samba.git/libcli/security, branch talloc-2.4.0 Unnamed repository; edit this file 'description' to name the repository. libcli/security: Make null_sid static const, not just const 2022-10-21T03:57:33+00:00 Joseph Sutton josephsutton@catalyst.net.nz 2022-09-27T02:05:16+00:00 16746593db507ead2df227974b43c43c24b25340 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
libcli/security: Fix function header comments in SID handling 2022-10-21T03:57:33+00:00 Joseph Sutton josephsutton@catalyst.net.nz 2022-09-27T02:04:49+00:00 7ec569b3a6023a8f7c673820920f0d740241b30e Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
libcli security/sddl: Make sddl_encode_ace visible 2022-09-27T16:46:35+00:00 Christian Merten christian@merten.dev 2022-09-19T20:53:45+00:00 6501e4f00e5a36debdf44add1335818a791552f0 Removed static flag from sddl_encode_ace and added to headers. Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Signed-off-by: Christian Merten <christian@merten.dev> 
Removed static flag from sddl_encode_ace and added to headers.

Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Christian Merten <christian@merten.dev>
libcli security_descriptor: Compare object type and inherited object type when comparing ACEs 2022-09-27T16:46:35+00:00 Christian Merten christian@merten.dev 2022-09-19T20:50:58+00:00 1a9aac53e8ee081cf6d2028de759563120619554 Fixed security_ace_equal returning true, despite differing object type, by checking (inherited) object type of both ACEs is equal. Signed-off-by: Christian Merten <christian@merten.dev> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> 
Fixed security_ace_equal returning true, despite differing object type, by checking (inherited) object type
of both ACEs is equal.

Signed-off-by: Christian Merten <christian@merten.dev>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
libcli security_descriptor: Add function to delete a given ace from a security descriptor 2022-09-27T16:46:35+00:00 Christian Merten christian@merten.dev 2022-09-19T20:47:10+00:00 7efe673fbdcd27ddd23f36281c5f5338681a68fe Two functions have been added to delete a given ace from the SACL or the DACL of a security descriptor. Signed-off-by: Christian Merten <christian@merten.dev> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> 
Two functions have been added to delete a given ace from the SACL or the DACL of a security descriptor.

Signed-off-by: Christian Merten <christian@merten.dev>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
CVE-2020-25720: s4-acl: Owner no longer has implicit Write DACL 2022-09-16T02:32:36+00:00 Nadezhda Ivanova nivanova@symas.com 2021-10-22T18:33:03+00:00 5073d5997cb1d7f654423655e0d1eeb117bdab38 The implicit right of an object's owner to modify its security descriptor no longer exists, according to the new access rules. However, we continue to grant this implicit right for fileserver access checks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> 
The implicit right of an object's owner to modify its security
descriptor no longer exists, according to the new access rules. However,
we continue to grant this implicit right for fileserver access checks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810

Signed-off-by: Nadezhda Ivanova <nivanova@symas.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
libcli/security: Fix typos 2022-06-14T07:21:29+00:00 Joseph Sutton josephsutton@catalyst.net.nz 2022-04-28T08:32:51+00:00 45f2e3631e1424f99915a01bdf4808189bd8a6d7 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
 sddl: Remove SDDL SID strings unsupported by Windows 2022-03-17T23:11:37+00:00 Joseph Sutton josephsutton@catalyst.net.nz 2022-03-14T05:18:39+00:00 1137ebc654e4dfd91601abd20262024063a495c8 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
sddl: Add new SDDL SID strings 2022-03-17T23:11:37+00:00 Joseph Sutton josephsutton@catalyst.net.nz 2022-03-14T05:18:09+00:00 732d17a129ab0f48d0025f5992af38d442b1fc6a Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
sddl: Fix incorrect SDDL SID strings 2022-03-17T23:11:37+00:00 Joseph Sutton josephsutton@catalyst.net.nz 2022-03-14T05:14:15+00:00 e61fa573fe1a911460cfb3b64ba05b031d124256 Change the values to match those used by Windows. Verified with PowerShell commands of the form: New-Object Security.Principal.SecurityIdentifier ER Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> 
Change the values to match those used by Windows.

Verified with PowerShell commands of the form:
New-Object Security.Principal.SecurityIdentifier ER

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>