source4/auth/unix_token.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Deal with unix elements in the security token
   5
   6    Copyright (C) Andrew Tridgell 2004
   7    Copyright (C) Andrew Bartlett 2011
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "auth/auth.h"
  25 #include "libcli/wbclient/wbclient.h"
  26 #include "param/param.h"
  27
  28 /*
  29   form a security_unix_token from the current security_token
  30 */
  31 NTSTATUS security_token_to_unix_token(TALLOC_CTX *mem_ctx,
  32                                       struct wbc_context *wbc_ctx,
  33                                       struct security_token *token,
  34                                       struct security_unix_token **sec)
  35 {
  36         int i;
  37         NTSTATUS status;
  38         struct id_map *ids;
  39         struct composite_context *ctx;
  40         *sec = talloc(mem_ctx, struct security_unix_token);
  41
  42         /* we can't do unix security without a user and group */
  43         if (token->num_sids < 2) {
  44                 return NT_STATUS_ACCESS_DENIED;
  45         }
  46
  47         ids = talloc_array(mem_ctx, struct id_map, token->num_sids);
  48         NT_STATUS_HAVE_NO_MEMORY(ids);
  49
  50         (*sec)->ngroups = token->num_sids - 2;
  51         (*sec)->groups = talloc_array(*sec, gid_t, (*sec)->ngroups);
  52         NT_STATUS_HAVE_NO_MEMORY((*sec)->groups);
  53
  54         for (i=0;i<token->num_sids;i++) {
  55                 ZERO_STRUCT(ids[i].xid);
  56                 ids[i].sid = &token->sids[i];
  57                 ids[i].status = ID_UNKNOWN;
  58         }
  59
  60         ctx = wbc_sids_to_xids_send(wbc_ctx, ids, token->num_sids, ids);
  61         NT_STATUS_HAVE_NO_MEMORY(ctx);
  62
  63         status = wbc_sids_to_xids_recv(ctx, &ids);
  64         NT_STATUS_NOT_OK_RETURN(status);
  65
  66         if (ids[0].xid.type == ID_TYPE_BOTH ||
  67             ids[0].xid.type == ID_TYPE_UID) {
  68                 (*sec)->uid = ids[0].xid.id;
  69         } else {
  70                 return NT_STATUS_INVALID_SID;
  71         }
  72
  73         if (ids[1].xid.type == ID_TYPE_BOTH ||
  74             ids[1].xid.type == ID_TYPE_GID) {
  75                 (*sec)->gid = ids[1].xid.id;
  76         } else {
  77                 return NT_STATUS_INVALID_SID;
  78         }
  79
  80         for (i=0;i<(*sec)->ngroups;i++) {
  81                 if (ids[i+2].xid.type == ID_TYPE_BOTH ||
  82                     ids[i+2].xid.type == ID_TYPE_GID) {
  83                         (*sec)->groups[i] = ids[i+2].xid.id;
  84                 } else {
  85                         return NT_STATUS_INVALID_SID;
  86                 }
  87         }
  88
  89         TALLOC_FREE(ids);
  90
  91         return NT_STATUS_OK;
  92 }
  93
  94 /*
  95   Fill in the auth_user_info_unix and auth_unix_token elements in a struct session_info
  96 */
  97 NTSTATUS auth_session_info_fill_unix( struct wbc_context *wbc_ctx,
  98                                      struct loadparm_context *lp_ctx,
  99                                      struct auth_session_info *session_info)
 100 {
 101         char *su;
 102         size_t len;
 103         NTSTATUS status = security_token_to_unix_token(session_info, wbc_ctx,
 104                                                        session_info->security_token,
 105                                                        &session_info->unix_token);
 106         if (!NT_STATUS_IS_OK(status)) {
 107                 return status;
 108         }
 109
 110         session_info->unix_info = talloc_zero(session_info, struct auth_user_info_unix);
 111         NT_STATUS_HAVE_NO_MEMORY(session_info->unix_info);
 112
 113         session_info->unix_info->system = security_token_is_system(session_info->security_token);
 114
 115         session_info->unix_info->unix_name = talloc_asprintf(session_info->unix_info,
 116                                                              "%s%s%s", session_info->info->domain_name,
 117                                                              lpcfg_winbind_separator(lp_ctx),
 118                                                              session_info->info->account_name);
 119         NT_STATUS_HAVE_NO_MEMORY(session_info->unix_info->unix_name);
 120
 121         len = strlen(session_info->info->account_name) + 1;
 122         session_info->unix_info->sanitized_username = su = talloc_array(session_info->unix_info, char, len);
 123         NT_STATUS_HAVE_NO_MEMORY(su);
 124
 125         alpha_strcpy(su, session_info->info->account_name,
 126                      ". _-$", len);
 127
 128         return NT_STATUS_OK;
 129 }