall: allow admins to specify an alternate krb5.conf fileJeff Layton2-4/+17
This was actually requested by the Red Hat QA group, who sometimes work with multiple krb5.conf files when testing. Requested-by: Marko Myllynen <myllynen@redhat.com> Signed-off-by: Jeff Layton <jlayton@samba.org>
2012-01-10get/setcifsacl: don't link in -lkeyutilsJeff Layton1-2/+2
These binaries don't use keys API at all. There's no need to link in the keys library. Reported-by: Frédéric L. W. Meunier <fredlwm@fredlwm.net> Signed-off-by: Jeff Layton <jlayton@samba.org> Acked-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
2011-12-10contrib: add a set of sample /etc/request-key.d filesJeff Layton8-1/+22
Add a contrib directory, a set of sample /etc/request-key.d files and a README that explains what they're for. This version sets the path to the upcall programs based on the configure options. Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-12-09autoconf: bump release to 5.2.1 for interim buildsJeff Layton1-1/+1
Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-12-09autoconf: set version to 5.2cifs-utils-5.2Jeff Layton1-1/+1
Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-12-05manpage: add an entry for prefixpath= to the mount.cifs manpageJeff Layton1-0/+5
Reported-by: Sumit Bose <sbose@redhat.com> Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-12-03cifs.upcall: try and guess the domain name on unqualified namesJeff Layton1-5/+42
Resolve the unqualified hostname and set AI_CANONNAME to make sure that field is populated. Scan forward to the first '.' in ai_canonname, and append that value onto the unqualified hostname to get a FQDN. Then prepend that value with "cifs/" and try to get a service ticket for that principal. Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-12-03cifs.upcall: move to Andrew's suggested algorithm for picking a principalJeff Layton2-13/+29
Andrew Bartlett suggests the heuristic supplied in the comments. For now, we don't try to guess the domainname when the hostname is not qualified, but add a comment with what needs to be done in order to support that. Also, with this change we no longer need util.o to be linked in. Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-12-03cifs.upcall: always lowercase the hostnameJeff Layton1-0/+12
Most KDCs are case-sensitive (the notable exception being AD), but DNS is case-insensitive. To prevent admins from having to put in all possible case combinations of a principal, lowercase the hostname prior to trying to get a principal. Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-12-03cifs.upcall: move to an on-stack princ bufferJeff Layton1-14/+11
...and check to see if provided hostname will exceed it. Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-12-03resolve_host: silence compiler warning about discarding const qualifierJeff Layton1-2/+1
...don't use "ipaddr" here since it's a const pointer. Signed-off-by: Jeff Layton <jlayton@samba.org> Reviewed-by: Steve French <sfrench@us.ibm.com>
2011-11-12cifs.upcall: silence unused parameter warningJeff Layton1-1/+1
cifs.upcall.c: In function ‘cifs_krb5_principal_get_realm’: cifs.upcall.c:80:57: warning: unused parameter ‘context’ [-Wunused-parameter] Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-10-19manpage: document new rsize= behaviorJeff Layton1-2/+2
With the addition of async readpages in 3.2 kernels, the behavior of the rsize= option has changed. Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-10-19cifs.idmap: Add uid/gid to SID mapping functions (try #3)Shirish Pargaonkar1-0/+37
Add functions to map a uid and gid to a SID. These functions are similar to SID to uid and gid mapping functions. A SID is what is returned to the cifs module. Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
2011-10-19manpage: cleanups to new backupuid/gid sectionsJeff Layton1-9/+5
Minor cleanups and consistency fixes... Cc: Shirish Pargaonkar <shirishpargaonkar@gmail.com> Signed-off-by: Jeff Layton <jlayton@samba.org>
2011-10-19mount.cifs: Add mount options for backup intent and their manpages (try #8)Shirish Pargaonkar2-2/+118
Add mount options backupuid and backugid and their manpage contents. Check for either a valid uid/gid or valid user/group name. Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
2011-10-18cifs-utils: manpage: mention the required kernel version to make cifs.idmap workSuresh Jayaraman1-0/+3
Cc: Shirish Pargaonkar <shirishpargaonkar@gmail.com> Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-23 01:06:44 +0000