samba.git/libcli/security, branch ldb-1.2.3

libcli/security: Move debug message to DBG_DEBUG()

2017-09-14T15:48:27+00:00

This message shows up a lot at level 6 for no particularly good reason

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13017

Signed-off-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall 
(cherry picked from commit 544084d4a2e19958982e6003b1b1290315099b34)

libcli/security: fix dom_sid_in_domain()

2017-04-11T23:41:14+00:00

Ensure the SID has exactly one component more then the domain SID, eg

Domain SID: S-1-5-21-1-2-3
SID:        S-1-5-21-1-2-3-4

This will return true. If the SID has more components, eg

SID: S-1-5-21-1-2-3-4-5, or
SID: S-1-5-21-1-2-3-4-5-6-7-8

dom_sid_in_domain() must return false.

This was verified against Windows:

     lsa_LookupSids: struct lsa_LookupSids
        out: struct lsa_LookupSids
            domains                  : *
                domains                  : *
                    domains: struct lsa_RefDomainList
                        count                    : 0x00000002 (2)
                        domains                  : *
                            domains: ARRAY(2)
                                domains: struct lsa_DomainInfo
                                    name: struct lsa_StringLarge
                                        length                   : 0x000e (14)
                                        size                     : 0x0010 (16)
                                        string                   : *
                                            string                   : 'BUILTIN'
                                    sid                      : *
                                        sid                      : S-1-5-32
                                domains: struct lsa_DomainInfo
                                    name: struct lsa_StringLarge
                                        length                   : 0x0012 (18)
                                        size                     : 0x0014 (20)
                                        string                   : *
                                            string                   : 'W4EDOM-L4'
                                    sid                      : *
                                        sid                      : S-1-5-21-278041429-3399921908-1452754838
                        max_size                 : 0x00000020 (32)
            names                    : *
                names: struct lsa_TransNameArray
                    count                    : 0x00000004 (4)
                    names                    : *
                        names: ARRAY(4)
                            names: struct lsa_TranslatedName
                                sid_type                 : SID_NAME_USER (1)
                                name: struct lsa_String
                                    length                   : 0x001a (26)
                                    size                     : 0x001a (26)
                                    string                   : *
                                        string                   : 'Administrator'
                                sid_index                : 0x00000001 (1)
                            names: struct lsa_TranslatedName
                                sid_type                 : SID_NAME_UNKNOWN (8)
                                name: struct lsa_String
                                    length                   : 0x005c (92)
                                    size                     : 0x005e (94)
                                    string                   : *
                                        string                   : 'S-1-5-21-278041429-3399921908-1452754838-500-1'
                                sid_index                : 0xffffffff (4294967295)
                            names: struct lsa_TranslatedName
                                sid_type                 : SID_NAME_ALIAS (4)
                                name: struct lsa_String
                                    length                   : 0x001c (28)
                                    size                     : 0x001c (28)
                                    string                   : *
                                        string                   : 'Administrators'
                                sid_index                : 0x00000000 (0)
                            names: struct lsa_TranslatedName
                                sid_type                 : SID_NAME_UNKNOWN (8)
                                name: struct lsa_String
                                    length                   : 0x001c (28)
                                    size                     : 0x001e (30)
                                    string                   : *
                                        string                   : 'S-1-5-32-544-9'
                                sid_index                : 0xffffffff (4294967295)
            count                    : *
                count                    : 0x00000002 (2)
            result                   : STATUS_SOME_UNMAPPED

Pair-Programmed-With: Stefan Metzmacher 

Signed-off-by: Ralph Boehme 
Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison

libcli/security: add SID_NAME_LABEL to sid_type_lookup()

2017-03-23T08:01:21+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison

libcli: Add an overflow check

2017-01-23T21:46:13+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

libcli: Do not overwrite pointer on realloc failure

2017-01-23T21:46:13+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

lib: Add required prerequisites for librpc/gen_ndr/security.h

2016-12-28T19:17:12+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Uri Simchoni

lib: security: se_access_check() incorrectly processes owner rights (S-1-3-4) DENY ace entries

2016-12-10T05:24:11+00:00

Reported and proposed fix by Shilpa K .

When processing DENY ACE entries for owner rights SIDs (S-1-3-4) the
code OR's in the deny access mask bits without taking into account if
they were being requested in the requested access mask.

E.g. The current logic has:

An ACL containining:

[0] SID: S-1-3-4
    TYPE: DENY
    MASK: WRITE_DATA
[1] SID: S-1-3-4
    TYPE: ALLOW
    MASK: ALLOW_ALL

prohibits an open request by the owner for READ_DATA - even though this
is explicitly allowed.

Furthermore a non-canonical ACL containing:

[0] SID: User SID 1-5-21-something
    TYPE: ALLOW
    MASK: READ_DATA

[1] SID: S-1-3-4
    TYPE: DENY
    MASK: READ_DATA

[2] SID: User SID 1-5-21-something
    TYPE: ALLOW
    MASK: WRITE_DATA

prohibits an open request by the owner for READ_DATA|WRITE_DATA - even
though READ_DATA is explicitly allowed in ACE no 0 and is thus already
filtered out of the "access-still-needed" mask when the deny ACE no 1 is
evaluated.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12466

Signed-off-by: Jeremy Allison 
Signed-off-by: Ralph Boehme 
Reviewed-by: Ralph Boehme

lib: Make dom_sid_parse_endp init "endp" on all "ok" paths

2016-12-06T19:24:22+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

libcli: Remove code clone

2016-10-13T16:13:45+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12373
Signed-off-by: Moritz Beller 
Reviewed-by: Jeremy Allison 
Reviewed-by: Simo 

Autobuild-User(master): Volker Lendecke 
Autobuild-Date(master): Thu Oct 13 18:13:45 CEST 2016 on sn-devel-144

lib: Annotate well known SID names

2016-09-29T06:02:18+00:00

Add Samba specific well known SIDs for
Unix UID and GID owner.

Signed-off-by: Steve French 
Reviewed-by: Guenther Deschner